menggambar
Solved by: grb
This is what the challenge looks like, there's a link attached to the challenge that leads us to a memdump file.
In this challenge, I will use Volatility3 for analyzing the memdump file. Lets start by using the banners.Banner module. We wanna know what memory dump are we working with.
It came out empty, maybe its not a linux memdump. Let's try windows.info.Info module to dump the Windows version info next.
Bingo! So it is a Windows memdump. Next, because the challenge description told us to get their image becuase their computer crashed while they were drawing, lets try to list the running processes with windows.pslist.PsList.
Volatility 3 Framework 2.27.0
Progress: 100.00 PDB scanning finished
PID PPID ImageFileName Offset(V) Threads Handles SessionId Wow64 CreateTime ExitTime File output
4 0 System 0xad8b4185e040 130 - N/A False 2025-09-02 07:32:53.000000 UTC N/A Disabled
72 4 Registry 0xad8b41957080 4 - N/A False 2025-09-02 07:32:47.000000 UTC N/A Disabled
540 4 smss.exe 0xad8b448f0040 2 - N/A False 2025-09-02 07:32:53.000000 UTC N/A Disabled
640 632 csrss.exe 0xad8b44d59080 10 - 0 False 2025-09-02 07:32:55.000000 UTC N/A Disabled
716 708 csrss.exe 0xad8b4558a140 11 - 1 False 2025-09-02 07:32:56.000000 UTC N/A Disabled
724 632 wininit.exe 0xad8b455b1080 1 - 0 False 2025-09-02 07:32:56.000000 UTC N/A Disabled
772 708 winlogon.exe 0xad8b45c28080 4 - 1 False 2025-09-02 07:32:56.000000 UTC N/A Disabled
840 724 services.exe 0xad8b45c69080 6 - 0 False 2025-09-02 07:32:56.000000 UTC N/A Disabled
848 724 lsass.exe 0xad8b45c6d080 8 - 0 False 2025-09-02 07:32:56.000000 UTC N/A Disabled
932 772 fontdrvhost.ex 0xad8b45cd3140 5 - 1 False 2025-09-02 07:32:57.000000 UTC N/A Disabled
940 724 fontdrvhost.ex 0xad8b45cd4080 5 - 0 False 2025-09-02 07:32:57.000000 UTC N/A Disabled
976 840 svchost.exe 0xad8b45d04240 17 - 0 False 2025-09-02 07:32:57.000000 UTC N/A Disabled
608 840 svchost.exe 0xad8b45d3d2c0 9 - 0 False 2025-09-02 07:32:57.000000 UTC N/A Disabled
564 772 dwm.exe 0xad8b45dd2080 15 - 1 False 2025-09-02 07:32:58.000000 UTC N/A Disabled
1092 840 svchost.exe 0xad8b45e3d240 57 - 0 False 2025-09-02 07:32:58.000000 UTC N/A Disabled
1104 840 svchost.exe 0xad8b45e472c0 13 - 0 False 2025-09-02 07:32:58.000000 UTC N/A Disabled
1136 840 svchost.exe 0xad8b45e492c0 14 - 0 False 2025-09-02 07:32:58.000000 UTC N/A Disabled
1168 840 svchost.exe 0xad8b45e78280 19 - 0 False 2025-09-02 07:32:58.000000 UTC N/A Disabled
1304 840 svchost.exe 0xad8b45e4b080 22 - 0 False 2025-09-02 07:32:59.000000 UTC N/A Disabled
1520 4 MemCompression 0xad8b418c8040 62 - N/A False 2025-09-02 07:33:00.000000 UTC N/A Disabled
1548 840 svchost.exe 0xad8b45c172c0 17 - 0 False 2025-09-02 07:33:00.000000 UTC N/A Disabled
1616 840 svchost.exe 0xad8b45fdf2c0 2 - 0 False 2025-09-02 07:33:01.000000 UTC N/A Disabled
1672 840 svchost.exe 0xad8b45fe7240 9 - 0 False 2025-09-02 07:33:01.000000 UTC N/A Disabled
1728 840 svchost.exe 0xad8b41958080 3 - 0 False 2025-09-02 07:33:01.000000 UTC N/A Disabled
1756 840 svchost.exe 0xad8b4194d080 4 - 0 False 2025-09-02 07:33:01.000000 UTC N/A Disabled
1800 840 svchost.exe 0xad8b41944080 8 - 0 False 2025-09-02 07:33:01.000000 UTC N/A Disabled
1940 840 spoolsv.exe 0xad8b4615d200 6 - 0 False 2025-09-02 07:33:02.000000 UTC N/A Disabled
1956 840 svchost.exe 0xad8b461602c0 15 - 0 False 2025-09-02 07:33:02.000000 UTC N/A Disabled
2108 840 svchost.exe 0xad8b4629b240 11 - 0 False 2025-09-02 07:33:03.000000 UTC N/A Disabled
2152 840 MpDefenderCore 0xad8b462b5080 10 - 0 False 2025-09-02 07:33:03.000000 UTC N/A Disabled
2216 840 VGAuthService. 0xad8b46304300 2 - 0 False 2025-09-02 07:33:04.000000 UTC N/A Disabled
2236 840 MsMpEng.exe 0xad8b46337340 24 - 0 False 2025-09-02 07:33:04.000000 UTC N/A Disabled
2244 840 vmtoolsd.exe 0xad8b463350c0 12 - 0 False 2025-09-02 07:33:04.000000 UTC N/A Disabled
2256 840 vm3dservice.ex 0xad8b46333080 3 - 0 False 2025-09-02 07:33:04.000000 UTC N/A Disabled
2460 2256 vm3dservice.ex 0xad8b46409300 4 - 1 False 2025-09-02 07:33:04.000000 UTC N/A Disabled
2648 840 SearchIndexer. 0xad8b464e3240 19 - 0 False 2025-09-02 07:33:06.000000 UTC N/A Disabled
2852 976 dllhost.exe 0xad8b465cf2c0 4 - 0 False 2025-09-02 07:33:07.000000 UTC N/A Disabled
