1. Merge all three logs by timestamp (the page can sort them together). The order is: web upload → new file appears in file-mods → SSH login from the same IP. Why: a super-timeline shows cause/effect across data sources.
2. The file created between the upload and the SSH login is the webshell (/var/www/uploads/shell_7f3a.php). Its filemods.log entry records a planted marker=THM{...} — that marker is the flag.
3. Enter the flag to confirm.
Lesson: cross-source correlation turns isolated events into a narrative.