Ransomémoire 2/3 - Début d'investigation

Description

Phew, you were able to recover your precious file. Now you investigate the origin of this encryption.

The flag is case insensitive and follows the format FCSC{<pid>:<protocol>:<port>}, where:

• <pid> is the PID of the process that dropped and performed the encryption and
• <protocol> and <port> are the parameters of the connection with the C&C.

This challenge has been split into four parts:

• Ransomémoire 0/3 - Pour commencer.
• Ransomémoire 1/3 - Mon précieux.
• Ransomémoire 2/3 - Début d’investigation.
• Ransomémoire 3/3 - Doppelgänger.