2896 840 dllhost.exe 0xad8b465f3280 11 - 0 False 2025-09-02 07:33:07.000000 UTC N/A Disabled
3056 976 WmiPrvSE.exe 0xad8b464b0300 12 - 0 False 2025-09-02 07:33:08.000000 UTC N/A Disabled
2196 1092 sihost.exe 0xad8b467cf280 13 - 1 False 2025-09-02 07:33:13.000000 UTC N/A Disabled
2596 840 svchost.exe 0xad8b468f32c0 10 - 1 False 2025-09-02 07:33:13.000000 UTC N/A Disabled
1440 1092 MicrosoftEdgeU 0xad8b46909300 4 - 0 True 2025-09-02 07:33:13.000000 UTC N/A Disabled
3124 1092 taskhostw.exe 0xad8b46938300 8 - 1 False 2025-09-02 07:33:14.000000 UTC N/A Disabled
3320 1168 ctfmon.exe 0xad8b46976280 9 - 1 False 2025-09-02 07:33:14.000000 UTC N/A Disabled
3760 772 userinit.exe 0xad8b46a90080 0 - 1 False 2025-09-02 07:33:18.000000 UTC 2025-09-02 07:34:01.000000 UTC Disabled
3796 3760 explorer.exe 0xad8b46aad340 0 - 1 False 2025-09-02 07:33:19.000000 UTC 2025-09-02 08:07:24.000000 UTC Disabled
3948 840 svchost.exe 0xad8b46ae92c0 5 - 0 False 2025-09-02 07:33:20.000000 UTC N/A Disabled
3408 840 svchost.exe 0xad8b46c922c0 5 - 1 False 2025-09-02 07:33:23.000000 UTC N/A Disabled
3548 840 msdtc.exe 0xad8b46cb8280 9 - 0 False 2025-09-02 07:33:23.000000 UTC N/A Disabled
4312 840 svchost.exe 0xad8b46f1d2c0 5 - 0 False 2025-09-02 07:33:29.000000 UTC N/A Disabled
4528 840 svchost.exe 0xad8b4702e2c0 8 - 0 False 2025-09-02 07:33:35.000000 UTC N/A Disabled
4724 840 NisSrv.exe 0xad8b4690c080 3 - 0 False 2025-09-02 07:33:37.000000 UTC N/A Disabled
5104 976 RuntimeBroker. 0xad8b472ca2c0 2 - 1 False 2025-09-02 07:33:41.000000 UTC N/A Disabled
3956 976 RuntimeBroker. 0xad8b475412c0 8 - 1 False 2025-09-02 07:33:45.000000 UTC N/A Disabled
5488 976 SkypeApp.exe 0xad8b47580300 40 - 1 False 2025-09-02 07:33:59.000000 UTC N/A Disabled
5552 976 backgroundTask 0xad8b477de240 5 - 1 False 2025-09-02 07:33:59.000000 UTC N/A Disabled
5576 976 SkypeBackgroun 0xad8b47642300 3 - 1 False 2025-09-02 07:33:59.000000 UTC N/A Disabled
5888 976 RuntimeBroker. 0xad8b478f62c0 5 - 1 False 2025-09-02 07:34:04.000000 UTC N/A Disabled
5284 976 RuntimeBroker. 0xad8b475302c0 4 - 1 False 2025-09-02 07:34:10.000000 UTC N/A Disabled
3776 3796 SecurityHealth 0xad8b47536080 1 - 1 False 2025-09-02 07:34:11.000000 UTC N/A Disabled
1968 840 SecurityHealth 0xad8b476a0080 8 - 0 False 2025-09-02 07:34:11.000000 UTC N/A Disabled
5676 3796 vmtoolsd.exe 0xad8b476a7080 7 - 1 False 2025-09-02 07:34:12.000000 UTC N/A Disabled
5948 3796 msedge.exe 0xad8b47a52080 0 - 1 False 2025-09-02 07:34:13.000000 UTC 2025-09-02 08:03:41.000000 UTC Disabled
3188 976 ApplicationFra 0xad8b47b0a080 4 - 1 False 2025-09-02 07:34:59.000000 UTC N/A Disabled
6396 840 SgrmBroker.exe 0xad8b4763c080 7 - 0 False 2025-09-02 07:35:11.000000 UTC N/A Disabled
6088 840 svchost.exe 0xad8b468f8080 8 - 0 False 2025-09-02 07:35:21.000000 UTC N/A Disabled
6952 840 svchost.exe 0xad8b47a842c0 3 - 0 False 2025-09-02 07:35:46.000000 UTC N/A Disabled
1704 976 dllhost.exe 0xad8b47ed3340 7 - 1 False 2025-09-02 07:35:48.000000 UTC N/A Disabled
2536 1168 dasHost.exe 0xad8b47a9e080 1 - 0 False 2025-09-02 07:36:06.000000 UTC N/A Disabled
6568 840 svchost.exe 0xad8b475762c0 4 - 0 False 2025-09-02 07:36:12.000000 UTC N/A Disabled
1668 3796 cmd.exe 0xad8b47b6a080 1 - 1 False 2025-09-02 07:36:41.000000 UTC N/A Disabled
2072 1668 conhost.exe 0xad8b47b9e080 4 - 1 False 2025-09-02 07:36:42.000000 UTC N/A Disabled
6588 6188 OneDrive.Sync. 0xad8b47ab6080 16 - 1 False 2025-09-02 07:36:56.000000 UTC N/A Disabled
2040 6336 OneDrive.exe 0xad8b47a91080 33 - 1 False 2025-09-02 07:37:22.000000 UTC N/A Disabled
7120 3796 cmd.exe 0xad8b485d8080 1 - 1 False 2025-09-02 07:38:44.000000 UTC N/A Disabled
5396 7120 conhost.exe 0xad8b48c5d080 3 - 1 False 2025-09-02 07:38:44.000000 UTC N/A Disabled
6340 1092 taskhostw.exe 0xad8b48c1b080 6 - 1 False 2025-09-02 07:39:17.000000 UTC N/A Disabled
1900 976 RuntimeBroker. 0xad8b47ba8080 2 - 1 False 2025-09-02 07:40:42.000000 UTC N/A Disabled
6676 2196 SkypeBridge.ex 0xad8b47c09080 11 - 1 False 2025-09-02 07:41:34.000000 UTC N/A Disabled
4204 840 svchost.exe 0xad8b4720a080 3 - 0 False 2025-09-02 07:46:35.000000 UTC N/A Disabled
8072 3796 notepad.exe 0xad8b47fed080 2 - 1 False 2025-09-02 07:50:09.000000 UTC N/A Disabled
5956 840 svchost.exe 0xad8b47b65080 3 - 0 False 2025-09-02 07:56:27.000000 UTC N/A Disabled
