$ cat writeup.md…
$ cat writeup.md…
hackerlab
Task: ~165 MB winlogbeat/Sysmon events.json from a slacking developer's workstation; reconstruct his behavior and find the flag. Solution: parse Sysmon events, recover Chrome History showing downloaded osu! beatmaps, ignore the decoy CODEBY{try_it_ok} beatmap, pivot via OSINT to the SAME creator's second beatmap whose audio filename IS the flag.
Permission denied (requires tier.pro)
Sign in with GitHub, Discord, or Google to continue. No email required.
$sign in$ grep --similar