Incident Response: Application Shimming

It's been a while and no one has responded so I created a helpful hint for you:

You are definitely on the right track by focusing your final analysis on the DLL identified in your previous steps. Since you haven't found any clear network indicators in plaintext, consider whether the attacker might have hidden their tracks using basic data encoding. Take a closer look at the strings within that DLL and keep an eye out for blocks of text that might need decoding, such as Base64. You shouldn't need any complex tools outside of what is provided in the VM—just a keen eye for disguised artifacts!