Quiet Forest: The Hidden Administrator

You've obtained a BloodHound JSON export from the QUIETFOREST.LOCAL domain during a red team engagement. The client wants you to identify all privileged accounts, but something seems off. The SOC team mentioned they recently disabled a rogue Domain Admin account, but it still appears in some group membership lists.

BloodHound JSON excerpt (users.json):

code
[
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-1104","Properties":{"name":"ADMIN-BACKUP@QUIETFOREST.LOCAL","enabled":true,"lastlogon":1705234567}},
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-1105","Properties":{"name":"SVC-MSSQL@QUIETFOREST.LOCAL","enabled":true,"serviceprincipalnames":["MSSQLSvc/db01.quietforest.local:1433"]}},
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-1106","Properties":{"name":"JOHN.SMITH@QUIETFOREST.LOCAL","enabled":false,"admincount":1,"lastlogon":1698123456}},
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-500","Properties":{"name":"ADMINISTRATOR@QUIETFOREST.LOCAL","enabled":true}}
]

Group membership excerpt (groups.json):

code
[
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-512","Properties":{"name":"DOMAIN ADMINS@QUIETFOREST.LOCAL"},"Members":[{"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-500"},{"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-1104"}]},
  {"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-519","Properties":{"name":"ENTERPRISE ADMINS@QUIETFOREST.LOCAL"},"Members":[{"ObjectIdentifier":"S-1-5-21-3623811015-3361044348-30300820-500"}]}
]

The disabled account JOHN.SMITH has adminCount=1, indicating it was once privileged. Cross-reference the SID in old access logs:

Access log fragment (base64-encoded): VXNlciBTLTEtNS0yMS0zNjIzODExMDE1LTMzNjEwNDQzNDgtMzAzMDA4MjAtMTEwNiBhdHRlbXB0ZWQgcHJpdmlsZWdlZCBvcGVyYXRpb24gYXQ6IDE2OTgxMjM0MDAKRGF0YTogRGVsZXRlZCBzZXJ2aWNlIGFjY291bnQgaGlkZGVuX3N2Y19hY2NvdW50X3JlY29uXzIwMjM=

Your task: decode the log, identify the deleted service account name that was managed by the disabled Domain Admin. That account name is the flag.