e0a7f645cc2a6b8f50013c69d2d69fd59ede914e223236c0dd1ed16dd21cd234

Analysis

user interaction
yes
max time kernel
298s
max time network
210s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MobaXterm_installer_26.3.msi
Size 12.9MB
Sample260425-pcgvgahs4s
SHA256 e0a7f645cc2a6b8f50013c69d2d69fd59ede914e223236c0dd1ed16dd21cd234
MD5 97516e0260fd75501c211672f606094c
SHA1 99e8dae6e9c48ac61a7111698e28e3659b3c97a9
SHA512 e70adcc9da4d3c0f1c2fd66aac874643949d7dfb43025ac189d4e60e3763e0ec9c704b25b915ca4489c2227d5b771e2379c76f27634c9ba1ab193e89ad1d9d02
SSDEEP 393216:vvh4B9MVflpqYB6e+JeSShzI6BVXKraiqM:B4zMVqkhz1RbiqM
TLSH
T133D6DE839C8B4CBDC103613BC511B75401195DE89FAC0B9ED6AA770BE9A18C6F6FB171
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1408	MobaXterm.exe
4432	MobaXterm.exe
5436	XWin_MobaX.exe
5624	xkbcomp_w32.exe

Loads dropped DLL 26 IoCs

pid	Process
3988	MsiExec.exe
4276	MsiExec.exe
748	MsiExec.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe
5624	xkbcomp_w32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3928	msiexec.exe
3	3928	msiexec.exe
4	3928	msiexec.exe
5	3928	msiexec.exe
11	3928	msiexec.exe
14	3928	msiexec.exe
17	3928	msiexec.exe
18	3928	msiexec.exe
19	3928	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm_installer.dat	msiexec.exe
File opened for modification	C:\PROGRA~2\Mobatek\MOBAXT~1\CygUtils.plugin	MobaXterm.exe
File created	C:\PROGRA~2\Mobatek\MOBAXT~1\CygUtils64.plugin	MobaXterm.exe
File opened for modification	C:\PROGRA~2\Mobatek\MOBAXT~1\MobaRTE.exe	MobaXterm.exe
File opened for modification	C:\PROGRA~2\Mobatek\MOBAXT~1\MobaXterm.ini	MobaXterm.exe
File created	C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe	msiexec.exe
File created	C:\PROGRA~2\Mobatek\MOBAXT~1\version.dat	MobaXterm.exe
File created	C:\PROGRA~2\Mobatek\MOBAXT~1\CygUtils.plugin	MobaXterm.exe
File opened for modification	C:\PROGRA~2\Mobatek\MOBAXT~1\CygUtils64.plugin	MobaXterm.exe
File created	C:\PROGRA~2\Mobatek\MOBAXT~1\MobaRTE.exe	MobaXterm.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF569EF55D828EF391.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6E1.tmp	msiexec.exe
File created	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaTextEditor.ico	msiexec.exe
File created	C:\Windows\SystemTemp\~DF86D40DD4E12ECFB8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2DE91EBF015F5E58.TMP	msiexec.exe
File created	C:\Windows\Installer\e58e4be.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}	msiexec.exe
File created	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaXterm.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaXterm.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaTextEditor.ico	msiexec.exe
File created	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaDiff.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE934.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58e4be.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B59A5C3B59AA187.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaDiff.ico	msiexec.exe
File created	C:\Windows\Installer\e58e4c0.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3928	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MobaXterm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MobaXterm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWin_MobaX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xkbcomp_w32.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005f9272311ec871480000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005f9272310000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809005f927231000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a5f927231000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d5f927231000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\*\shell\MobaTextEditor\AppliesTo = "System.Size:0..6000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\PackageCode = "682EE09B70456F94D993BB9E25FD3711"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\SourceList\PackageName = "MobaXterm_installer_26.3.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background\shell\OpenWithMobaXterm\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\" -openfolder \"%v\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.moba\ = "moba_auto_file"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mobaxterm\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\OpenWithMobaXterm\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\" -openfolder \"%L\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\ProductName = "MobaXterm"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\mobaxterm\shell\open\command\ = "C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe -protocolHandler \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Drive\shell\OpenWithMobaXterm\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\",0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Applications\MobaRTE.exe\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MobaRTE.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shell\MobaDiff	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\moba_auto_file	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.moba	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shell\OpenWithMobaXterm\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\",0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Drive\shell\OpenWithMobaXterm\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\OpenWithMobaFind\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\" -searchindir \"%v\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\MobaTextEditor\AppliesTo = "System.Size:0..6000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\MobaDiff\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\MobaDiff	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\*\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\OpenWithMobaXterm\ = "Open MobaXterm terminal here"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\OpenWithMobaFind\ = "Find text using MobaFind"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\*\shell\MobaTextEditor\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\moba_auto_file\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background\shell\OpenWithMobaFind\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\background\shell\OpenWithMobaFind\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\",2"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\OpenWithMobaXterm	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background\shell\OpenWithMobaXterm\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\OpenWithMobaFind\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\",2"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\OpenWithMobaFind\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background\shell\OpenWithMobaFind	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mobaxterm\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MobaRTE.exe\AppliesTo = "MobaTextEditor"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Drive	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\OpenWithMobaFind	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Applications\MobaRTE.exe\AppliesTo = "MobaTextEditor"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\Version = "436404224"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\mobaxterm	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\mobaxterm\ = "URL:mobaxterm Protocol Handler"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\*\shell\MobaDiff\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\OpenWithMobaFind\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\",2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\.moba\ = "moba_auto_file"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\moba_auto_file\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\mobaxterm\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\MobaRTE.exe\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\ProductIcon = "C:\\Windows\\Installer\\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\\MobaXterm.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F406A5471A50768488189588E88C8B60\9931C8ABACC302643841A44A5B0E500D	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Drive\shell\OpenWithMobaXterm\ = "Open MobaXterm terminal here"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\Background\shell\OpenWithMobaFind\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\" -searchindir \"%v\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Applications\MobaRTE.exe\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\moba_auto_file\shell\open\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaXterm.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\MobaDiff\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Directory\shell\MobaDiff\command\ = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\" -contextdiff \"%L\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Drive\shell\OpenWithMobaFind\Icon = "\"C:\\Program Files (x86)\\Mobatek\\MobaXterm\\MobaRTE.exe\",2"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\*\shell\MobaTextEditor	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9931C8ABACC302643841A44A5B0E500D\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\mobaxterm\shell	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5436	XWin_MobaX.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2460	msiexec.exe
2460	msiexec.exe
4432	MobaXterm.exe
4432	MobaXterm.exe
4432	MobaXterm.exe
4432	MobaXterm.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3928	msiexec.exe
Token: SeSecurityPrivilege	2460	msiexec.exe
Token: SeCreateTokenPrivilege	3928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3928	msiexec.exe
Token: SeLockMemoryPrivilege	3928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3928	msiexec.exe
Token: SeMachineAccountPrivilege	3928	msiexec.exe
Token: SeTcbPrivilege	3928	msiexec.exe
Token: SeSecurityPrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeLoadDriverPrivilege	3928	msiexec.exe
Token: SeSystemProfilePrivilege	3928	msiexec.exe
Token: SeSystemtimePrivilege	3928	msiexec.exe
Token: SeProfSingleProcessPrivilege	3928	msiexec.exe
Token: SeIncBasePriorityPrivilege	3928	msiexec.exe
Token: SeCreatePagefilePrivilege	3928	msiexec.exe
Token: SeCreatePermanentPrivilege	3928	msiexec.exe
Token: SeBackupPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeShutdownPrivilege	3928	msiexec.exe
Token: SeDebugPrivilege	3928	msiexec.exe
Token: SeAuditPrivilege	3928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3928	msiexec.exe
Token: SeChangeNotifyPrivilege	3928	msiexec.exe
Token: SeRemoteShutdownPrivilege	3928	msiexec.exe
Token: SeUndockPrivilege	3928	msiexec.exe
Token: SeSyncAgentPrivilege	3928	msiexec.exe
Token: SeEnableDelegationPrivilege	3928	msiexec.exe
Token: SeManageVolumePrivilege	3928	msiexec.exe
Token: SeImpersonatePrivilege	3928	msiexec.exe
Token: SeCreateGlobalPrivilege	3928	msiexec.exe
Token: SeCreateTokenPrivilege	3928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3928	msiexec.exe
Token: SeLockMemoryPrivilege	3928	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3928	msiexec.exe
Token: SeMachineAccountPrivilege	3928	msiexec.exe
Token: SeTcbPrivilege	3928	msiexec.exe
Token: SeSecurityPrivilege	3928	msiexec.exe
Token: SeTakeOwnershipPrivilege	3928	msiexec.exe
Token: SeLoadDriverPrivilege	3928	msiexec.exe
Token: SeSystemProfilePrivilege	3928	msiexec.exe
Token: SeSystemtimePrivilege	3928	msiexec.exe
Token: SeProfSingleProcessPrivilege	3928	msiexec.exe
Token: SeIncBasePriorityPrivilege	3928	msiexec.exe
Token: SeCreatePagefilePrivilege	3928	msiexec.exe
Token: SeCreatePermanentPrivilege	3928	msiexec.exe
Token: SeBackupPrivilege	3928	msiexec.exe
Token: SeRestorePrivilege	3928	msiexec.exe
Token: SeShutdownPrivilege	3928	msiexec.exe
Token: SeDebugPrivilege	3928	msiexec.exe
Token: SeAuditPrivilege	3928	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3928	msiexec.exe
Token: SeChangeNotifyPrivilege	3928	msiexec.exe
Token: SeRemoteShutdownPrivilege	3928	msiexec.exe
Token: SeUndockPrivilege	3928	msiexec.exe
Token: SeSyncAgentPrivilege	3928	msiexec.exe
Token: SeEnableDelegationPrivilege	3928	msiexec.exe
Token: SeManageVolumePrivilege	3928	msiexec.exe
Token: SeImpersonatePrivilege	3928	msiexec.exe
Token: SeCreateGlobalPrivilege	3928	msiexec.exe
Token: SeCreateTokenPrivilege	3928	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3928	msiexec.exe
Token: SeLockMemoryPrivilege	3928	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3928	msiexec.exe
1408	MobaXterm.exe
3928	msiexec.exe
4432	MobaXterm.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe
5436	XWin_MobaX.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1408	MobaXterm.exe
4432	MobaXterm.exe
5436	XWin_MobaX.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 3988	2460	msiexec.exe	81
PID 2460 wrote to memory of 244	2460	msiexec.exe	85
PID 2460 wrote to memory of 4276	2460	msiexec.exe	87
PID 2460 wrote to memory of 748	2460	msiexec.exe	88
PID 2460 wrote to memory of 1408	2460	msiexec.exe	89
PID 4432 wrote to memory of 5436	4432	MobaXterm.exe	92
PID 5436 wrote to memory of 5624	5436	XWin_MobaX.exe	93

