Before You Go · Huntress CTF 2026

The challenge

"Prefetch evidence records what Windows prepared to execute even after filenames changed. Recover executable identities and connect execution traces to the correct hosts."

answer_id	Question	Format
`d26-prefetch-001-prefetch-executable-name`	"Determine prefetch.executable_name for trace-001.pf." (artifact `metadata-day-26-evidence.zip -> trace-001.pf`)	exact text: "exact artifact-derived value only … use the literal none only when the requested field is absent"; trimmed

The Time Trial asked 31 questions: every earlier day's field (copied-file names and hashes, roster, BOM, JPEG, PNG, PDF, ZIP, PE, .NET, MSI, LNK, OOXML, email, audio, video, ELF, Mach-O, APK, JAR, SQLite, EVTX, registry hive), today's Prefetch name, and the SHA-256 ordering synthesis. The Mastery asked the same family across 10 sets (310 questions).

Reading the prompt: what it said we'd need

Clue	What it pointed to	What I did about it
"Prefetch evidence"	Windows `.pf` files: an `SCCA` header, file-information block, file-name strings, and volume records; on Windows 10 and later, wrapped in `MAM` compression	A Prefetch reader (with an XPRESS Huffman decompressor) had been pre-built on 2026-10-14
"what Windows prepared to execute"	The executable the Prefetch file was made for	`prefetch.executable_name` is the header's own name field, read verbatim
"even after filenames changed"	The `.pf` file name (normally `NAME-HASH.pf`) can't be trusted	Every file was renamed `trace-001.pf`; only the header gives the name
"connect execution traces to the correct hosts"	Volume serials and device paths, across several files	No question asked for it; each set had one Prefetch file, and the synthesis question was the usual SHA-256 order list
"use the literal none only when the requested field is absent" (format)	`none` is a real answer only for a missing field	Never needed: the name was always present
"Before You Go" (title)	Prefetch: what Windows readies before a program runs	Confirmed the reading

What was in the files

Single Solve: metadata-day-26-evidence.zip, 3,943 bytes, one member: trace-001.pf, 3,896 bytes, starting MAM\x04 (XPRESS Huffman). Decompressed: 15,412 bytes, version 30, SCCA. Executable name CMD.EXE, hash 0xcd245f9e, run count 20, last run 2026-08-13 23:30:39 UTC, 35 file-name strings, one volume (\VOLUME{01dac5d839f8392d-5a3a0dd2}, serial 0x5a3a0dd2). The executable's own path string ends \WINDOWS\SYSTEM32\CMD.EXE.
Time Trial: evidence.zip, 638,474 bytes, 23 members: one sample per earlier day's file type plus trace-001.pf. This one was not compressed: 15,316 bytes of plain version-30 SCCA. Name VIEWER.EXE, 17 runs.
Mastery: one 6,954,094-byte zip of 10 evidence sets (evidence-01.zip … evidence-10.zip), 31 questions each. Each set's trace-001.pf was uncompressed version 30 (15,318 to 15,326 bytes) with its own name and volume serial: EMBER40.EXE, MONITOR.EXE, UPDATER.EXE, TELEMETRY.EXE, COBALT55.EXE, MEADOW83.EXE, SESSIONHOST.EXE, VELVET43.EXE, MAILCLIENT.EXE, MEADOW16.EXE.

Same template, different values, and a different wrapper. The Single used the Windows 10+ compressed form; the timed files were the raw SCCA form. A reader that handled only one of the two would have failed one mode.

Single Solve

The solver got it with no stop, straight from the pre-built parser. It opened the Single Solve untimed and checked the one question against what it knew: the field was new to the event, but its slug prefetch-executable-name was already registered by a pre-built parser, so the solver sent it without needing its candidate ladder.

The handler is the pre-built Prefetch reader (built 2026-10-14, twelve days early): - If the file starts MAM, it checks the compression format is XPRESS Huffman, reads the uncompressed size, and decompresses (MS-XCA LZ77 + Huffman, 64 KiB blocks, each led by a 256-byte table of 4-bit code lengths). - It then requires SCCA, a known version (17, 23, 26, 30, or 31), and a header file-size field equal to the data length, and reads the 60-byte UTF-16 executable name at offset 16. Anything off raises. - It registers prefetch-, pf-, and scca-executable-name (and -executable-filename, -exe-name), plus hash, run count, last run, version, volume serial, device path, and the executable's full path.

started_at  2026-10-26 09:00:07.354 ET
deadline    none (Single Solve)
answers     1   CMD.EXE
start        182 ms   (the solver's reconnect at 09:00:13)
artifact     237 ms   (3,943 bytes)
solve          3 ms
submit       758 ms
TOTAL       1180 ms   (submit +7.20 s after started_at; the question check ran in between)
result      CORRECT   flag 84b4bd0d…ed61

Before the timed runs, a regression rehearsal replayed the saved attempts and passed (no counts were recorded today).

Time Trial

CORRECT on the first attempt, ranked. The start replied unique_attempts_remaining: 31 and variant_fresh: true.

The solver runs Metadata timed modes through its candidate ladder's overlay: the base solver answers, then rules accepted on earlier days overwrite any field they cover. Today's Prefetch field came from the base solver itself; Day 25's hive root name came from the stored rule pure:regf-root-key-name, re-run on today's hive. The solver's report lines showing BEST-EFFORT … = 'none' for that field are placeholders before the overlay: the request log shows HsjKiEo sent, and no none in the 31 answers.

started_at  2026-10-26 09:00:37.859 ET
deadline    2026-10-26 09:01:27.859 ET   (50 s)
answers     31   (prefetch name VIEWER.EXE)
start       1096 ms
artifact     446 ms   (638,474 bytes)
solve        171 ms
submit      1004 ms
TOTAL       2717 ms   (submit +1.74 s after started_at)
result      CORRECT   flag 8fd2da8b…dfe2

The synthesis answer listed five files in ascending SHA-256 order, today's Prefetch file among them: ["document-15-001.docx","trace-001.pf","macos-001.bin","evidence-note-bbfedf.txt","document-001.pdf"].

Mastery

CORRECT on the first attempt, ranked (10 sets, 325 s clock; Day 25 had 9 sets and 295 s). All ten Prefetch names came from each set's own file, and all ten hive root names from the overlay; the log shows 310 answers and no none.

started_at  2026-10-26 09:00:45.170 ET
deadline    2026-10-26 09:06:10.170 ET   (325 s)
answers     310 across 10 sets   (names EMBER40.EXE … MEADOW16.EXE)
start        124 ms after started_at
artifact     879 ms after started_at   (6.95 MB)
solve       2850 ms after started_at   (1971 ms)
submit      3772 ms after started_at
result      CORRECT   flag 32117a2f…79d5

No code was written for this lane today.

Time to solve

All three modes were solved by 09:00:48 ET, 48 s after release (41 s from the first start request). The Time Trial and Mastery were both ranked and each went through on the first submit.

Takeaways

Pre-building paid off again. The Prefetch reader, written twelve days early as a guess, answered a brand-new field with no stop and no ladder (Day 25's hive reader came from the same set).
Build both forms of a format. The Single was MAM-compressed and the timed files were raw SCCA. The pre-built reader handled both because it included the XPRESS Huffman decompressor from the start.
The ladder's stored rule carried Day 25 forward. Yesterday's hive root name is now just another field in every timed set, filled by the rule saved yesterday.
The prompt promises more than the questions ask. "Connect execution traces to the correct hosts" sounds like a multi-file volume-serial match; no field asked for it. The reader already returns serials and device paths if one comes.