Volatility

John Grunewald was deleting some old accounting documents when he accidentally deleted an important document he had been working on. He panicked and downloaded software to recover the document, but after installing it, his PC started behaving strangely. Feeling even more demoralised and depressed, he alerted the IT department, who immediately locked down the workstation and recovered some forensic evidence. Now it is up to you to analyze the evidence to understand what happened on John’s workstation.

Reminiscent carves a malicious resume.pdf.lnk out of a Windows 7 memory dump with Volatility, then peels back two offset-read, base64-chained PowerShell stagers — the second an RC4-keyed Empire-style beacon — down to the flag.