day8.md

windows shi

1- checking some log file sorted by date and discorvering info at [SantasLaptopLogs]

2. decoding base64 string to bat and analysing it in shellbags weer u can see files that has been in satas desk

3. https://github.com/Grinchiest < SantaRat

4. fiding the password in operation-bag-of-toys in a commit https://github.com/Grinchiest/operation-bag-of-toys/commit/41615462e4fdc0ceeb4ef1bec693ec3de1125ed2 [TheGrinchiestGrinchmasOfAll]

5. entering the password in bag-of-toys.exe file in the vm and getting 228 files