The Nixu Challenge - 2019 - Bad memories - part 3
-------------------------------------------------

So the assignment tells us that a graphical designer was working on something, so we're looking for some image file most likely.

Let's check the consoles:

        volatility -f mem.dmp --profile=Win7SP1x64 consoles

The output tells that flag.txt was deleted (and recovered in Bad Memories pt2 writeup), but flag.bmp is left intact.

Let's see what was running when the dump was taken:

        volatility -f mem.dmp --profile=Win7SP1x64 cmdline
	--snip--
	************************************************************************
	mspaint.exe pid:   2816
	Command line : "C:\Windows\system32\mspaint.exe" "C:\Users\Alice\Pictures\flag.bmp"
	************************************************************************
	--snip--

Tells that PID 2816 is a mspaint instance, with flag.bmp open.

Then we'll dump the mspaint's data:

        volatility -f mem.dmp --profile=Win7SP1x64 memdump -p 2816 -D .

This dumps the paint's data to 2816.dmp

Next we open the 2816.data with Gimp with the following settings:

        Image:
        offset 7162600
        width: 1000
        height: 800

Then we can read the text in the image:

        NIXU{c4n_you_3nhanc3_this}
        NIXU
        cybercybercyber