moth/puzzles/forensics/20/index.html

16 lines
645 B
HTML
Executable File

You are currently employed as a SW engineer at KELCY INC. One of your clients has informed you that $10,000 has been deducted from their accounts from an authorized user. They have delivered a software image for you to investigate. Determine if the machine has been compromised.
</BR>
In order to answer the questions:
</BR>
- Determine if the machine has been compromised.
</BR>
- If it has not been compromised, list "no" as your answer.
</BR>
- If it has been compromised, list the file name (with its extension) being used by the malicious software
</BR>
<A href="http://10.1.1.2/20/winxppro.vmem">winxppro.vmem</A>