Benign powershell Download

AWS.Tools.RecycleBin 5.0.302

AWS SDK for .NET Core assemblyAuthenticode chain CN: Amazon Web Services, Inc.

SHA-25675eaf18d471e24cb77e6d0b4dd12c0b7d77d740520e1c5f070428558e41a793a

URLhttps://www.powershellgallery.com/api/v2/package/AWS.Tools.RecycleBin/5.0.302

MaleculeK₂(LiMc)O₂(AsC)H₄(Cm₅DbOs₂Po₂)Md₅(Bi₃Pa₂Si₄)

Evidence

AWS SDK for .NET Core assembly 0xc38f–0xc44f

0xc38f7572636554797065004a736f6e546f6burceType.JsonTok
0xc39f656e54797065006765745f4375727265enType.get_Curre
0xc3af6e74546f6b656e54797065004572726fntTokenType.Erro
0xc3bf7254797065006572726f725479706500rType.errorType.
0xc3cf41575353444b2e436f7265005f697350AWSSDK.Core._isP
0xc3df6167696e61746f72496e55736500496eaginatorInUse.In
0xc3ef766f6b654f7074696f6e734261736500vokeOptionsBase.
0xc3ff416d617a6f6e57656253657276696365AmazonWebService
0xc40f526573706f6e7365005461675265736fResponse.TagReso
0xc41f75726365526573706f6e736500556e74urceResponse.Unt
0xc42f61675265736f75726365526573706f6eagResourceRespon
0xc43f7365004c69737454616773466f725265se.ListTagsForRe
0xc44f736f75726365526573706f          sourceRespo     

.NET set_Item method reference 0xcc0c–0xcd1c

0xcc0c6d617a6f6e2e5574696c004d61727368mazon.Util.Marsh
0xcc1c616c6c00556e6d61727368616c6c0041all.Unmarshall.A
0xcc2c575353444b2e52656379636c6542696eWSSDK.RecycleBin
0xcc3c2e646c6c006765745f53747265616d00.dll.get_Stream.
0xcc4c6765745f436f6e74656e745374726561get_ContentStrea
0xcc5c6d007365745f436f6e74656e74537472m.set_ContentStr
0xcc6c65616d00506f6f6c6564436f6e74656eeam.PooledConten
0xcc7c7453747265616d004d656d6f72795374tStream.MemorySt
0xcc8c7265616d006765745f4974656d007365ream.get_Item.se
0xcc9c745f4974656d0053797374656d00416dt_Item.System.Am
0xccac617a6f6e2e52756e74696d652e496e74azon.Runtime.Int
0xccbc65726e616c2e5472616e73666f726d00ernal.Transform.
0xcccc466e00426f6f6c65616e0054696d6553Fn.Boolean.TimeS
0xccdc70616e006765745f546f6b656e006177pan.get_Token.aw
0xccec7353657373696f6e546f6b656e004361sSessionToken.Ca
0xccfc6e63656c6c6174696f6e546f6b656e00ncellationToken.
0xcd0c3c3e335f5f63616e63656c6c6174696f<>3__cancellatio
0xcd1c6e546f6b656e                    nToken          

Credentials filename marker 0xdb5a–0xdc1a

0xdb5a6973004d6963726f736f66742e436f64is.Microsoft.Cod
0xdb6a65416e616c797369730053797374656deAnalysis.System
0xdb7a2e546872656164696e672e5461736b73.Threading.Tasks
0xdb8a0041575343726564656e7469616c7300.AWSCredentials.
0xdb9a63726564656e7469616c730045717561credentials.Equa
0xdbaa6c730041575353444b5574696c730049ls.AWSSDKUtils.I
0xdbba6e7465726e616c53444b5574696c7300nternalSDKUtils.
0xdbca537472696e675574696c730050616769StringUtils.Pagi
0xdbda6e61746f725574696c73003c3e785f5fnatorUtils.<>x__
0xdbea636f6d62696e6564546f6b656e730053combinedTokens.S
0xdbfa797374656d2e546872656164696e672eystem.Threading.
0xdc0a5461736b732e457874656e73696f6e73Tasks.Extensions
0xdc1a00416d617a6f6e2e526563          .Amazon.Rec     

HttpClient UserAgent accessor 0xe0ab–0xe16b

0xe0ab656d2e546872656164696e672e546173em.Threading.Tas
0xe0bb6b732e536f75726365732e4956616c75ks.Sources.IValu
0xe0cb655461736b536f757263652e47657452eTaskSource.GetR
0xe0db6573756c7400536574526573756c7400esult.SetResult.
0xe0eb6765745f557365724167656e74005f75get_UserAgent._u
0xe0fb7365724167656e7400416d617a6f6e53serAgent.AmazonS
0xe10b657276696365436c69656e7400416d61erviceClient.Ama
0xe11b7a6f6e52656379636c6542696e436c69zonRecycleBinCli
0xe12b656e74005f636c69656e7400456e7669ent._client.Envi
0xe13b726f6e6d656e740053797374656d2e43ronment.System.C
0xe14b6f6c6c656374696f6e732e47656e6572ollections.Gener
0xe15b69632e494173796e63456e756d657261ic.IAsyncEnumera
0xe16b746f723c416d617a6f6e2e5265      tor<Amazon.Re   

PE version metadata includes CompanyName 0x11402–0x115d2

⋯3 more rows
0x11432420069006e002e000000400010000100B.i.n.....@.....
0x1144243006f006d00700061006e0079004e00C.o.m.p.a.n.y.N.
0x1145261006d0065000000000041006d006100a.m.e.....A.m.a.
0x114627a006f006e002e0063006f006d002c00z.o.n...c.o.m.,.
0x11472200049006e00630000004c0012000100 .I.n.c...L.....
0x11482460069006c0065004400650073006300F.i.l.e.D.e.s.c.
0x11492720069007000740069006f006e000000r.i.p.t.i.o.n...
0x114a20000410057005300530044004b002e00..A.W.S.S.D.K...
0x114b2520065006300790063006c0065004200R.e.c.y.c.l.e.B.
0x114c269006e00000036000b00010046006900i.n...6.....F.i.
0x114d26c006500560065007200730069006f00l.e.V.e.r.s.i.o.
0x114e26e000000000034002e0030002e003100n.....4...0...1.
0x114f2300030002e0031003400000000004c000.0...1.4.....L.
0x115021600010049006e007400650072006e00....I.n.t.e.r.n.
0x1151261006c004e0061006d00650000004100a.l.N.a.m.e...A.
⋯12 more rows

No evidence locations were recorded for this file. Raw result