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MobaXterm_installer_26.3.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3928

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D37112855AF75921F1F2289A604699E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3988
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:244
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding ED6DF41ED9904DB4D757EA2586AF6F47
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4276
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 97422E7CB7C4E71C2FB7E27A640F927E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:748
- C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe
  "C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe" -instunpack -msipath C:\Users\Admin\AppData\Local\Temp\MobaXterm_installer_26.3.msi
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3952

C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe
"C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\XWin_MobaX.exe
  "C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\XWin_MobaX.exe" -silent-dup-error -notrayicon -nolisten inet6 -hostintitle +bs -clipboard -nowgl -multiwindow -noreset :0
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\xkbcomp_w32.exe
    "C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\xkbcomp_w32.exe" -w 1 "-RC:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\xkb" -xkm "C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\var\log\xwin\xkb_a05440" -em1 "The XKEYBOARD keymap compiler (xkbcomp) reports:" -emp "> " -eml "Errors from xkbcomp are not fatal to the X server" "C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\var\log\xwin\server-0.xkm"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58e4bf.rbs

Path C:\Config.Msi\e58e4bf.rbs
Size 165KB
SHA256 495d97d7bd335f0c616bb8932df85a5178f1de436204524aca053463fc1c8a60
MD5 67e46ede18a9d63eb854e8b08f6dbf8c
SHA1 74541bff3167e84a1610b107524076cafb75ce26
SHA512 9fae1384811e985ffedf8e1d3f8724e7109b9e668deb6940be0022763a56bd3ee3499cea3efe67e15487d845338511b0695d795a8c573aa7508045c1beabdf2c
SSDEEP 1536:2JBXpE+chXzGFcvDKeQlWe+LTwhT06Ua/782ix4UjAr628r4TbmMOI5IJhb6+I1i:0FpEPXElP22c4GusR6ZKX1PJEQ7+kQ+h
TLSH
T1ABF39E327181C1B6F2A319B3E657C7319E3DF5680710858E5B868E5FAC28596BFB7302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CygUtils64.plugin

Path C:\PROGRA~2\Mobatek\MOBAXT~1\CygUtils64.plugin
Size 12.2MB
SHA256 13a7d69f86bb7c737f8acb009caba88e3c3a2624fed87c2cb73db3009460b872
MD5 ad5649f4f213366a3bcc9e4a265086da
SHA1 e0a6a04459e4404e302ff8848a95d76b5ce6a339
SHA512 85b9d1b5fed1ad0a3f0f9ce65481c1215eca6f7bba28612f9326495a7b7780ef278e116b9a22006279d86592a71c6a7a645b13eac050b7f4f38b0a05babe47a1
SSDEEP 393216:7iKJZU6bAUqifUFohuBHl84n15XWB2taxDr:VAN1H5nrGGaxP
TLSH
T14ED633AAE7596835C129B7BCEC5F40A37B27D6D9CC10CD05AF8DC9A0FC44962C54B88B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MobaXterm_installer.dat

Path C:\PROGRA~2\Mobatek\MOBAXT~1\MobaXterm_installer.dat
Size 30.5MB
SHA256 d39d8d8b7fb1a3686cd434c7e1214ceb046ddae891471e4f97dce790cfed2b60
MD5 bc247427bbed431bae807b4d32c031e3
SHA1 762624511d7d833284ae94df2548826c489c7101
SHA512 b9fb913f22bf86c9c74d2d6aa22aa57d86e99d246928412154b3d40cac311eb9e157f7292c5a15c8af7a13389d756b8f134a465cc50a8a7bdc90cd013f4a22bf
SSDEEP 786432:salPlNxYjdnwFdvPYTbf4YQYKBAN1H5nrGGaxg:7BxYjhSATD7Q9sH5nSG1
TLSH
T132673375D75E2435C9215BB1E48781A33B2BB1C6D804D901AF8CA5F6FD4F98A860F88F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

version.dat

Path C:\PROGRA~2\Mobatek\MOBAXT~1\version.dat
Size 15B
SHA256 e130ba8b3f3bbec23ed3d32ff7089bc4f37395391f8babfc5d80639a16fc6ac6
MD5 695fbc1a6bd7548310e922be88234a41
SHA1 cef18de173b2359726188a17b9d7feb1c8618e36
SHA512 869ef884858c23fa214b6c3b0637ced47910c9df39b3b1865820e0f6813b702375aa29bee2f12965513ade0dfaca527943b4012700c3549ceedcf3c8daf375f0
MD5 SHA1 SHA512

