ASCWG 2026
Detailed walkthroughs for the ASCWG 2026 Qualifications, covering macOS endpoint triage, Windows artifact carving, covert packet analysis, and Bitcoin transaction tracking.
Solved Challenges
The Thrushes
Investigating an infected macOS machine. We decompile a trojanized Signal Desktop binary in Ghidra, uncover hidden threads, and pull out hardcoded AES-256 keys.
Do You Even Search Dude
Carving Windows Search (Windows.db) ESE databases and parsing Program Compatibility Assistant (PCA) logs to trace how malware was executed on the host.
Sensor Confession
Finding data hidden inside raw PCAP traffic. We inspect unusual TCP packets, spot data smuggled inside TCP Urgent Pointers, and reconstruct the full stream.
NightShade Vendor
Tracking illicit Bitcoin transactions through a Wasabi CoinJoin mixer. Using the TRACE-7 Peel-Chain method and multi-input clustering to unmask the real destination.