c47chm31fy0uc4n

A Linux server is suspected to have been compromised.

During the incident window, administrators observed suspicious user activity and abnormal process behavior, but no malicious binaries were recovered from disk.

You are provided with a full memory dump of the system taken shortly after the incident.

Initial triage suggests that an attacker may have:

Accessed the system remotely

Executed a malicious userspace program

Exfiltrated sensitive session data before disappearing

Your task is to analyze the memory dump and reconstruct what happened.

Objectives

Using only the provided memory dump, determine:

The session key exfiltrated by the malicious process

The epoch timestamp used during the exfiltration

The IP address the program exfiltrated sensitive data to.

The ephemeral source port used by the attacker during remote access

You must correlate process activity, memory artifacts, and session metadata to arrive at your answer. flag format:

p_ctf{:::}