A file's own timestamps, and the firewall record of the session that supposedly created it.
The file claims to have been written before the connection that delivered it existed. One of these sources has been tampered with, and the filesystem keeps more than one timestamp for a reason.
Find the field that proves the visible write time was altered, and submit its name as the flag: skrd{field}.
Malware routinely rewrites the timestamp a file browser shows. It rarely bothers with the one only the filesystem updates.