Submit Download

MobaXterm.exe

Path C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe
Size 15.8MB
SHA256 63b3dab055fd78adc8155d6fd4febe9920e4c00e56c04b57e6754ef7b41d538a
MD5 373863338b32e5a281c8b5dabd669a5b
SHA1 e9bfc424f9cf4c89160862a01fe54303f78b4d54
SHA512 dcb3c6278c2789683ca535a2090d07ac3b7278d1eef5270ccd1bb7341bc259e34b0d8a5866dcf610eaf90bb55e5b807dd4850b551386870cc33dd7e28213da6b
SSDEEP 393216:FHlNJzWmZJ7uomDG74sJ2FVjeLubfGUzmd38Irx2kcl:1FJ91J2aUzKnYk6
TLSH
T180F6C029F6429837D0631B748D1B82D9A529BB303F3815977BE82F0C6B7839375392D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 765B
SHA256 92141f189484da81a4e75d20bcd5af66bd3531f987b7717014189e6c15fb0d99
MD5 5355bb87b98b7439632616a40606e54f
SHA1 a12062d0568da99cb4b2a2842eb68d81f5feff18
SHA512 7abb6b1b07162f4942bbde080dccaaa97b2d1eb4eec4bf3f78d9c72141cd157f79238db26b442a13a71ef2d026a1a419557f4031c0d325fd9f8b0f0d75690cdf
TLSH
T18A01753A4E7B9587BB3609602EBCD03A2614391278E6071F7CBCB3095D44F161B31828
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_8FFAA0226E8BAD334E0300C6B80A16E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_8FFAA0226E8BAD334E0300C6B80A16E8
Size 637B
SHA256 ce7478bd7f0dd29480deeb1073d5525e82f4edb158f61d062d1f65e2a45414d4
MD5 9f1a17363ea106e36f389154d7d8c02c
SHA1 ff4bcd13532ccd87462f0f5259656c37cd0d44e0
SHA512 9199b2303381d8ec1c257d1c374df8bebe6e15f2a296833ee0c1f94a260717f8813fe896b8ad363b51ed4ba04ededbfc1cb8cba2a8b0c3afb6df0eb79845f965
TLSH
T100F0D346447CCCB7681E41110D55ED6E008131DFBFCC6487651A179145927624E8DD19
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 1KB
SHA256 1c4632b4f658f93fb9e2ff9098b061cff8dbb2b84d7c4c4fb0053b75dda0a5e5
MD5 3a018c328f5fc7fa3a522742bef0d94e
SHA1 8d8e2a7589db114c28efe332d400aa8d1ea37bd0
SHA512 694c7933bf53f7fd3a76f5eebffca7575fae89778c45a3d11afbb681617fe5fa816aa224590ebb27185d857fe4210c9bf6abbec610007007b421bd5365f69959
TLSH
T1EF31E6D3AB78BA205E194E50A8AD4B62BCF470F6FAA408753CB8001BA0A6FD0180980D
MD5 SHA1 SHA512 TLSH

Submit Download

18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013
Size 484B
SHA256 53d1debf5f9844f354412c053497c552b74d33f54d7fa5f4204445547701707d
MD5 a47505344cbef513c0bc5baaabf17e6e
SHA1 8d1f752e0981989883b14292e9241a60ba3e7abf
SHA512 29284482e8cc7cc18d1f648df4e7561a4bb7090fd36b7b2a2039acbbc1b323eaf21c9f08b6bc50d9ab272bf04a8eaba8680b3c51d8d70722270aa1cff923220d
TLSH
T1E5F0AB3C8AAA803FF095CCB19ED4A137E805F322345541BC06E60B045B03D85BC661BA
MD5 SHA1 SHA512 TLSH

Submit Download

3AA0DCD5A74331FBD6F344550EC48B87_8FFAA0226E8BAD334E0300C6B80A16E8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3AA0DCD5A74331FBD6F344550EC48B87_8FFAA0226E8BAD334E0300C6B80A16E8
Size 484B
SHA256 e8cf5f6ecfd5727d3e58f19113068b5c002ad5a0ed29779477e07a2d5d66a9a1
MD5 589d399a479311e9cb3a5d29a037b008
SHA1 423ad7131ce4ac8a40a62f62217148bd10f150d1
SHA512 a76107bc37ac88a5f6ed5ceb769845a2cf87f04166f6b1cd206e343ebd43f01087a9e1df178fcf1d0ff978afce0da29d2ea2d581ff6bda8fc8aa5bc32a96398d
TLSH
T16AF0A3241DF6417FE4B4CD7D4BC4806FDD6BF333240445AA5990070B9A01F808C61DA5
MD5 SHA1 SHA512 TLSH

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F
Size 482B
SHA256 1a59380c6d52d9d561d2165982bac9b4c6d436482d965dd683d90d4ac9ee4b0d
MD5 b742a39462c629a1068459582b63df02
SHA1 e1552fdfed6dcc15c7cb0a063692c001588ac9c4
SHA512 3dc27d235c2acf660db32cc83ac7f349f64fe76cc10428cc25f5aa8a399765f22762a24fd02531dd42fc9cec2c53b55e2a9369c3131c66dc531c54dea03c1ed3
TLSH
T164F0A3346EFA606DF0779E74C9D8F51B58BCF7220401119701711506AE477834E91137
MD5 SHA1 SHA512 TLSH

