Block

One of your junior system administrators forgot to deactivate two accounts from a pair of recently fired employees.
We believe these employees used the credentials they were given in order to access some of the many private files from our server, but we need concrete proof.
The junior system administrator only has a small network capture of the incident and a memory dump of the Local Security Authority Subsystem Service process.
Fortunately, for your company, that is all you need.

Click on the Download Task Files button at the top of this task. You will be provided with an evidence.zip file.

Extract the zip file's contents and recover the information in order to answer the questions.

Note: For free users using the AttackBox, the challenge is best done using your own environment. Some browsers may detect the file as malicious. The zip file is safe to download with md5 of 286c133a1b67c068f86cef06785e104d. In general, as a security practice, download the zip and analyze the forensic files on a dedicated lab machine, and not on your host OS.