Description
The memory dump was taken while a user was working on a highly sensitive document. If the workstation was compromised, this document may have been stolen. Can you find:
- the name of the document editing software,
- the name of the document.
The flag is in the format FCSC{<software name>:<document name>} where:
<software name>is the name of the editing software’s executable, and<document name>is the name of the document being edited by the user (without the file path).
For example: FCSC{calc.exe:My accounts 2025.txt}.
Files
-
analyse-memoire.tar.xz
1.05 GiB – 59dbdb3d2e0eb219afc63fa086069b0e21cad79060ca3752b75e910058fce206
Author
haxom
Flag
Submit your solution
You can submit your writeup for this challenge. Read the FAQ to learn how to proceed.
You need to be logged in to submit a writeup.