What’s the Operating System version of the Server? (two words)

What’s the Operating System of the Desktop? (four words separated by spaces)

What was the IP address assigned to the domain controller?

What was the timezone of the Server?

What was the initial entry vector (how did they get in)?. Provide protocol name.

What was the malicious process used by the malware? (one word)

Which process did malware migrate to after the initial compromise? (one word)

Identify the IP Address that delivered the payload.

What IP Address was the malware calling to?

Where did the malware reside on the disk?

What's the name of the attack tool you think this malware belongs to? (one word)

One of the involved malicious IP's is based in Thailand. What was the IP?

Another malicious IP once resolved to
klient-293.xyz . What is this IP?

The attacker performed some lateral movements and accessed another system in the environment via RDP. What is the hostname of that system?

Other than the administrator, which user has logged into the Desktop machine? (two words)

What was the password for "jerrysmith" account?

What was the original filename for Beth’s secrets?

What was the content of Beth’s secret file? ( six words, spaces in between)

The malware tried to obtain persistence in a similar way to how Carbanak malware obtains persistence. What is the corresponding MITRE technique ID?