File: Kill.the.plumber.zip ... -

Look for unusual .sh or .bat scripts in the startup folders of the extracted archive.

Below is a general write-up based on the typical structure of this forensics challenge: File Name: Kill.The.Plumber.zip File: Kill.The.Plumber.zip ...

Run binwalk -e Kill.The.Plumber.zip to see if there are images or documents hidden within other files (a file within a file). Look for unusual

Run file Kill.The.Plumber.zip to confirm it is a standard ZIP archive. File: Kill.The.Plumber.zip ...

Depending on the specific CTF platform, the "flag" is usually hidden in one of the following ways: