APT34: Glimpse - Question 4

For 

What is the name of the Visual Basics script that is used to run the malicious PowerShell script?, I am wondering about where should I dig deeper into volatility into extracting the command history of the raw file, as I keep running into errors.

I am wondering about where should I be digging deeper to find out what I am doing wrong