Submit Download

MSIAB2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIAB2F.tmp
Size 64KB
SHA256 428c16fad8a8190a6090fa940c2ef2d5c13168f721d958750a874ff8c13c5a85
MD5 5ea7455a71a9b481d0d9402c4e4e19d7
SHA1 4630e3d9788c445812ae7f3a5436b809c6cda09e
SHA512 124b8cc4590eb31fbd336031ff4dc86987ca320a768cf8d6350f1d1628761d4099e8f4baf5b25bb9587afb903a4911efa950c15dcdae3aedfdd56b7ac2199370
SSDEEP 768:7k1qSO8a8WTyFWV91fVHbAkAAj+6KHpRmLihvIMKE9Y0Th+DCGqN1:Sm8a8WT9fgAjqpLNITEnTh+eGqN1
TLSH
T125537C217350D23AC09B6435A465C6722A7EB5315EF5C5CB7FA707AE5F302C0B67A30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MobaRTE.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\MobaRTE.exe
Size 6.1MB
SHA256 76873821e258fcd98ff842fbc7bade3e369342ba010875f3fe1e39051403b3c7
MD5 e4097b99e9df3d0d65b612b1cdb8b80c
SHA1 01917f081a086f98ac1c2b4637a64981be8ccdd3
SHA512 4dca17a71197d0e32c63cca26e785cb6d52715d276b88a32064ee8f69d8ec5ddfb17149db4af3ee9298ae8b975031f97b3b391e921f05688feb8c2e7a67ebb4d
SSDEEP 98304:uU5QPHXsoC6sANhgm/ZM9GDeqcOWCRKbbrF:zroC6DNhga0nx
TLSH
T125567C01F3D1499BF8737B744C6283994D26BE211EA9968B26947E0D1E35EC06D3E3F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MobaSCP.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\MobaSCP.exe
Size 875KB
SHA256 757fc5c39a53a362594d36092a883e123ea319ec761e9ae68a9f74f83f2f2d6c
MD5 91ea0091b7435bdeb8f508bc2912e8c9
SHA1 174e56d1685ab7a4ce3388259bc40739577fce2a
SHA512 b3ba3f1db961ebb9af2b6b06cea2d8842dce1f14f32f56e679783062aad581e31e1687ba824ecc71f527ab5e386bfb92d2421942eb35eba5ec4efd8df2466de0
SSDEEP 24576:8TmoDU+5UcOMM9T0y2gdkJ7W3ZVm2mt/Gi3DAj5pQ1KCVR:8TZU+UMMZ/Tds7WaLWOn
TLSH
T1EE155B84FAC7A4F2ED470AB08553F7BF5B319600C434CD76DA5CA949FD63A63912A328
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XWin_MobaX.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\XWin_MobaX.exe
Size 3.3MB
SHA256 1baaa9355c9e3f51336d72724c049d1b864234e45e3437c3bc30a8038ba9c62e
MD5 6aa1f1580651cb4d7f4ab53024d90395
SHA1 991e8fb6c4949b3500b57bc96bd66fadab5bcc81
SHA512 a3d7bc682dd3ef2007aeffc334b116d330fccd91f2a26bb8df62c12367cfb7800097139742fec18f83ff5ffab13f5d4a73e62eaf391384eef4d41f66d963ac46
SSDEEP 98304:0XDKfTzqNPnMM0RHWZMFpaiaNGT/FoFTWf6:0XDKfvqNvMM0RHWZipuNwFDS
TLSH
T1FFF5091AE34790B5C463B672424BE6BFF2246B0DC0226E6FEE5E1C14F73B601592D16B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

basename

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\basename
Size 28B
SHA256 7582e2ef3402aa6be87c8e8fcb2e396769663be83a3ab7446bb64b67edf67a67
MD5 d8a937ce890c7fd9ed05c23908a6dcd7
SHA1 c4732d4beb8115e4114e9c68747b06a5a14a1753
SHA512 834b451773f77ee271df85ea9899a3f0e16d44cf68571cfa2de4f2b831639dda7403f99d1bbf8d771ceb8e9b36632133755c488325a9667c15b4ea3112fc6bd9
MD5 SHA1 SHA512

Submit Download

egrep.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\egrep.exe
Size 56KB
SHA256 e36de90bd13bf93ba423a449b2e4155f57f3a3436f7f1017a39883a8545cebf2
MD5 cb8103caf0d892f30fb3f1ffb8339842
SHA1 6d3b420c00049179f17de96338f3a52c40139a69
SHA512 fe4f2cad7d7fb8c10e189970e9e929c1646fcbb89ecdb59615063adeacd48df0e17ba77d53a50d6c0b85f89bd05a6e634a1fe9f3a5d3a380b4b9816ec2119300
SSDEEP 1536:Kqm5CeAK6d4HivQlQHqgyd8Rg1my8wxW:7YDzdgydYg1mDws
TLSH
T15C43643AE3F78078C0AAD0789B4283736EB4BD1D1529B2EB5394E5D23F154745F6E2A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

git-upload-pack.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\git-upload-pack.exe
Size 28B
SHA256 f8b0cc4efb6663615eb5fc4a359752df3f01643dec68fd6598d39df5bd7370c2
MD5 9ffbcfdc36f6b0c1088aed96a6030654
SHA1 dacbe9b9b45fceef704f76a93019938eec4b93ee
SHA512 89add0c78330db5cc063ca1095664077d4e23598d69cc7ec1ff540f47a0872232f8141c4464019ecf28a30f942dcac2130a538434dd6f35a777032478ef99995
MD5 SHA1 SHA512

