2024GHCTF的三道取证题[GHCTF2024新生赛]皆非取证vol.py-fchall.vmem--profile=Win7SP1x64filescan|grepzip找到压缩包vol.py-fchall.vmem--profile=Win7SP1x64mimikatzmrl64l0v3miku这个是密码，解压得flag[GHCTF2024新生赛]是名取证vol.py-fchall.vmem--profile