9375cff0413111d3b88a00104b2a6676MD5 hash

Reported by 1 independent source · first reported 1 Mar 2023 by Elastic Security Labs · last reported 1 Mar 2023

Last reported 3 years ago

What the reports say

1 report, newest first · the exact sentence from each

“- '\Registry\User\*\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001\*Password'”

Elastic Security LabsVendor1 Mar 2023
Detect Credential Access with Elastic Security

Indicators reported together

named in the same reports

process[.]pidin 1 report
posts.specterops[.]ioin 1 report
hxxps://github[.]com/AlessandroZ/LaZagnein 1 report
hxxps://github[.]com/GhostPack/Seatbeltin 1 report
hxxps://posts.specterops[.]io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107in 1 report
hxxps://github[.]com/gtworek/PSBits/tree/master/LSASecretDumperin 1 report
hxxps://github[.]com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.mdin 1 report

Copy these 7 indicators · defanged

7 indicators, defanged, one per line

process[.]pid
posts.specterops[.]io
hxxps://github[.]com/AlessandroZ/LaZagne
hxxps://github[.]com/GhostPack/Seatbelt
hxxps://posts.specterops[.]io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107
hxxps://github[.]com/gtworek/PSBits/tree/master/LSASecretDumper
hxxps://github[.]com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.md

Thanks — we review every report.

Report a wrong value