From 16abad8a93d8e603a8ca3a0d80db5449a690abf6 Mon Sep 17 00:00:00 2001
From: LuemmelSec <58529760+LuemmelSec@users.noreply.github.com>
Date: Wed, 5 Oct 2022 14:48:47 +0200
Subject: [PATCH] Update OfficeMemScraper.ps1

Added the "-append" flag for the out-file function.
When there is more than one process, the tool will iterate over each of them, create a dump and then out-file the results, overwriting them on each iteration.

In my case I dumped msedge.exe, which had 10 processes running.
The Token for office.com was only contained in one of the dumps.

With this addition, we can preserve all findings in one file :)
---
 OfficeMemScraper.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/OfficeMemScraper.ps1 b/OfficeMemScraper.ps1
index be246d6..b98d7ff 100644
--- a/OfficeMemScraper.ps1
+++ b/OfficeMemScraper.ps1
@@ -176,7 +176,7 @@ function Invoke-OfficeScrape {
             foreach ($d in $dumps) {
                 Write-Output "Scraping memory dump: $($d.FullName)"
                 $output = select-string -Path $d.FullName -Pattern eyJ0eX   
-                $output | out-file -encoding ascii $outfile
+                $output | out-file -append -encoding ascii $outfile
             }
         }
         else {