7568 3796 FTK Imager.exe 0xad8b47b37080 26 - 1 False 2025-09-02 07:58:37.000000 UTC N/A Disabled
4056 5948 msedge.exe 0xad8b47b5f080 46 - 1 False 2025-09-02 08:03:37.000000 UTC N/A Disabled
6884 4056 msedge.exe 0xad8b47b2f080 7 - 1 False 2025-09-02 08:03:38.000000 UTC N/A Disabled
5376 4056 msedge.exe 0xad8b483ae080 15 - 1 False 2025-09-02 08:03:38.000000 UTC N/A Disabled
7992 4056 msedge.exe 0xad8b4aace340 14 - 1 False 2025-09-02 08:03:38.000000 UTC N/A Disabled
7572 4056 msedge.exe 0xad8b4ac5b340 9 - 1 False 2025-09-02 08:03:38.000000 UTC N/A Disabled
5188 2040 explorer.exe 0xad8b47bb8340 70 - 1 False 2025-09-02 08:07:25.000000 UTC N/A Disabled
5288 976 StartMenuExper 0xad8b47b61080 7 - 1 False 2025-09-02 08:07:40.000000 UTC N/A Disabled
7796 976 TextInputHost. 0xad8b47ba1080 10 - 1 False 2025-09-02 08:07:41.000000 UTC N/A Disabled
392 976 SearchApp.exe 0xad8b47b31080 41 - 1 False 2025-09-02 08:07:56.000000 UTC N/A Disabled
2600 840 svchost.exe 0xad8b47a53080 28 - 0 False 2025-09-02 08:15:43.000000 UTC N/A Disabled
1124 976 SearchApp.exe 0xad8b47b9d080 13 - 1 False 2025-09-02 08:18:04.000000 UTC N/A Disabled
4616 1124 msedgewebview2 0xad8b46974080 56 - 1 False 2025-09-02 08:18:07.000000 UTC N/A Disabled
568 4616 msedgewebview2 0xad8b47ba3080 9 - 1 False 2025-09-02 08:18:07.000000 UTC N/A Disabled
7232 4616 msedgewebview2 0xad8b46bf9080 18 - 1 False 2025-09-02 08:18:11.000000 UTC N/A Disabled
3196 4616 msedgewebview2 0xad8b48c75080 19 - 1 False 2025-09-02 08:18:11.000000 UTC N/A Disabled
5088 4616 msedgewebview2 0xad8b48533080 15 - 1 False 2025-09-02 08:18:11.000000 UTC N/A Disabled
6968 4616 msedgewebview2 0xad8b4769d080 9 - 1 False 2025-09-02 08:18:11.000000 UTC N/A Disabled
7460 976 Microsoft.Phot 0xad8b47c11080 16 - 1 False 2025-09-02 08:18:50.000000 UTC N/A Disabled
6076 976 RuntimeBroker. 0xad8b46f1c080 4 - 1 False 2025-09-02 08:19:01.000000 UTC N/A Disabled
900 976 SystemSettings 0xad8b46e70080 19 - 1 False 2025-09-02 08:19:18.000000 UTC N/A Disabled
6052 976 UserOOBEBroker 0xad8b47097080 2 - 1 False 2025-09-02 08:19:20.000000 UTC N/A Disabled
4684 840 svchost.exe 0xad8b4a5b7240 4 - 0 False 2025-09-02 08:20:32.000000 UTC N/A Disabled
6276 976 smartscreen.ex 0xad8b46ebe080 7 - 1 False 2025-09-02 08:20:48.000000 UTC N/A Disabled
4560 5188 mspaint.exe 0xad8b47ed2080 5 - 1 False 2025-09-02 08:20:49.000000 UTC N/A Disabled
7684 976 FileCoAuth.exe 0xad8b48a38080 6 - 1 False 2025-09-02 08:24:14.000000 UTC N/A Disabled
6688 2648 SearchProtocol 0xad8b48cee080 6 - 1 False 2025-09-02 08:24:39.000000 UTC N/A Disabled
3660 2648 SearchFilterHo 0xad8b483ab080 6 - 0 False 2025-09-02 08:24:40.000000 UTC N/A Disabled
So as you can see, we know that mspaint.exe is indeed running. There's also some other interesting stuff such as notepad.exe, maybe we should try to dump that, see if there's any information that we can pull. We can use windows.memmap module with --dump and --pid parameter to dump process memory. After we run the volatility, there should be a single process dump on your current directory.
After we dump it, lets open it under a hex editor, see if there's anything related to the "gambar" (image) that we want to recover, and we did find something.
So, the string above looks like a dialog between two people, one of them is asking why does the image looks broken, and the other one said its because the width and the height of the image is wrong, and they said that the width and height of the image is 600x282, and when one of them asked for the offset (which probably means we need to manually look for the image in the mspaint.exe dump), the other one said to "look for yourself!". Alrighty, this is good, getting the width and height of the image is a good step for increasing our chance of recovering the image. Next, lets dump the mspaint.exe process.
Next, with the clue we had, I asked an LLM for a script to extract images from raw data bytes from the mspaint.exe process dump. I also want to calculate the entropy of each candidate, a lower entropy means there's a higher chance that the image generated looks more valid than some static mess, and I chose 3 as the maximum entropy, any higher than that would not going to be extracted. You can check the script here. When we run the script against the mspaint.exe process dump, this is some of the outputs.
