SuperSonic: Ep.6 – TEMPLE

I have Problems with the last two questions:

In which file did the attacker find the credentials for the second account they accessed?

I extracted the 14 files with SMB/Wireshark but i am not able to find anyything.

Which two user accounts did the attacker use to access the SMB share? (Use a comma to separate the two usernames.)

I think i found one Account in the 14 files but at restart of the lab i dont find it anymore.

 (This are the last two Questions for Supersonic-Badge)