An employee's workstation began acting suspiciously; strange files appeared, and system performance dropped. Can you investigate what happened?

Router OS openwrt/immortalwrt forensics