[ALEXCTF 2017]-Fore3: USB probing (Forensics 150)

Open the pcap file in Wireshark, looking at the usb.capdata, and the packet 101:

It's a picture just chose the hex then export it, open it in Linux we'll get a flag:

Flag is:

ALEXCTF{SN1FF_TH3_FL4G_OV3R_USB}