Wimdows 3 - author: deltabluejay - forensics

WriteUp: bylal, Eliot, Rubisk and tinderbox.

Among all users on the machine, we found that phasma is suspicious: it is not created at the same time as the others, and it seems to be dissimulated, as we can not directly login to it. It was added to the Remote Desktop Users group.