DFIRHub

Windows registry artifactMobaXTerm

Collects all MobaXTerm/MobaTek administrative artifacts

  • Third Party Applications
  • 4 keys
  • NTUSERSOFTWARE

Registry keys

4 keys that RECmd reads for this artifact

  • NTUSERrecursive
    SOFTWARE\Mobatek

    Collects all MobaXTerm/MobaTek administrative artifacts

  • SOFTWARE
    Software\Mobatek\MobaXterm\M

    MobaXTerm Master Password Registry Key

  • SOFTWARE
    Software\Mobatek\MobaXterm\P

    MobaXTerm Passwords Registry Key

  • SOFTWARE
    Software\Mobatek\MobaXterm\C

    MobaXTerm Credentials Registry Key

References

2 links

Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)