TryHackMeHard
Hacker Holidays — Day 14: Management Wants a Word
A KAPE triage image of an abandoned laptop yields one saved Chrome password, decrypted entirely offline through a DPAPI masterkey → Local State → AES-GCM chain, which turns out to be the passphrase for a hidden VeraCrypt volume holding the real evidence.
- #hacker-holidays
- #forensics
- #dpapi
- #veracrypt