This screenshot of an email reads: Thanks for getting back to me with the details, which confirmed what I was seeing. I'm just going to share with you some of my thoughts and recommendations being that I understand the Windows ecosystem and the technique. Utilman.exe is a Windows protected file and the only way to overwrite it would be to first disable windows system file checker. To achieve this one would need to be logged in ot the PC and typically is performed manually. The modification is done in the registry or direct calls into [obscured]. From the activity I would treat the host as fully compromised and from the commands issued assume that local creds were taken. Hopefully the local creds aren't domain creds? Recommend changing the users account information. Attackers typically do this as a 2nd stage access to a network in the event their initial access is lost. Thanks for the help and please let me know if you have any questions. [Name obscured]
{}