Submit Download

iperf.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\iperf.exe
Size 62KB
SHA256 53e30918275a333054cbe745cbf0086559b2cf6732b8c7c13d969c50f89456ea
MD5 a02e8c65c4d45d304f2707a65fa8b270
SHA1 907290b068df0d79ad633266e78db5308d2977cc
SHA512 88132269a2461b7df3a6cf797a0beaaffaccad8ee76ee44555381a68508f370de5ca0760bc94948efaf41a6c2539094f5b20cedf50cb50b65ca7b55e49f67328
SSDEEP 768:R/PyrOEq3wTsZqSvZUNsDYX7YDqR/kZalZaAHlgTYHkwmBObzQRWv:RyKysZqSvZGsUcDqVkgzHlPFmBfRWv
TLSH
T10653191FB2A350BCC14BC0B182A96B71EB33F96502357B6D6718E7700F25964AF2F919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libX11-6.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libX11-6.dll
Size 1.2MB
SHA256 497471497886f18ca16f7facab7d76dc9bfadd69deb9c6e4ea9bdc0869a15628
MD5 3cd9af46753f2a618d15157372d0d2bc
SHA1 f2a1781b1a6d33338db4d9725b28f15d8a410903
SHA512 925097106554f6eac698ba933e32fb82c1405c7ccfe284b27f1558e9ab46139506b1e981721aeafaf2e0d595dbdfce3587c4056c6920fdffb0b2f2bdbdcdb38d
SSDEEP 24576:uA7S97BMxq0REUm75horlhVwwf7JtdVrd:ud9VMxq0REUm7IrlhVd7d
TLSH
T12E555D1AE20380F9D827F272466BD9BFF2249B2DC0261D6F9D5E1E14FB37A60684C157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libXau-6.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libXau-6.dll
Size 20KB
SHA256 0da1f856d92d6b95f10ed8c3f629cd15468c906de9352fb4ae629139d1412eed
MD5 b6f0655bed934503621fcf94ba449a19
SHA1 f0a5d9eefff5f3bcd2e23b9db748c50cffc1c6e8
SHA512 77a10ae1748e5d76288c59933f3f41d4dc7a690b1f2bc9bff0b761f9f2c5331f868dc0259ffe4c4672e1806c33f3f9d0fe0a8b09b10e06333d2590f623c5b284
SSDEEP 192:vdBaTJcGAV5S55Nv8ekSoifItD33VBBmBJI3b5Ud5kbQbDTHlNspsorvgAFa2jf7:lBwcGAV5S55ZkBpTVTuI3dUd5GFoCJg+
TLSH
T1F792D815F50A98F5DAE7F2BD8596DB7BC1E12A0380277677BF16FA0C7463887B008146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libXdmcp-6.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libXdmcp-6.dll
Size 28KB
SHA256 7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba
MD5 7d4f4d3bc6ab6c3ea2097a7ecd018728
SHA1 2434fbad089ac85eda43c0b0e911ab437b4dfe63
SHA512 f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8
SSDEEP 384:sEZJxxKcB6SOd08J0DBljbG4H80iIOitbr0iIOi1Nk6qTdOoTcFbf3IU2xRov+h2:sEYWnJH80Qi0Q+ZOcFDR27e
TLSH
T13AD2074BF70A99F6E17BA7B6859BC73387AA54110132BA7B6F0DF30D3873912E905184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libdl.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libdl.dll
Size 17KB
SHA256 e1646c7778c24407a17881908037a49ecfcb5a980d155212d544302653a3ef62
MD5 ed925bdab51f49813686b62eb82fb4a4
SHA1 bc7c742b92a5b47089e0b400a8a80bb217e775fe
SHA512 5be99a6b0e2091fe37ff50d5a9c4fa789db27b5ba108801e4d18e99ae584ae1bc91ba3339916dff8a323155815e660f43ca54ffcc7c14c1e3f90600aedb54bd8
SSDEEP 192:9oqX4Maf/9pG1cBQS6YEn8+K8fZkkLGM2u5YiXNDTPsd9/9ZidfuOiSLU8:9XX4My/9pG1cBQS6nb6kqu28wOY8
TLSH
T11C72D819F70B94F1D6ABE17C8657DB77D5626A130123B6B7BB88F70CE8B3902E809105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libgcc_s_dw2-1.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libgcc_s_dw2-1.dll
Size 114KB
SHA256 c7544e1f9927afdf6e8cd7063020b572e60fe8f00af39227eb831d331df38225
MD5 d35376c0d447108b2f9d64d4c40014f8
SHA1 c68129e8bf6cdaaa318c5aad8974efbc2b7ce39a
SHA512 c46af0bbd3bca6e12125750a5b1ca4f17f85f84729b1c1c01ee76de3704bcdb090212202cf449458833f8ee92e9a46c8758cbd069747de534e2984dccbe9f24d
SSDEEP 1536:YkTNSPvyLV9dUT+PspQ+2Q4p2VtjByBzEgezt2f38hD99/E3oiHjyYIx7s:YZilU6PspQ+2zsBy2q8hD83oiHjyYA7s
TLSH
T1B9B31B00FACB61E4F96795B98517BB3BDA107A110034E979FF89FB4BE472543E42920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglapi-0.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libglapi-0.dll
Size 201KB
SHA256 284701380f33a30b25e8eb9822e7f47179238e91d08bd3fb5a117145de7e0d8d
MD5 04e73806d86a77ca6bbfe41be8db5494
SHA1 c31346161ee9a9b40e7e2fc826e6c374778af7a7
SHA512 452b95557bfcb638daa07ea427cd140830839b6ad950d8e282fabec78ceb7476558ab7996fcb526371c6b143028ebf288c0579f37011b3be5fbb92d68d452042
SSDEEP 3072:XEuzWU+gImW1gZCnZslqf53P3fMN0PvNPbbkl/v9xRvt3MEsF5HBx0JknvjrFVfE:gP3qI7tuUb9I
TLSH
T1BC14BC2AA0270DF6C9319733458BC86BC324768956272F4F394E1E27F2BF605BD5E246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libwinpthread-1.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libwinpthread-1.dll
Size 96KB
SHA256 620a7e658af05cc848091b8a639854b9b15700a9061b4a3d078523653133a4af
MD5 c6e473bbed2fa26953bebfdd0b66419f
SHA1 226e16684e02c6331f7ee82d02d058e2c55f8ba5
SHA512 277419eafcec04618304f19b8b5b4aa55e0233fd6118d92a41d51447f210be382aac9098f3476b9d5891ec180c4d3450fa556705e6cd0e6e2b414097860f0e9b
SSDEEP 1536:IIW8gl4cRxGgURT1nJesB6fyIer2UWrSvTEfqRkb9VhW4iI4im3YcoF:Ieg9xGznJJFmATEYkbviI4im3YcoF
TLSH
T16CA32A5CBB8B69F0E2B25036C74ED77B46929306001BFBB2FB19EB4EB8775163418146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxcb-1.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libxcb-1.dll
Size 132KB
SHA256 394d2d862f2ddce71f28d9b933b21a7d6c621c80ef28652574f758f77f01f716
MD5 a4212be49e5ce8f3bf3950ca32c4bf14
SHA1 53f8e986e5fa3844eb73f063ed01772b53bc2504
SHA512 74520d3b3749d2b61e8a970c1fb29c588f98ce477eac4ced8837420153a6e739303aca15ed7d1e070125afa7f3ee32e452815ef1af135f8ed39ef2fce9d333ab
SSDEEP 3072:aIGpdymum+ToZU+DXGzm7YVB7h0We49UP9PXrW:9mTj++zGzmcVB7h0h49UP9/rW
TLSH
T1A3D3422AF401C5A6D0B7E7F7918BCA7F91186B0CC722AE5FAECE4D44F36A641C425607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxcb-image-0.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libxcb-image-0.dll
Size 25KB
SHA256 cb220267fb0116b298bab6a09a764420d630c52026f7d750f8ffca4818389327
MD5 a3718d24f0e6eae9d6121a1219381ae9
SHA1 a3377f64d8fb6162f6280d3d924626c1fc6a2fe7
SHA512 43f9c760be222490d43cbd9589b4afbc64759919993a1957a13a753cfcc9d94059dba0b5400a745c377c7bea1f02f4f8f6f952bee5b7ed33f6a49efaec62e9f6
SSDEEP 384:MQg1oL5xGT8So2/8iC6KcIId6dTGtDVHJsH9I8qxeHt6Lboi7:1g4i8i5EdTUpGdrBMLV
TLSH
T159B23A09FA0BD8F1E9A7A175AD9FE777C55029010212EBB2EF89E74DF173282E01D506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxcb-shm-0.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libxcb-shm-0.dll
Size 19KB
SHA256 e102c9c5b22ceb60dc516ab4124bea8ec8e808b08eec48ea7ac674d13fca82ef
MD5 557ed85a1d8a3308e552a77a9902e8cf
SHA1 a9acf7a1db500a734e95038b29c0bd90f7af59e7
SHA512 110acfc0b886a1ff77b5452e2f813213630ba2eb4610e06942a59da78e516e05893b049c0d1ddcc077ebabb3a9490cf84fb41f31b62822c9365b60a1b38fd4b8
SSDEEP 192:w/gaEEPQOv7AV2SbsZ/oBtUoBx1tFnMDRlqbE9ubTtEHL+zJjIOaDTTsGzXKMy73:MgIv7AV2SbsoBCoBntUSd7z0y74Yd97
TLSH
T1F392E61AF501C1B2D9B7D7BB818F8B7FC1942E418A139B6FBF88ED197023895D81A507
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libxcb-util-1.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\libxcb-util-1.dll
Size 23KB
SHA256 b5acf358ff97127eac9ef4c664a980b937376b5295ef23d77ee338225de10d60
MD5 ee6788d3d3750421e01519a27f86634e
SHA1 48f4c7dc7bd1208f07e4176e78f035d36682d687
SHA512 12ef0ac4cf9c8461044317e693bcfabdb4beb34a222b635ba50f6652b5a91b92ff20cb19e916ac60dca3e8314b7d8cec710a1c730374bb8f260b8d94f57c9775
SSDEEP 384:FlSwg+49czS++g6Od6e4um1J47E6Lx7Ow7qOocOS1:FlWgPdX66wwQJk
TLSH
T150B20916F90688E6FEEBA27E8AA79737C76479004115E277FB4DE60DF073186D01D10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rsync.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\rsync.exe
Size 525KB
SHA256 133ce5b47ed74e3a6b970992558b425eabc7b0f82c501e8fe6488202ec109c66
MD5 1627d27ccdd1a2f2afb3b65bf2731742
SHA1 d73d2a318b1fef34273f9cf46b05a0d2404f6302
SHA512 2f5be154f619fe005dfa8614cd602fc0be697ee18b93eca9f8e0f550a05f0c4886fb7a6f3f837d3eb5d7cec82f5278573bcd279ebdec2936fca9bef30bf1d2ce
SSDEEP 12288:MkitdzUcN+PB397U1p9O1CXjJO+DiHIYGWYzP31TJnGl:M3XN+PhEQ1YDPYG91TJGl
TLSH
T165B46C1AE3E320BCC52BC1758BA79772BAB1B42412307DBF2198E7741F11D50276AF68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

