Please, do not write just a link to original writeup here.

Original writeup (http://blog.ghaaf.me/2017/10/14/kaspersky-ctf-help-forensic-500/).