: Does it attempt to beacon to a Command & Control (C2) server?

: Does it modify the Registry (Windows) or create Cron jobs (Linux) to survive a reboot? 3. Forensic Investigation

: Document the MD5/SHA-256 hashes of the ZIP and its contents.