Persist

Although Santa just updated his infra, problems still occur. He keeps complaining about slow boot time and a blue window popping up for a split second during startup. The IT elves support suggested that he should restart his computer. Ah, classic IT support!

Download Link: http://46.101.25.140/forensics_persist.zip

Flag

Not pwned.

Progress so far

The zip file contains ä windows memory dump
As the intro text states the boot time is slow and blue windows pop up. This might be ä Powershell reverse shell.
So it is probably reasonable to check the windows autostart and the accoring registry keys
I was not able to find anything as of yet
Probably the autostarts plugin for volatility2 would help. But I'm using version 3 and the plugin is not compatible.