When given one working week to go from raw pcaps to a report on any detected malicious activity, two security dudes rush to perform the best analysis they can given their situation. After making sure the traffic was actually captured properly of course. I'll be talking about my experience with this particular engagement, some of the gotchas we faced with the initial capture and later analysis, some of the actual analysis we performed, and finally what we would have liked to do given an easier situation.