Scanning pid.4560.dmp width 600 height 282 step 4096
Saved candidate: mspaint_candidates/cand_off3088384_w600x282_RGB_ent2.99.png ent= 2.992075952356677
Saved candidate: mspaint_candidates/cand_off3096576_w600x282_RGB_ent2.97.png ent= 2.972235665725512
Saved candidate: mspaint_candidates/cand_off3100672_w600x282_RGB_ent2.96.png ent= 2.956637639898204
Saved candidate: mspaint_candidates/cand_off3104768_w600x282_RGB_ent2.97.png ent= 2.9688230062818293
Saved candidate: mspaint_candidates/cand_off3108864_w600x282_RGB_ent2.98.png ent= 2.9815701030143154
Saved candidate: mspaint_candidates/cand_off3112960_w600x282_RGB_ent2.98.png ent= 2.979802638112861
Saved candidate: mspaint_candidates/cand_off3117056_w600x282_RGB_ent2.98.png ent= 2.9847878459567876
Saved candidate: mspaint_candidates/cand_off3129344_w600x282_RGB_ent3.00.png ent= 2.9956776093993533
Saved candidate: mspaint_candidates/cand_off3133440_w600x282_RGB_ent3.00.png ent= 2.9959530022258503
Saved candidate: mspaint_candidates/cand_off3137536_w600x282_RGB_ent2.97.png ent= 2.973637531949753
Saved candidate: mspaint_candidates/cand_off3141632_w600x282_RGB_ent2.97.png ent= 2.966052833343397
Saved candidate: mspaint_candidates/cand_off3145728_w600x282_RGB_ent2.95.png ent= 2.9492148762382397
Saved candidate: mspaint_candidates/cand_off3149824_w600x282_RGB_ent2.92.png ent= 2.923610237115141
Saved candidate: mspaint_candidates/cand_off3153920_w600x282_RGB_ent2.90.png ent= 2.8955937418514663
Saved candidate: mspaint_candidates/cand_off3158016_w600x282_RGB_ent2.87.png ent= 2.8687326055334132
Saved candidate: mspaint_candidates/cand_off3162112_w600x282_RGB_ent2.88.png ent= 2.876757987807493
Saved candidate: mspaint_candidates/cand_off3166208_w600x282_RGB_ent2.85.png ent= 2.8529920884694837
Saved candidate: mspaint_candidates/cand_off3170304_w600x282_RGB_ent2.87.png ent= 2.869500094953436
Saved candidate: mspaint_candidates/cand_off3174400_w600x282_RGB_ent2.89.png ent= 2.886980736278336
Saved candidate: mspaint_candidates/cand_off3178496_w600x282_RGB_ent2.87.png ent= 2.873203758148785
Saved candidate: mspaint_candidates/cand_off3182592_w600x282_RGB_ent2.85.png ent= 2.8537568951857137
Saved candidate: mspaint_candidates/cand_off3186688_w600x282_RGB_ent2.85.png ent= 2.8456409960866806
Saved candidate: mspaint_candidates/cand_off3190784_w600x282_RGB_ent2.84.png ent= 2.8353229327446265
Saved candidate: mspaint_candidates/cand_off3194880_w600x282_RGB_ent2.82.png ent= 2.818016594936528
Saved candidate: mspaint_candidates/cand_off3198976_w600x282_RGB_ent2.79.png ent= 2.7863456729654312
Saved candidate: mspaint_candidates/cand_off3203072_w600x282_RGB_ent2.79.png ent= 2.7860805178394967
Saved candidate: mspaint_candidates/cand_off3207168_w600x282_RGB_ent2.80.png ent= 2.7980271516631556
Saved candidate: mspaint_candidates/cand_off3211264_w600x282_RGB_ent2.80.png ent= 2.8017254393683495
Saved candidate: mspaint_candidates/cand_off3215360_w600x282_RGB_ent2.80.png ent= 2.8010648703114875
Saved candidate: mspaint_candidates/cand_off3219456_w600x282_RGB_ent2.79.png ent= 2.788768417340305
Saved candidate: mspaint_candidates/cand_off3223552_w600x282_RGB_ent2.80.png ent= 2.796671760104214
Saved candidate: mspaint_candidates/cand_off3227648_w600x282_RGB_ent2.80.png ent= 2.796787676544265
Saved candidate: mspaint_candidates/cand_off3231744_w600x282_RGB_ent2.80.png ent= 2.7979133136030945
Saved candidate: mspaint_candidates/cand_off3235840_w600x282_RGB_ent2.80.png ent= 2.7994613496370495
Saved candidate: mspaint_candidates/cand_off3239936_w600x282_RGB_ent2.79.png ent= 2.794645850887597
Saved candidate: mspaint_candidates/cand_off3244032_w600x282_RGB_ent2.79.png ent= 2.789063098271013
Saved candidate: mspaint_candidates/cand_off3248128_w600x282_RGB_ent2.80.png ent= 2.796667174199392
Saved candidate: mspaint_candidates/cand_off3252224_w600x282_RGB_ent2.82.png ent= 2.8247608643166826
Saved candidate: mspaint_candidates/cand_off3256320_w600x282_RGB_ent2.84.png ent= 2.8393963793688846
Saved candidate: mspaint_candidates/cand_off3260416_w600x282_RGB_ent2.84.png ent= 2.842812366320284
Saved candidate: mspaint_candidates/cand_off3264512_w600x282_RGB_ent2.84.png ent= 2.8446433617791524
Saved candidate: mspaint_candidates/cand_off3268608_w600x282_RGB_ent2.82.png ent= 2.824603301748778
Saved candidate: mspaint_candidates/cand_off3272704_w600x282_RGB_ent2.81.png ent= 2.808540860242681
Saved candidate: mspaint_candidates/cand_off3276800_w600x282_RGB_ent2.80.png ent= 2.796942014458949
Saved candidate: mspaint_candidates/cand_off3280896_w600x282_RGB_ent2.79.png ent= 2.785171429806253
Saved candidate: mspaint_candidates/cand_off3284992_w600x282_RGB_ent2.79.png ent= 2.7886822872432364
Saved candidate: mspaint_candidates/cand_off3289088_w600x282_RGB_ent2.81.png ent= 2.8106344480329755
Saved candidate: mspaint_candidates/cand_off3293184_w600x282_RGB_ent2.81.png ent= 2.8121120786061033
Saved candidate: mspaint_candidates/cand_off3297280_w600x282_RGB_ent2.81.png ent= 2.8079312325523014
