Judgmental Behavior

hackerlab

Task: ~165 MB winlogbeat/Sysmon events.json from a slacking developer's workstation; reconstruct his behavior and find the flag. Solution: parse Sysmon events, recover Chrome History showing downloaded osu! beatmaps, ignore the decoy CODEBY{try_it_ok} beatmap, pivot via OSINT to the SAME creator's second beatmap whose audio filename IS the flag.