Skills | Threat Intel & Forensics Portfolio

ASCWG QUALS • WINDOWS FORENSICS • ESE CARVING

By Abdo•Aug 20, 2026

Challenge Prompt

“A CEO's corporate workstation was compromised. The attacker attempted to evade disk forensics by wiping standard execution logs. Analyze the Windows.db Extensible Storage Engine (ESE) database and KAPE triage collection to reconstruct the executed malware payload.”

● Category: Windows Forensics / ESE Database Carving● Platform: ASCWG Qualifications 2026● Flag Format: ASCWG{...}

Provided Artifacts

Windows.db / KAPE.zip

Size: 285 MB • ESE DatabasePath: Windows\Windows.edb

Parser: ESEDatabaseView / NirSoft

A CEO's workstation was compromised. We were provided with a KAPE triage collection and tasked with identifying exactly what the attacker ran and where they hid the evidence. This challenge was an exercise in avoiding rabbit holes and looking in the last place anyone expects: the Windows Search database itself.

💡 THE BEGINNER BREAKDOWN (Footprints in the Registry)

If a burglar breaks into a house, they usually leave footprints near the window they smashed. In Windows, every time a program is run, the operating system quietly takes notes about it (like “Program Compatibility” logs) just in case the program crashes later. We found a footprint showing that a fake program called OfficeUpdater.exe was launched. But searching for the stolen goods inside that file was a trap! The burglar actually hid the loot inside the house's own security ledger.

Q: Where did the attacker hide the actual payload data?

A: The Windows Search Database (Windows.db)

Initial investigation revealed an execution record for C:\Users\user\AppData\Local\Temp\OfficeUpdater.exe via the Program Compatibility Assistant (PCA)A Windows service that monitors programs for compatibility issues. Its logs often retain evidence of malware execution long after the malware is deleted.. Simply searching for the executable name was a rabbit hole designed to distract investigators. The actual flag was hidden within Windows Search database residue.

Windows.db [System.Search.AutoSummary]

Offset(h)  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
00000000   41 00 00 00 01 00 00 00 10 00 00 00 00 00 00 00  A...............
00000010   a3 f1 c8 9b 72 1e 5a 44 8f 3c 11 22 4a 99 bb 01  £ñÈ.r.ZD.<."J.».
00000020   ... [48 Bytes High-Entropy Ciphertext] ...       ................

# Decryption using PCA AppHelp SolutionID (Key):
> python decrypt_blob.py --key "{A92B31-...}" --data payload.bin
SUCCESS: ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}

Automated Python Decryptor (`decrypt_blob.py`):

from Crypto.Cipher import AES
import hashlib

# 1. SolutionID extracted from PCA AppHelp database
solution_id = "{A92B31C4-7D4F-4A92-B582-82E9104A7F11}"
key = hashlib.sha256(solution_id.encode('utf-16le')).digest()[:16]

# 2. 48-byte ciphertext blob extracted from Windows.db System.Search.AutoSummary
ciphertext = bytes.fromhex("a3f1c89b721e5a448f3c11224a99bb012f5a89b0...")

cipher = AES.new(key, AES.MODE_CBC, iv=b"\x00"*16)
decrypted = cipher.decrypt(ciphertext)

print("🎉 Decrypted Flag:", decrypted.decode('utf-8', errors='ignore'))

⚡ Terminal One-Liner (PowerShell / Bash):

python -c "from Crypto.Cipher import AES; import hashlib; k=hashlib.sha256('{A92B31C4-7D4F-4A92-B582-82E9104A7F11}'.encode('utf-16le')).digest()[:16]; print(AES.new(k,AES.MODE_CBC,b'\x00'*16).decrypt(bytes.fromhex('...')).decode('latin1'))"

[ SHOW METHODOLOGY: Windows.db & PCA AppHelp Decryption ]▼

Navigated to ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db.
Correlated the execution of OfficeUpdater.exe with suspicious binary data found in the System.Search.AutoSummary entries.
Extracted a 64-byte blob: 16 bytes of structured data and 48 bytes of high-entropy ciphertext.
Recovered the PCA AppHelp metadata from the registry/event logs, which provided a SolutionID.
Used the SolutionID as the cryptographic key to decrypt the 48-byte blob, revealing the final string.

Decrypted Final Flag:

ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}

Here is the step-by-step roadmap from initial KAPE triage to decrypting the hidden ESE database blob:

STEP 1

Execution Triage & Avoiding Rabbit Holes

Discovered PCA execution entry for OfficeUpdater.exe. Confirmed the executable was an empty decoy placed to distract analysts.

STEP 2

Extensible Storage Engine (ESE) Carving

Loaded Windows.db into ESEDatabaseView. Scanned System.Search.AutoSummary table and located high-entropy 48-byte binary blob residue.

STEP 3

Key Hunting in PCA AppHelp Metadata

Cross-referenced Windows Event Logs and found the PCA Compatibility database SolutionID GUID.

STEP 4

Automated Cryptographic Decryption

Derived the AES key via UTF-16LE SHA-256 and decrypted the 48-byte blob using Python.

STEP 5

Flag Capture

Extracted the final flag: ASCWG{c0mp4t_s0luti0n_h1d_th3_k3y_w1thin}.

Stage 1: The Execution Anchor

💡 THE BEGINNER BREAKDOWN (Footprints in the Registry)

The Complete Investigation Path & Mental Roadmap