swrast_dri.so

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\swrast_dri.so
Size 5.5MB
SHA256 e958d03db79e9f1d2770c70a5bc24904aa3e2d27a8d5637684cf8166b38908f2
MD5 05fdc592af4f67ce10cfe808201e9fa6
SHA1 64a60c22b9ef98e0f897b71911f1424d3a39acea
SHA512 856345be44e6ca3a211bc5a05e41035a28373ac19bd35c09b4352ea74a2b791710cdfd111ec6e27919e57c7bc74f2eb1bfbf2c1c9cfa607672869b3180001213
SSDEEP 49152:WkDOXR+Yow66p7pJRqpvQfDlNXWHnCgJf1oQNbpn+1rhEFdwQj6yoclwwPUHQa:WUYow6+R+QhNXWHCgJf1ArGDlBPUH/
TLSH
T1BE46F81EE503907AC967B3B2414BD1FF9224AB39C0136F9FFE990C18FB36651581A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toybox.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\toybox.exe
Size 453KB
SHA256 2e964c017df8b7d56600a5d68018f9f810a1c7dd3da800b5b5dfe85e9ce6b385
MD5 01b521c78f5bbdaba0cc221bc893e2b8
SHA1 2dad7fa742175aee9a241ae4548b9f6673df7e1a
SHA512 1124cd5d96ce2a374b282b03a12e46aaecdb4a8823c61f7bab11bc70b285facf3950759bdd4d153adc26915680fea4d6414208974d8f3ba19d56bdd3a3782eb5
SSDEEP 6144:shxHDqccm/c/5QaXxTTBW9VxGg3d5B6t8b21/6v/3vIGXXMmqi/sZHu:sPDqrccOaBTdWrxHHB6t8b21hQsZHu
TLSH
T1E0A47C23E2A212B9C966C171CBDA9333BA71F48912747A1E36ADC7242F21D71537FB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xkbcomp_w32.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\xkbcomp_w32.exe
Size 291KB
SHA256 0693cfa59aa1f79b1d401af22d6dd33c1ad64297165345fef6fea663b94e91f5
MD5 b2b22157777ed19c9f1369e2d45c1510
SHA1 e516b6baa035f3b852799a88ebbfba3848b12e60
SHA512 2b8d558808ad839deab960d435d13f240182e16fc8d79292e10e81d5733ee1a5cb7ac7952d43a42ca85ba412ec0eea0c8b8a576726208b6b836bc00964327f75
SSDEEP 6144:J1iSvLlkl4ySmNOnm9MoNFi5L4/WFe64sC88fX3dm56fj:3vL6l4RnIMoNFEL4/WFmf9F
TLSH
T12D542858FA4B54F1FE634032869BF37F86289202D513EDF1EB8C5A99FA23932151D325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\bin\zlib1.dll
Size 90KB
SHA256 3668c6749db59a6cbc5293d0a4f904f76d6fb5048704449dd53894916f408a57
MD5 7e507af32ca219d2f832cf8d90ca805b
SHA1 4eb56c6f4184efc5a6bb5c7cab46547cfa769744
SHA512 d19c6a0a0798db42490631aa9e30da4200e0b687250daa5ec8bcfe68ae2589a523adeacb6c77544488ddc7610fa84be7477a92c2a27605537a0caec2449c87f1
SSDEEP 1536:pQrGMvscpi5FEexSwqJFQjF2P5kzfWan9USUnToIfAIO6IOq89CVxX:pahexSwqJFQjF2wUrTBf2Iq6AxX
TLSH
T112935C41F6879AF2D6BB863685DADB7F8221A2014121F9B7FB4CF74D743362265082CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

http

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\etc\init.d\http
Size 26B
SHA256 e15e060390ba4f039b8162a45445ebdf490ea901948b5bf0793380645a7a59c2
MD5 5b662a9aa9acd0e3a087b70370d1c103
SHA1 f101b7606cf8462e56552edddb708bc9f312a714
SHA512 f68547b220fb0eaf8fdff414e2f7dd2587f26fb9e2160d02134a1574f9cd9f75d91cfced2670ad9418e03e86346978613f4d18a8ad941f6206f4feeeeb972eb4
MD5 SHA1 SHA512

Submit Download

persistprofile.sh

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\etc\persistprofile.sh
Size 634B
SHA256 9abeab0dc5e784210b75405cb766de331177bf674be58155bfaccd2ad3901805
MD5 b2135defb607c28081c695cfab22c059
SHA1 1e10816e159f0fd5e779236321f2ae04b08ae145
SHA512 0b7b1447b1c6c83b29a873bb273f65ef63583884c3756c5c2a7b199c2b82c2f87b846c86b67e1345af435387629ff1e39f1df01891d38cc8405215a70bc2edd4
TLSH
T197F0F9B4E57F800470188E5774F45E74DCA97ABD2422E84840725B51C35EACF0A98E72
MD5 SHA1 SHA512 TLSH

Submit Download

media

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\media
Size 20B
SHA256 d7f3656e9078257bd9b7558ee2d01e94d3c30b81f035fa3417b745139c9eccb8
MD5 2064a8dffc77a2130d9f64018604769e
SHA1 d500ae449c156bf0fa0704597a20d9d225c0ff64
SHA512 6ddad200b271adf4363aed239f40a85371251697b7df2f32287a5f284f40cf25dc9156666687ea7f6d30ba5ccc8e277472dafefd739d0c44a7ea723786396648
MD5 SHA1 SHA512

Submit Download

git-annotate.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\git\git-core\git-annotate.exe
Size 38B
SHA256 3e6ecda77250329d1530349fafe7d98e8e8cfbb3f68020fb8be1b730778d03c8
MD5 a6082d6929e075a79e99516a7b60b20d
SHA1 d30cbc8a989ae5365bb2a376645e040eb3fd5b20
SHA512 aee5a79fb5d030993f797ce5e2165063f75982e14bd847fd18e15264a9ca6564efc0739c84ac3097eb7b526b20e86003a8f215cc432ad7a93c8f9edf048212fa
MD5 SHA1 SHA512

Submit Download

git-remote-https.exe

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\git\git-core\git-remote-https.exe
Size 52B
SHA256 d4001c2bc7f4331951e811070fe359655e8b65a220c829e4779a38299a143936
MD5 5a6108b0e16d6511d69fcd185ba954e5
SHA1 e01708e9775361f8a6687af4cb99e7f4f9733e29
SHA512 930193633d7b0f67cd9d57e19b46ce67b8b34caaca3b6d861fa3f2373c5dce82e17d494db6bd885910f7f100ed7795648f8e3231d3ebbe4652beea9930f57efc
TLSH
T14990044135F733317344C0D041F14D34C114F150D101CF4DC0150DCC01170040104F1D
MD5 SHA1 SHA512 TLSH

Submit Download

Compose

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\locale\C\Compose
Size 1B
SHA256 334359b90efed75da5f0ada1d5e6b256f4a6bd0aee7eb39c0f90182a021ffc8b
MD5 01abfc750a0c942167651c40d088531d
SHA1 d08f88df745fa7950b104e4a707a31cfce7b5841
SHA512 d369286ac86b60fa920f6464d26becacd9f4c8bd885b783407cdcaa74fafd45a8b56b364b63f6256c3ceef26278a1c7799d4243a8149b5ede5ce1d890b5c7236
MD5 SHA1 SHA512

