https://crmulent.github.io/posts/picoctf-forensics/
picoCTF (Forensics) - Writeup - crmulent