4d 5a 41 52 55 48 89 e5 03 24 06 spoolsv iex 203.78.103.109:443
$SI != $FN UsnJrnl:$J coreupdater.exe
Agentic DFIR · Case 001

The Stolen
Szechuan Sauce,
solved blind.

A computer-forensics workshop.
No computer. One iPhone.
12.8 GB · 2 Windows hosts · disk + RAM · 0 walkthroughs
solved over SSH from a phone — then it graded itself.
$ vol -f citadeldc01.mem netscan
scanning…
10.42.85.10 → 203.78.103.109:443
ESTABLISHED · coreupdater
 
$ vol malfind spoolsv.exe
4d 5a 41 52 55 48 MZARUH
↳ meterpreter injected
 
$ istat Beth_Secret.txt
$SI 07:33:54.000
$FN 11:34:56.970
↳ timestomped decoy
 
► case reconstructed.