Submit Download

XI18N_OBJS

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\locale\iso8859-5\XI18N_OBJS
Size 248B
SHA256 a8a0e42aaf0bc6365ec936da183f3ab58784166f0155f8135265f926fe29a60d
MD5 df430ba0495815fc0641fa836b4d500d
SHA1 c77edc36f505f284455177a0abf04c7db4d9fccf
SHA512 c9cbbd6fba0e1195b36b84ecc509b6b84cfbdc288467f08ec4aec2dcf20ba3aa8e8ed40b743e77169823c6f224e1a2d3b2bc6c1aeb99b580a66cfb75df375598
TLSH
T171D02BC0D0E29CA4035AA9394230993617A28201090C22229B55AFD541D698046BE537
MD5 SHA1 SHA512 TLSH

Submit Download

base

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\xkb\rules\base
Size 42KB
SHA256 d24951d2565837f78cb6bb08c4a218251f3215bb63a4b318bdb67db68989ce60
MD5 b55a67e89b0829a0cc7a42ddfde79e74
SHA1 13839b46fc91583e1bf62b63fee4eb8dce52793b
SHA512 f549f2e294b9f0ae8af8093fece05ae69b5933281e3ec8190f9710ec9300c78fe33cd8559c25d0920ab27664fc2b939466081166614ba28f682306042198d8eb
SSDEEP 384:7vZhEtw5p0BRXhrIjyHwi/OK8IowYbAnO5xzgZ30EvAwOpfm5ZwKjiIt5bMGrRRt:7N5erd2TKDoynowbfHf8azVX0jo
TLSH
T1781330B81B7EEDAAE38231860A55B743FC71872244CC6773385D4199E3EB8D6417EB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mokeypad

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\xkb\symbols\mokeypad
Size 21KB
SHA256 8816e6d43807235d9ba4ceec419f696886719bf8785737a5286a6cb3a7629b0c
MD5 f3b27b5b196cc21e3c4ffc16940963ff
SHA1 41191245b1244c3d16b045e99dd0751d5bdc6543
SHA512 19734f13931372e4b6618b3c3c7104217235f22beee1b06b1db8c87b51d95201954339c229f0177f1e8b6d7318afe02b8cc78e5217145d309659634fbf1a643a
SSDEEP 192:nPLOfI+KgPXs98zprgevZOPqvxr1LzzH5Bwc+/xK6ET3QS+KvpFDs/7cNAysbNaE:qXzP3we6IZE7QFn1jCD/fO0q6R
TLSH
T197A2E03F899DAA197799E19F470B0986EE567073F26810423C9D3700FFDD83A14922BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mopc

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\X11\xkb\symbols\mopc
Size 3KB
SHA256 bd6ff9bcc42e7052dc9d88fb403622f90efbf7a0f4e0e7e51683265ead6222ba
MD5 1a329359571bb5e738e92797bc0e29c6
SHA1 64e161a00a98f115f688994b6d520ab2f0f713f5
SHA512 720ee1fec58ce681fdee78279dfab0638efbbbde84f30b2ab9835d1421622deaff75d9dfa72fa8ca8091ff9a96811d7542f4d24246a6f8393a9d228957412b4f
TLSH
T159718F07C16EDD490A4ED13303C998423C7345A72646E8553FED7E99AF6E45701D17EC
MD5 SHA1 SHA512 TLSH

Submit Download

7x13-ISO8859-1.pcf

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\fonts\misc\7x13-ISO8859-1.pcf
Size 19KB
SHA256 f0134c93e873bfe20a53fa13352eaabb51b7b1e351aca58c77400daa10fd425a
MD5 9108846c31349ce5a6fd54a82cf8c7aa
SHA1 c264c2a7e2bd0bc1c42a386a3eabf64f85884376
SHA512 4cdcbed343ff14b564f39e4201ff116efd565c8b64b8984bbd60326abd158bd127c0970445ba28c59b4788633485b81da636ff1ab24be29685d8534d2b48eafe
SSDEEP 96:2zL3l5J0A1SZPbqGQWc3AzAHBA3FHlSoVgjWqEHR3bZ3Ea8OoIOll07eE:2zj3J0A1SZPboUXxzqYZTAGP
TLSH
T1649273367B0706B5C079A670E78BCF1278F66FDBB2EA11719F61594C8A225201E7CDE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cursor.pcf

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\fonts\misc\cursor.pcf
Size 16KB
SHA256 0e5d4ed2c84a7c8692c958b171969df00fb6a7ed7a593d0bde74d3cfee9ef99f
MD5 e9269414d89bb6d6b1e03c312385c98a
SHA1 1269b09c05490b375ba311ecb1e021599c06795e
SHA512 75d224375e83ceab974bf19ee67e66f8a59386070cd410a7ccc910d3a5b7e8850700715cdde24f163fa52494e9160297356ad5268ac4711aa95392915aaf0aa3
SSDEEP 192:63tfGS9lb0NVFrHsBs/RcarlrrXXrrbX18oXrrzrrrrrrbLrzrrrqrSrrQtrzVtS:qtTbb0NVuG/2WCzZX+GGT
TLSH
T10F7208007BC57F47C81259B6E6A7E7F09264DDE47A024F0724949A0F6E59BA36F830EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fonts.alias

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\fonts\misc\fonts.alias
Size 9KB
SHA256 14b5ca2d5d2b1f59d97ae55b11f978f52c1b33fd6931469a8c99567043cb29b1
MD5 9b2cb92d9ad6e6bf5e887b17d3907bcc
SHA1 d3de3fb3f1a07e154a915ebaada7a3f15c4dee34
SHA512 38d95f94ed6476cc64c0cc577cec6416f0b7ed6370d7dfffa1b51b64a5292f1b2d966567bb5885bce680009de8cb2d25bbab6382edaf6e04e486a38cbb804ff1
SSDEEP 192:pvyX27zvmqNvP8SBZSbWYYsLK57Lv5vPhAvMvyLv:pZ/fNn8OZSbJA3BSke
TLSH
T1181203056DC36B03A681445F76BC8321DC211C87C266D6EAFD8E7E814311CB67AD7BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fonts.dir

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\fonts\misc\fonts.dir
Size 186KB
SHA256 3d4f66cbd345b7d4962e673b2206fe7973b7cd040726cf46d34979476ce4281c
MD5 71692df801f318749a942804d3f85a69
SHA1 a3f1f32dad3d17302e2fb91c8b1f01441ac75d14
SHA512 c2e2bded61f52084b466f28f6f919c09855e75417f0ad0275af6904097e4d5801968446728dc5414f0d2e760b0c59b76ed7e2b990543af67ef007503c00f1415
SSDEEP 384:/dep3FOUovwiOsksaUmC2GbWWYHsmhw2giO6y3qi0DntR3E7uRaaDk+d9bUv0Uix:0dovxCPbUv0ryQGbSGUa6
TLSH
T18C14700F9CC5B123E65546BB7F7883009D26184BD136F6969D017EE28216CE3BA87FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locale.alias

Path C:\Users\Admin\AppData\Roaming\MobaXterm\slash\mx86_64b\usr\share\locale\locale.alias
Size 1KB
SHA256 dc4436b6bea7b682eef1934f4dad32cbe80babaa04ab002bde9993a5cf833e29
MD5 21395e15b61aacfae532200530f68716
SHA1 915cce96a7b77f6a3ce527f38bd661d7fceaa85f
SHA512 b595e6d5744cc28cab8ed4fc4dfe619a807a446a2aa14955f37312ebf89996455ebeac9e22bb53c54922d03140079e7e72bea156d94c6d0d568750e311a75000
TLSH
T1F421878E460D3318DF578FA43C9781304381ACECE49BA4163D8D912C57B6D0AEACB6B3
MD5 SHA1 SHA512 TLSH