Saved candidate: mspaint_candidates/cand_off3301376_w600x282_RGB_ent2.81.png ent= 2.8082782775281783
Saved candidate: mspaint_candidates/cand_off3305472_w600x282_RGB_ent2.80.png ent= 2.8030903729666976
Saved candidate: mspaint_candidates/cand_off3309568_w600x282_RGB_ent2.81.png ent= 2.8078139460055898
Saved candidate: mspaint_candidates/cand_off3313664_w600x282_RGB_ent2.82.png ent= 2.8239143605009978
Saved candidate: mspaint_candidates/cand_off3317760_w600x282_RGB_ent2.83.png ent= 2.8270142381294665
Saved candidate: mspaint_candidates/cand_off3321856_w600x282_RGB_ent2.84.png ent= 2.836913397557497
Saved candidate: mspaint_candidates/cand_off3325952_w600x282_RGB_ent2.85.png ent= 2.850227888697375
Saved candidate: mspaint_candidates/cand_off3330048_w600x282_RGB_ent2.87.png ent= 2.87104076308292
Saved candidate: mspaint_candidates/cand_off3334144_w600x282_RGB_ent2.88.png ent= 2.882852779579435
Saved candidate: mspaint_candidates/cand_off3338240_w600x282_RGB_ent2.89.png ent= 2.894926106053967
Saved candidate: mspaint_candidates/cand_off3342336_w600x282_RGB_ent2.91.png ent= 2.9083012231521206
Saved candidate: mspaint_candidates/cand_off3346432_w600x282_RGB_ent2.92.png ent= 2.9213714663329884
Saved candidate: mspaint_candidates/cand_off3350528_w600x282_RGB_ent2.92.png ent= 2.921944583923307
Saved candidate: mspaint_candidates/cand_off3354624_w600x282_RGB_ent2.93.png ent= 2.9298735220380125
Saved candidate: mspaint_candidates/cand_off3358720_w600x282_RGB_ent2.94.png ent= 2.939608854780601
Saved candidate: mspaint_candidates/cand_off3362816_w600x282_RGB_ent2.94.png ent= 2.9440247569183535
Saved candidate: mspaint_candidates/cand_off3366912_w600x282_RGB_ent2.94.png ent= 2.9428360205118627
Saved candidate: mspaint_candidates/cand_off3371008_w600x282_RGB_ent2.94.png ent= 2.937155977613211
Saved candidate: mspaint_candidates/cand_off3375104_w600x282_RGB_ent2.95.png ent= 2.948161089608949
Saved candidate: mspaint_candidates/cand_off3379200_w600x282_RGB_ent2.96.png ent= 2.9566493944403254
Saved candidate: mspaint_candidates/cand_off3383296_w600x282_RGB_ent2.97.png ent= 2.9686591994494784
Saved candidate: mspaint_candidates/cand_off3387392_w600x282_RGB_ent2.98.png ent= 2.980949374996593
Saved candidate: mspaint_candidates/cand_off3391488_w600x282_RGB_ent3.00.png ent= 2.996386207434198
Saved candidate: mspaint_candidates/cand_off3395584_w600x282_RGB_ent3.00.png ent= 2.9957237592699184
Saved candidate: mspaint_candidates/cand_off9342976_w600x282_RGB_ent2.99.png ent= 2.9914845609727507
Saved candidate: mspaint_candidates/cand_off9347072_w600x282_RGB_ent2.96.png ent= 2.955868250422656
Saved candidate: mspaint_candidates/cand_off9351168_w600x282_RGB_ent2.90.png ent= 2.897623570160537
Saved candidate: mspaint_candidates/cand_off9355264_w600x282_RGB_ent2.82.png ent= 2.8236159384700126
Saved candidate: mspaint_candidates/cand_off9359360_w600x282_RGB_ent2.82.png ent= 2.823308037021325
Saved candidate: mspaint_candidates/cand_off9363456_w600x282_RGB_ent2.79.png ent= 2.786935901504562
Saved candidate: mspaint_candidates/cand_off9367552_w600x282_RGB_ent2.72.png ent= 2.720426287520373
Saved candidate: mspaint_candidates/cand_off9371648_w600x282_RGB_ent2.67.png ent= 2.6658126414270344
Saved candidate: mspaint_candidates/cand_off9375744_w600x282_RGB_ent2.65.png ent= 2.651263426217099
Saved candidate: mspaint_candidates/cand_off9379840_w600x282_RGB_ent2.65.png ent= 2.6517369600093117
Saved candidate: mspaint_candidates/cand_off9383936_w600x282_RGB_ent2.61.png ent= 2.6099184153750645
Saved candidate: mspaint_candidates/cand_off9388032_w600x282_RGB_ent2.56.png ent= 2.556594752168363
Saved candidate: mspaint_candidates/cand_off9392128_w600x282_RGB_ent2.55.png ent= 2.546966769783387
Saved candidate: mspaint_candidates/cand_off9396224_w600x282_RGB_ent2.55.png ent= 2.5472185232558453
Saved candidate: mspaint_candidates/cand_off9400320_w600x282_RGB_ent2.49.png ent= 2.4918992937506936
Saved candidate: mspaint_candidates/cand_off9404416_w600x282_RGB_ent2.48.png ent= 2.4764069664092747
Saved candidate: mspaint_candidates/cand_off9408512_w600x282_RGB_ent2.45.png ent= 2.4509889425489657
Saved candidate: mspaint_candidates/cand_off9412608_w600x282_RGB_ent2.45.png ent= 2.4509889425489657
Saved candidate: mspaint_candidates/cand_off9416704_w600x282_RGB_ent2.45.png ent= 2.4507977576154016
Saved candidate: mspaint_candidates/cand_off9420800_w600x282_RGB_ent2.45.png ent= 2.4507977576154016
Saved candidate: mspaint_candidates/cand_off9424896_w600x282_RGB_ent2.43.png ent= 2.4318394141431057
Saved candidate: mspaint_candidates/cand_off9428992_w600x282_RGB_ent2.38.png ent= 2.3756230451932323
Saved candidate: mspaint_candidates/cand_off9433088_w600x282_RGB_ent2.36.png ent= 2.355285614725758
Saved candidate: mspaint_candidates/cand_off9437184_w600x282_RGB_ent2.34.png ent= 2.3421235391358675
Saved candidate: mspaint_candidates/cand_off9441280_w600x282_RGB_ent2.29.png ent= 2.2939492651977837
