: Sometimes a simple search for the flag format works if the data isn't compressed or encrypted. Command: strings mem.raw | grep "DUCTF{"
To give you a more specific solution, are you stuck on a or looking for the exact location of the flag within the memory dump? File: A_Whore_New_World-final.zip ...
: Ensure the zip downloaded completely; forensics files are often several gigabytes. : Sometimes a simple search for the flag