2024-10-08-Zimmer Down (Forensics)

Really danced around this one, sometimes the flg stuff is jsut too obvious and annoying.

Run regripper -r NTUSER.DAT -f ntuser

Some stuff from recmd.exe wasn’t working

Registry Explorer also showed the same

All it was as the base62 encoded file name

flag{4b676ccc1070be66b1a15d8601c8d500}

Trying the plugins for extraction