Saved candidate: mspaint_candidates/cand_off9445376_w600x282_RGB_ent2.28.png ent= 2.2768918595600605
Saved candidate: mspaint_candidates/cand_off9449472_w600x282_RGB_ent2.25.png ent= 2.251327202871655
Saved candidate: mspaint_candidates/cand_off9453568_w600x282_RGB_ent2.23.png ent= 2.2297747231826515
Saved candidate: mspaint_candidates/cand_off9457664_w600x282_RGB_ent2.21.png ent= 2.210354616408975
Saved candidate: mspaint_candidates/cand_off9461760_w600x282_RGB_ent2.14.png ent= 2.141274047005772
Saved candidate: mspaint_candidates/cand_off9465856_w600x282_RGB_ent2.11.png ent= 2.105845401661913
Saved candidate: mspaint_candidates/cand_off9469952_w600x282_RGB_ent2.03.png ent= 2.033458529739985
Saved candidate: mspaint_candidates/cand_off9474048_w600x282_RGB_ent2.00.png ent= 2.001028002678474
Saved candidate: mspaint_candidates/cand_off9478144_w600x282_RGB_ent1.96.png ent= 1.9645814160137445
Saved candidate: mspaint_candidates/cand_off9482240_w600x282_RGB_ent1.95.png ent= 1.9479005910990501
Saved candidate: mspaint_candidates/cand_off9486336_w600x282_RGB_ent1.87.png ent= 1.8741188670547506
Saved candidate: mspaint_candidates/cand_off9490432_w600x282_RGB_ent1.80.png ent= 1.803574513760725
Saved candidate: mspaint_candidates/cand_off9494528_w600x282_RGB_ent1.73.png ent= 1.731168887829599
Saved candidate: mspaint_candidates/cand_off9498624_w600x282_RGB_ent1.65.png ent= 1.6516577675590784
Saved candidate: mspaint_candidates/cand_off9502720_w600x282_RGB_ent1.58.png ent= 1.5838936601350884
Saved candidate: mspaint_candidates/cand_off9506816_w600x282_RGB_ent1.51.png ent= 1.5101530325091403
Saved candidate: mspaint_candidates/cand_off9510912_w600x282_RGB_ent1.48.png ent= 1.4813524479472397
Saved candidate: mspaint_candidates/cand_off9515008_w600x282_RGB_ent1.40.png ent= 1.4046069586713996
Saved candidate: mspaint_candidates/cand_off9519104_w600x282_RGB_ent1.38.png ent= 1.3766770460810749
Saved candidate: mspaint_candidates/cand_off9523200_w600x282_RGB_ent1.36.png ent= 1.359538092342572
Saved candidate: mspaint_candidates/cand_off9527296_w600x282_RGB_ent1.30.png ent= 1.302009476108849
Saved candidate: mspaint_candidates/cand_off9531392_w600x282_RGB_ent1.28.png ent= 1.2828628968900528
Saved candidate: mspaint_candidates/cand_off9535488_w600x282_RGB_ent1.25.png ent= 1.2523856796691317
Saved candidate: mspaint_candidates/cand_off9539584_w600x282_RGB_ent1.20.png ent= 1.197159738579838
Saved candidate: mspaint_candidates/cand_off9543680_w600x282_RGB_ent1.14.png ent= 1.144915176390881
Saved candidate: mspaint_candidates/cand_off9547776_w600x282_RGB_ent1.11.png ent= 1.1093154976808732
Saved candidate: mspaint_candidates/cand_off9551872_w600x282_RGB_ent1.07.png ent= 1.0708166439224287
Saved candidate: mspaint_candidates/cand_off9555968_w600x282_RGB_ent1.03.png ent= 1.026137798285278
Saved candidate: mspaint_candidates/cand_off9560064_w600x282_RGB_ent0.98.png ent= 0.9833053571575678
Saved candidate: mspaint_candidates/cand_off9564160_w600x282_RGB_ent0.94.png ent= 0.9359308051576221
Saved candidate: mspaint_candidates/cand_off9568256_w600x282_RGB_ent0.87.png ent= 0.873037177403341
Saved candidate: mspaint_candidates/cand_off9572352_w600x282_RGB_ent0.82.png ent= 0.8200261657687138
Saved candidate: mspaint_candidates/cand_off9576448_w600x282_RGB_ent0.78.png ent= 0.7773381190790621
Saved candidate: mspaint_candidates/cand_off9580544_w600x282_RGB_ent0.71.png ent= 0.7148302877251178
Saved candidate: mspaint_candidates/cand_off9584640_w600x282_RGB_ent0.66.png ent= 0.6588167468759545
Saved candidate: mspaint_candidates/cand_off9588736_w600x282_RGB_ent0.60.png ent= 0.6036330286922581
Saved candidate: mspaint_candidates/cand_off9592832_w600x282_RGB_ent0.52.png ent= 0.5191254378219974
Saved candidate: mspaint_candidates/cand_off9596928_w600x282_RGB_ent0.48.png ent= 0.4832902967517086
Saved candidate: mspaint_candidates/cand_off9601024_w600x282_RGB_ent0.45.png ent= 0.44888297217530776
Saved candidate: mspaint_candidates/cand_off9605120_w600x282_RGB_ent0.41.png ent= 0.4129746015546004
Saved candidate: mspaint_candidates/cand_off9609216_w600x282_RGB_ent0.36.png ent= 0.36190848952182136
Saved candidate: mspaint_candidates/cand_off9613312_w600x282_RGB_ent0.29.png ent= 0.29482805292123226
Saved candidate: mspaint_candidates/cand_off9617408_w600x282_RGB_ent0.34.png ent= 0.34365713394506486
Saved candidate: mspaint_candidates/cand_off9621504_w600x282_RGB_ent0.42.png ent= 0.422770099775037
Saved candidate: mspaint_candidates/cand_off9625600_w600x282_RGB_ent0.47.png ent= 0.46708247000452785
Saved candidate: mspaint_candidates/cand_off9629696_w600x282_RGB_ent0.51.png ent= 0.5096822469201645
Saved candidate: mspaint_candidates/cand_off9633792_w600x282_RGB_ent0.55.png ent= 0.5491517157909861
Saved candidate: mspaint_candidates/cand_off9637888_w600x282_RGB_ent0.60.png ent= 0.5958814687393106
Saved candidate: mspaint_candidates/cand_off9641984_w600x282_RGB_ent0.64.png ent= 0.6366615761324042
