MiniFast - UNC1549 Lab

You are a network forensics analyst at SkyBridge Aero. On July 5, 2026, the SOC escalated an alert: a developer workstation was generating periodic outbound HTTP connections to an unfamiliar external IP. The traffic was structured and repetitive, inconsistent with normal browsing.The user had recently downloaded what they believed was a legitimate database tool from an external website. Shortly after, the anomalous activity began.A packet capture covering the incident window was already running on the segment. The workstation has been isolated. You have been handed the PCAP and a process memory dump from the browser that was active during the...