Submit Download

MSIE6E1.tmp

Path C:\Windows\Installer\MSIE6E1.tmp
Size 148KB
SHA256 fa9b83479f1b955790325dc557624185a8c72df3e31870dae075437146858185
MD5 14c01c848d8452005734858a64b6784b
SHA1 d3d81fcd1267095880218ef09b92220248905ea8
SHA512 8334c467c470c13b0245425d3bc1ba9676a04e1e015bec56122504d622e7e3858d5ad7950d09c155f3666a90b7d3c7b40f324d0786553d6e81711b7f38cf1d57
SSDEEP 1536:LJBXpE+chXzGFcvDKeQlWe+LTwhT06Ua/782ix4UjAr628r4TbmMOI5IJhb6+I1v:1FpEPXElP22c4GusR6ZKX1PJEQ7+kQ+
TLSH
T1CDE38F327085D175F2A218B7E96AC2719D3DF1280B2085CD5B828D9FAD28496BFF7703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58e4be.msi

Path C:\Windows\Installer\e58e4be.msi
Size 12.9MB
SHA256 e0a7f645cc2a6b8f50013c69d2d69fd59ede914e223236c0dd1ed16dd21cd234
MD5 97516e0260fd75501c211672f606094c
SHA1 99e8dae6e9c48ac61a7111698e28e3659b3c97a9
SHA512 e70adcc9da4d3c0f1c2fd66aac874643949d7dfb43025ac189d4e60e3763e0ec9c704b25b915ca4489c2227d5b771e2379c76f27634c9ba1ab193e89ad1d9d02
SSDEEP 393216:vvh4B9MVflpqYB6e+JeSShzI6BVXKraiqM:B4zMVqkhz1RbiqM
TLSH
T133D6DE839C8B4CBDC103613BC511B75401195DE89FAC0B9ED6AA770BE9A18C6F6FB171
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MobaDiff.ico

Path C:\Windows\Installer\{BA8C1399-3CCA-4620-8314-4AA4B5E005D0}\MobaDiff.ico
Size 278KB
SHA256 67e60eac1f190afec0ee38e97b77357ff7e6279dd64eb8bbb75f256bbfca7985
MD5 98d577a5aa595259f1f058e79e9208fb
SHA1 3fe671a61aa6256bd94e18797f1af0f4b24ac69d
SHA512 7583b2dbb338ffb5a1b548c74a5b957f9551ea1d2227c3ce67f240702b6066af4698fb0ae2e83fe527e15cbeee588c92c9c6e7701fd48ba517b5cb73b959c026
SSDEEP 768:eKVSDM3sDYYtMlEdcVUNsFk9810tMlEdcVUNsFk9810tBWgTiR:eKVMWgg
TLSH
T1B054A18BECA7A09DC357613B1A318B48052A3AC09F555B6E22DC375BC2FB8C3E617531
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 6e0eaeab339c3c0ee0f41b835b80cdc16e827d989f4fc45c35c3a4d9a5942f81
MD5 5def93349354e737a14bed417e755fa0
SHA1 98ac45c9550c9df1e728dd65b9699282e0fcd88f
SHA512 c529b9ce1c31f9bb15ded8df91427bf68edfe055f5918fc7c8fb033310502f1125335eb7e0348d54fe2d081059596359ebca6902715d9936210b1b366da01f86
SSDEEP 24576:N2gmSp1jdoO/vvTLSm5eRUXKfK5SgotjWW6dXpkpQy6o0198Yy4+7Ej+x:f
TLSH
T18C47C52836F92110E7F7DE3CB8F06A23493A7D579C1A9E8D05811F4D0961BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3bf189c6-1b3f-4c54-b975-b57e0cf4be96}_OnDiskSnapshotProp

Path \??\Volume{3172925f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3bf189c6-1b3f-4c54-b975-b57e0cf4be96}_OnDiskSnapshotProp
Size 6KB
SHA256 9e6d4e08f2bf48319db9b8649f44479cf1d055c76752dda689488c174af21cf7
MD5 42bbd9f74c63961aa3b4695f18b60f5a
SHA1 2349099f9c51b8d2426f322c15d23b84a32a8228
SHA512 559190d45ed8b402210dfdf996e62b634c8e86a1497a62af968d84c0652e3133e250f1c599d08a47dfb8240733d991d2418b8efb904616d61999a4c967086fce
SSDEEP 96:FohfAxvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:me7b++ZVmN
TLSH
T11AD177085AF54711E2B3AB3128F18557A477B911EF33CB8E0198238E6670A10F975F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-81-0x0000000002450000-0x0000000002A52000-memory.dmp

Download

memory/1408-73-0x0000000001B20000-0x0000000002122000-memory.dmp

Download

memory/1408-72-0x0000000000400000-0x0000000001466000-memory.dmp

Download

memory/3952-17-0x00000223B5D80000-0x00000223B5E2E000-memory.dmp

Download

memory/3988-16-0x0000000003330000-0x0000000003932000-memory.dmp

Download

memory/3988-85-0x0000000003330000-0x0000000003932000-memory.dmp

Download

memory/4276-82-0x0000000003350000-0x0000000003952000-memory.dmp

Download

memory/4432-1908-0x00000000019D0000-0x0000000001FD2000-memory.dmp

Download

memory/4432-1887-0x0000000000400000-0x0000000001466000-memory.dmp

Download

memory/4432-2728-0x0000000000400000-0x0000000001466000-memory.dmp

Download

memory/4432-2729-0x00000000019D0000-0x0000000001FD2000-memory.dmp

Download

memory/5436-2740-0x000000006DBE0000-0x000000006DBED000-memory.dmp

Download

memory/5436-2735-0x000000006C370000-0x000000006C4B3000-memory.dmp

Download

memory/5436-2730-0x0000000000400000-0x0000000000788000-memory.dmp

Download

memory/5436-2731-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/5436-2733-0x000000006DBF0000-0x000000006DBFE000-memory.dmp

Download

memory/5436-2744-0x000000006DEA0000-0x000000006DEDB000-memory.dmp

Download

memory/5436-2732-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Download

memory/5436-2734-0x000000006DBD0000-0x000000006DBDE000-memory.dmp

Download

memory/5436-2739-0x000000006DAB0000-0x000000006DACE000-memory.dmp

Download

memory/5436-2741-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/5436-2743-0x000000006D4F0000-0x000000006DAA8000-memory.dmp

Download

memory/5436-2742-0x0000000001240000-0x0000000001842000-memory.dmp

Download

memory/5436-2736-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/5436-2738-0x000000006DC20000-0x000000006DC48000-memory.dmp

Download

memory/5436-2737-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/5624-2726-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Download

memory/5624-2720-0x000000006C370000-0x000000006C4B3000-memory.dmp

Download

memory/5624-2725-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Download

memory/5624-2724-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Download

memory/5624-2723-0x000000006DC20000-0x000000006DC48000-memory.dmp

Download

memory/5624-2722-0x000000006E010000-0x000000006E02C000-memory.dmp

Download

memory/5624-2721-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Download

memory/5624-2719-0x0000000000400000-0x0000000000450000-memory.dmp

Download