challenge descreption : Use the memory image in the Google drive link below. An attacker left behind some evidence in the network connections. Follow the attacker's tracks to find the flag.

challenge hint : Try connecting to the attacker's system.

challenge file : recent-memory.mem

step by step writeup :
1- Given this memory dump, we will use Volatility to proceed. ( command vol.py -f recent-memory.mem windows.netscan.NetScan
( to follow the hint that there are evidence in network connections )

2- after investigation of the connections and the process name we find process name ( nc.exe ) pid ( 2756 )
connection state ( ESTABLISHED ) ip ( 161.35.53.62 ) port ( 5283 ) it seems that the attacker ip

3- hint says Try connecting to the attacker's system. ( using netcat command (nc 161.35.53.62 5283) )

### flag : ctf{f0ll0w_7h3_7r41l}