[Forensics] Marshal in the Middle

Anyone can pm me about the flag ? I found the “session” where the exfil has been done, I know from whats been stolen, from what system by which “tool” and that the user cleaned up his ‘mess’ but cant see anything that looks like a flag.

Update: Found it - no help needed