Saved candidate: mspaint_candidates/cand_off9646080_w600x282_RGB_ent0.67.png ent= 0.6714692841504615
Saved candidate: mspaint_candidates/cand_off9650176_w600x282_RGB_ent0.70.png ent= 0.7044173636519541
Saved candidate: mspaint_candidates/cand_off9654272_w600x282_RGB_ent0.74.png ent= 0.7381956348310676
Saved candidate: mspaint_candidates/cand_off9658368_w600x282_RGB_ent0.77.png ent= 0.7718904887928189
Saved candidate: mspaint_candidates/cand_off9662464_w600x282_RGB_ent0.80.png ent= 0.8016388674264026
Saved candidate: mspaint_candidates/cand_off9666560_w600x282_RGB_ent0.83.png ent= 0.8307787048981833
Saved candidate: mspaint_candidates/cand_off9670656_w600x282_RGB_ent0.86.png ent= 0.8568110779087412
Saved candidate: mspaint_candidates/cand_off9674752_w600x282_RGB_ent0.88.png ent= 0.8802399157038258
Saved candidate: mspaint_candidates/cand_off9678848_w600x282_RGB_ent0.91.png ent= 0.9069785674576895
Saved candidate: mspaint_candidates/cand_off9682944_w600x282_RGB_ent0.95.png ent= 0.95065731145457
Saved candidate: mspaint_candidates/cand_off9687040_w600x282_RGB_ent0.97.png ent= 0.9677349192828443
Saved candidate: mspaint_candidates/cand_off9691136_w600x282_RGB_ent0.99.png ent= 0.992464762769845
Saved candidate: mspaint_candidates/cand_off9695232_w600x282_RGB_ent1.01.png ent= 1.0136333677100278
Saved candidate: mspaint_candidates/cand_off9699328_w600x282_RGB_ent1.08.png ent= 1.0750408452576985
Saved candidate: mspaint_candidates/cand_off9703424_w600x282_RGB_ent1.10.png ent= 1.0995691983048528
Saved candidate: mspaint_candidates/cand_off9707520_w600x282_RGB_ent1.12.png ent= 1.120940258459008
Saved candidate: mspaint_candidates/cand_off9711616_w600x282_RGB_ent1.14.png ent= 1.1390489393253787
Saved candidate: mspaint_candidates/cand_off9715712_w600x282_RGB_ent1.16.png ent= 1.1597628305330974
Saved candidate: mspaint_candidates/cand_off9719808_w600x282_RGB_ent1.19.png ent= 1.1900589034740299
Saved candidate: mspaint_candidates/cand_off9723904_w600x282_RGB_ent1.21.png ent= 1.2095614757465867
Saved candidate: mspaint_candidates/cand_off9728000_w600x282_RGB_ent1.23.png ent= 1.2309481001217883
Saved candidate: mspaint_candidates/cand_off9732096_w600x282_RGB_ent1.25.png ent= 1.2529555806395354
Saved candidate: mspaint_candidates/cand_off9736192_w600x282_RGB_ent1.27.png ent= 1.2679852624460572
Saved candidate: mspaint_candidates/cand_off9740288_w600x282_RGB_ent1.28.png ent= 1.2843126217167369
Saved candidate: mspaint_candidates/cand_off9744384_w600x282_RGB_ent1.30.png ent= 1.302919032995534
Saved candidate: mspaint_candidates/cand_off9748480_w600x282_RGB_ent1.32.png ent= 1.3175011398315237
Saved candidate: mspaint_candidates/cand_off9752576_w600x282_RGB_ent1.34.png ent= 1.337612078709196
Saved candidate: mspaint_candidates/cand_off9756672_w600x282_RGB_ent1.36.png ent= 1.356335192934354
Saved candidate: mspaint_candidates/cand_off9760768_w600x282_RGB_ent1.37.png ent= 1.3709171551667694
Saved candidate: mspaint_candidates/cand_off9764864_w600x282_RGB_ent1.38.png ent= 1.3842790590110752
Saved candidate: mspaint_candidates/cand_off9768960_w600x282_RGB_ent1.40.png ent= 1.4004548847602114
Saved candidate: mspaint_candidates/cand_off9773056_w600x282_RGB_ent1.42.png ent= 1.4189822847016216
Saved candidate: mspaint_candidates/cand_off9777152_w600x282_RGB_ent1.43.png ent= 1.4313000311704787
Saved candidate: mspaint_candidates/cand_off9781248_w600x282_RGB_ent1.46.png ent= 1.4557069500116822
Saved candidate: mspaint_candidates/cand_off9785344_w600x282_RGB_ent1.47.png ent= 1.4660442726616914
Saved candidate: mspaint_candidates/cand_off9789440_w600x282_RGB_ent1.48.png ent= 1.4800636865349304
Saved candidate: mspaint_candidates/cand_off9793536_w600x282_RGB_ent1.49.png ent= 1.4895506103950873
Saved candidate: mspaint_candidates/cand_off9797632_w600x282_RGB_ent1.50.png ent= 1.500331745307557
Saved candidate: mspaint_candidates/cand_off9801728_w600x282_RGB_ent1.51.png ent= 1.5098426325610323
Saved candidate: mspaint_candidates/cand_off9805824_w600x282_RGB_ent1.52.png ent= 1.5178644354096982
Saved candidate: mspaint_candidates/cand_off9809920_w600x282_RGB_ent1.53.png ent= 1.5288175222231661
Saved candidate: mspaint_candidates/cand_off9814016_w600x282_RGB_ent1.54.png ent= 1.5445944425988833
Saved candidate: mspaint_candidates/cand_off9818112_w600x282_RGB_ent1.55.png ent= 1.5521047589940309
Saved candidate: mspaint_candidates/cand_off9822208_w600x282_RGB_ent1.57.png ent= 1.5656397133812543
Saved candidate: mspaint_candidates/cand_off9826304_w600x282_RGB_ent1.57.png ent= 1.570330863625153
Saved candidate: mspaint_candidates/cand_off9830400_w600x282_RGB_ent1.58.png ent= 1.579633457472999
Saved candidate: mspaint_candidates/cand_off9834496_w600x282_RGB_ent1.59.png ent= 1.5852126361602947
Saved candidate: mspaint_candidates/cand_off9838592_w600x282_RGB_ent1.59.png ent= 1.5911952983639108
Saved candidate: mspaint_candidates/cand_off9842688_w600x282_RGB_ent1.60.png ent= 1.600326718449746
