forensicsPromedium
:( (sad_face)
scarlet
Task: Forensics challenge with a Windows Event Log (.evtx) file containing hidden flag data related to BSOD/EternalBlue events. Solution: Parsed the EVTX file, extracted Binary fields from BugCheck events (EventID 1001/41), and applied double Base64 decoding to reconstruct the three flag parts.
$ ls tags/ techniques/
evtx_parsingbase64_double_decodeevent_log_analysisbinary_data_extraction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [forensics][Pro]Manager— duckerz
- [forensics][Pro]Advanced Packaged Threat— scarlet
- [forensics][Pro]exFill— grodno_new_year_2026
- [reverse][Pro]Challenge7— tamuctf
- [forensics][Pro]Stockpile Breach— 0xl4ugh