In Windows Task Manager, I right clicked a process and selected “Create dump file”. I’ll give you the dump, but in return, give me the flag!

Attachment: A compressed Windows process dump


I’m sure the creators had something very interesting in mind, however it seems they didn’t verify all the possibilities, because after extracting the xz file, I was able to run:

strings RunMe.DMP | grep -E "^SharifCTF{[0-9a-f]{32}}$"

Which returned the flag: SharifCTF{4d7328869acb371ede596d73ce0a9af8}

End that was the end of it