Saved candidate: mspaint_candidates/cand_off9846784_w600x282_RGB_ent1.61.png ent= 1.6116475005342261
Saved candidate: mspaint_candidates/cand_off9850880_w600x282_RGB_ent1.61.png ent= 1.6136216682023878
Saved candidate: mspaint_candidates/cand_off9854976_w600x282_RGB_ent1.62.png ent= 1.6161442731312685
Saved candidate: mspaint_candidates/cand_off9859072_w600x282_RGB_ent1.62.png ent= 1.6174867881823989
Saved candidate: mspaint_candidates/cand_off9863168_w600x282_RGB_ent1.62.png ent= 1.6240613380632374
Saved candidate: mspaint_candidates/cand_off9867264_w600x282_RGB_ent1.63.png ent= 1.629553124544862
Saved candidate: mspaint_candidates/cand_off9871360_w600x282_RGB_ent1.63.png ent= 1.6284033214317875
Saved candidate: mspaint_candidates/cand_off9875456_w600x282_RGB_ent1.63.png ent= 1.6305039406889275
Saved candidate: mspaint_candidates/cand_off9879552_w600x282_RGB_ent1.64.png ent= 1.638666678599584
Saved candidate: mspaint_candidates/cand_off9883648_w600x282_RGB_ent1.64.png ent= 1.6409875443498967
Saved candidate: mspaint_candidates/cand_off9887744_w600x282_RGB_ent1.65.png ent= 1.6467778689141623
Saved candidate: mspaint_candidates/cand_off9891840_w600x282_RGB_ent1.65.png ent= 1.6477851387685816
Saved candidate: mspaint_candidates/cand_off9895936_w600x282_RGB_ent1.65.png ent= 1.6495024460866168
Saved candidate: mspaint_candidates/cand_off9900032_w600x282_RGB_ent1.66.png ent= 1.6629333966413193
Saved candidate: mspaint_candidates/cand_off9904128_w600x282_RGB_ent1.67.png ent= 1.6675737296693982
Saved candidate: mspaint_candidates/cand_off9908224_w600x282_RGB_ent1.67.png ent= 1.6676474430795971
Saved candidate: mspaint_candidates/cand_off9912320_w600x282_RGB_ent1.67.png ent= 1.6670267313090745
Saved candidate: mspaint_candidates/cand_off9916416_w600x282_RGB_ent1.67.png ent= 1.673522217712938
Saved candidate: mspaint_candidates/cand_off9920512_w600x282_RGB_ent1.70.png ent= 1.6998942329838564
Saved candidate: mspaint_candidates/cand_off9924608_w600x282_RGB_ent1.71.png ent= 1.706139016652624
Saved candidate: mspaint_candidates/cand_off9928704_w600x282_RGB_ent1.71.png ent= 1.7105830082619062
Saved candidate: mspaint_candidates/cand_off9932800_w600x282_RGB_ent1.78.png ent= 1.783575603460917
Saved candidate: mspaint_candidates/cand_off9936896_w600x282_RGB_ent1.86.png ent= 1.8557991503174212
Saved candidate: mspaint_candidates/cand_off9940992_w600x282_RGB_ent1.92.png ent= 1.9207098342796138
Saved candidate: mspaint_candidates/cand_off9945088_w600x282_RGB_ent1.98.png ent= 1.983371225582791
Saved candidate: mspaint_candidates/cand_off9949184_w600x282_RGB_ent2.05.png ent= 2.0470342986515777
Saved candidate: mspaint_candidates/cand_off9953280_w600x282_RGB_ent2.11.png ent= 2.1078114988289296
Saved candidate: mspaint_candidates/cand_off9957376_w600x282_RGB_ent2.17.png ent= 2.165394925910658
Saved candidate: mspaint_candidates/cand_off9961472_w600x282_RGB_ent2.22.png ent= 2.223950977058396
Saved candidate: mspaint_candidates/cand_off9965568_w600x282_RGB_ent2.28.png ent= 2.2815563831611585
Saved candidate: mspaint_candidates/cand_off9969664_w600x282_RGB_ent2.33.png ent= 2.3336042326448942
Saved candidate: mspaint_candidates/cand_off9973760_w600x282_RGB_ent2.38.png ent= 2.384804342397442
Saved candidate: mspaint_candidates/cand_off9977856_w600x282_RGB_ent2.43.png ent= 2.434964724123999
Saved candidate: mspaint_candidates/cand_off9981952_w600x282_RGB_ent2.49.png ent= 2.48677754283776
Saved candidate: mspaint_candidates/cand_off9986048_w600x282_RGB_ent2.54.png ent= 2.537108977991541
Saved candidate: mspaint_candidates/cand_off9990144_w600x282_RGB_ent2.59.png ent= 2.5856218814953347
Saved candidate: mspaint_candidates/cand_off9994240_w600x282_RGB_ent2.64.png ent= 2.635265360722404
Saved candidate: mspaint_candidates/cand_off9998336_w600x282_RGB_ent2.68.png ent= 2.679095275433057
Saved candidate: mspaint_candidates/cand_off10002432_w600x282_RGB_ent2.72.png ent= 2.7235809077468263
Saved candidate: mspaint_candidates/cand_off10006528_w600x282_RGB_ent2.77.png ent= 2.770433112624042
Saved candidate: mspaint_candidates/cand_off10010624_w600x282_RGB_ent2.82.png ent= 2.815254519199354
Saved candidate: mspaint_candidates/cand_off10014720_w600x282_RGB_ent2.86.png ent= 2.8588240202170367
Saved candidate: mspaint_candidates/cand_off10018816_w600x282_RGB_ent2.90.png ent= 2.9002134850612835
Saved candidate: mspaint_candidates/cand_off10022912_w600x282_RGB_ent2.94.png ent= 2.9424945928060615
Saved candidate: mspaint_candidates/cand_off10027008_w600x282_RGB_ent2.99.png ent= 2.986838553651489
As you can see, there's image candidates where it have entropies even lower than 1, we can already smell the flag from here, and at this point, I stopped the script and try to scan through the candidates.
Bingo! Lets choose one of the images and try to look for the flag. I chose this image.
It looks like the image is upside down, lets edit it.
Flag : compit{gg_jago_keren_kamu}
PO- PO- PO- PWNED!!!