Sherlock

Our systems were compromised by a recent internal attack. Fortunately, our IT admin managed to get a network capture before the attacker deleted all his traces. Please perform a DFIR investigation to uncover what actually happened. Note: The flag is split into 3 parts: - Part one: What is the username of the first compromised user? - Part two: What is the final compromised user's NTLM hash? - Part three: You have to get this last part on your own. This part contains the } wrapper of the flag. Flag format: flag{username_NTLNHash_lastPartOfTheFlag} (submit the first two parts in lowercase). - @kujen