Remotely_Interesting

tsuto

One of our scientists was connected remotely to his Windows workstation via RDP when he suddenly saw a strange window open and then got locked out. The EDR software immediately detected the threat and performed a memory dump of the Desktop Windows Manager process, which we've been able to recover. Can you find out what the scientist saw?

Challenge handout: https://drive.google.com/file/d/1PE_WcWk9XkTO9mz9nHwc6Qnwf7RET4jx/view?usp=sharing