Baby

Task author

While the employee was distracted by a meeting, you obtained an image of their workstation. Your task is to reconstruct the infection chain, determine what exactly happened, and answer questions related to the incident. While the employee was distracted by a meeting, you obtained an image of their workstation. Your task is to reconstruct the chain of infection, determine exactly what happened, and answer questions regarding the incident.

What did the user download? What is the address of the C2 server? (including the port) What software was used to implement the persistence mechanism? Flag format: KubSTU{text.txt|184.0.0.2:1234|abob.exe}