Overview

overview

9

Static

static

3

Huroof.exe

windows10-2004-x64

9

Huroof.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 23:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Huroof.exe
  • Size 66.9MB
  • Sample260808-29p9bsem9y
  • SHA256 3d804ff4a0801907f2228ac4ca726c30d548209d01fb167bb0717cbd2daa38b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
cryptonedefense_evasiondiscoveryexecutionpacker

Malware Config

Signatures

  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Huroof.exe
    "C:\Users\Admin\AppData\Local\Temp\Huroof.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Users\Admin\AppData\Local\Temp\Huroof.exe
      "C:\Users\Admin\AppData\Local\Temp\Huroof.exe" /i "C:\Users\Admin\AppData\Roaming\mualim\install\D428654\معلم الحروف.msi" CHAINERUIPROCESSID="3272Chainer" EXECUTEACTION="INSTALL" SECONDSEQUENCE="1" CLIENTPROCESSID="3272" ADDLOCAL="MainFeature" ACTION="INSTALL" CLIENTUILEVEL="0" ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs " AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Huroof.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" TARGETDIR="F:\" APPDIR="C:\Program Files (x86)\Mualim Al Huroof\"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      PID:4412
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEE655.tmp.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\mualim\install\D428654\449F~1.MSI"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4160
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXEE655.tmp.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:4532
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEE655.tmp.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1148
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" cls"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1996
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEE721.tmp.bat" "
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5752
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\mualim\install\D428654\449F~1.MSI"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:1868
      • C:\Windows\SysWOW64\attrib.exe
        ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXEE721.tmp.bat"
        3⤵
        • System Location Discovery: System Language Discovery
        • Views/modifies file attributes
        PID:3716
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEE721.tmp.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3668
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" cls"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4368
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A4C083F03C229689C95CC056D65975D6 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4240
      • C:\Program Files (x86)\Mualim Al Huroof\MualimAlHuroof.exe
        "C:\Program Files (x86)\Mualim Al Huroof\MualimAlHuroof.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious use of SetWindowsHookEx
        PID:1552
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding A5A9D9B74B71DFADC0EB1C2AC487D191
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5864
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004CC
    1⤵
      PID:4168

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5995de.rbs
          • Path C:\Config.Msi\e5995de.rbs
          • Size 41KB
          • SHA256 fb4d326eac5017f9afe7a0ae0292083082bc705c4854d2534db3c5b720d8cbf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MualimAlHuroof.exe
          • Path C:\Program Files (x86)\Mualim Al Huroof\MualimAlHuroof.exe
          • Size 142KB
          • SHA256 2ec7895c70c3616a44ba7d02bcfb151babd8f5204e32c1f4fecf79cddf5dd294
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mualim Al Huroof.lnk
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mualim Al Huroof\Mualim Al Huroof.lnk
          • Size 2KB
          • SHA256 4a77c7a2d53d7574cada0fa8370a750344860d3418acb9a159e4d57450a5b261
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mualim Al Huroof.lnk~RFe59c4fc.TMP
          • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mualim Al Huroof\Mualim Al Huroof.lnk~RFe59c4fc.TMP
          • Size 2KB
          • SHA256 423d4c36ce75aa3b7b26c5caface2f32638732d3997bec86167349205c33f0ed
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          backgroundAR.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3272\backgroundAR.jpg
          • Size 470KB
          • SHA256 e00b68df5b2cf4a5281b8ce71efd23d550182c4f69494bd15c9038dd5284861d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backgroundEN.jpg
          • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_3272\backgroundEN.jpg
          • Size 473KB
          • SHA256 5fed0038ae260e0e234945d855553301c9a021826d8c69f84db7ef13ef08648a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          EXEE655.tmp.bat
          • Path C:\Users\Admin\AppData\Local\Temp\EXEE655.tmp.bat
          • Size 394B
          • SHA256 cf52443271854ed89437dabe51aa4642fa9d6c19cdc6a2bd2eb644bae080d1f6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          EXEE721.tmp.bat
          • Path C:\Users\Admin\AppData\Local\Temp\EXEE721.tmp.bat
          • Size 394B
          • SHA256 0c6078864f2e02cf25c479d7d936149c5dd4bc637dfa62240ce620a17bf411d9
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI7DB2.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI7DB2.tmp
          • Size 91KB
          • SHA256 02a81aea451cdfa2cd6668e3b814c4e50c6025e36b70ab972a8cc68aba5b3222
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe AIR.dll
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Adobe AIR.dll
          • Size 20.2MB
          • SHA256 67c67a0848d48ac2fbbf6e0a38db0a6e0bb7d0c60c692e93b9bb14c50c5314d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Adobe AIR.vch
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\Adobe AIR.vch
          • Size 439KB
          • SHA256 ecc30c569f12e3b27da06a5ef7a49662375f3534c8a4e46243e0347a62199b28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeCP15.dll
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\AdobeCP15.dll
          • Size 3.3MB
          • SHA256 e8fcbfbadfed3445a48965177e78d8427ee27e4be4f24bfe72c4a226b28b6551
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          CaptiveAppEntry.exe
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\CaptiveAppEntry.exe
          • Size 67KB
          • SHA256 9420da96063d5d33cb08f855d53123c04ca545f27b93480b557af6392fdda3a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NPSWF32.dll
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\NPSWF32.dll
          • Size 16.8MB
          • SHA256 40f23ba2b9adb7eb5cc8b8178d42ebb05be34ce073c1076b36c59166e9a61810
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WebKit.dll
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\WebKit.dll
          • Size 4.7MB
          • SHA256 a59a28fdd9fe2a65913782e7c67f49c9ff67951621174869ed33c8c24bcc470a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LGPL License.txt
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\WebKit\LGPL License.txt
          • Size 24KB
          • SHA256 98b84a0ef7b265dfd8c4796bc03eff27ebce5491026798c14508d80049434feb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Notice WebKit.txt
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\Adobe AIR\Versions\1.0\Resources\WebKit\Notice WebKit.txt
          • Size 771B
          • SHA256 935c1d9f4ebd571481dea85160e81c04af15b56adb0dc7664696475389990471
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          000000.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000000.dat
          • Size 63KB
          • SHA256 3626d6db04bad6ad65e955eb6625b8922f0f6dadb5cdf1b7d9066223326becf6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000001.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000001.dat
          • Size 26KB
          • SHA256 4fa2b8984fc6aa514ad17be99cdac18c3147678e60deec6f9b9d9b27cdec1c3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000002.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000002.dat
          • Size 35KB
          • SHA256 24a39abfcdbb7955895e69f428e1a5b56210f39c3bcde15eb4368bb2ad5a1b66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000003.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000003.dat
          • Size 57KB
          • SHA256 32510d1c50c6d7c6e72248a5858ec2739410a7d134aa2bfa2a1256dd652e2786
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000004.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000004.dat
          • Size 24KB
          • SHA256 958d26a7c22717577130c9ded66d795a0a91c5932e035693e72890c4e2f99ab6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000005.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000005.dat
          • Size 56KB
          • SHA256 6e61aacb1f4f5dcad10b2ac6dc2dc66714c218e410724736b733ece006b7c055
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000006.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000006.dat
          • Size 54KB
          • SHA256 98ed6f35808d891059f2b4f9f2cd1eb0d21a355b2f3018b549052f49b0fd5ad1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000007.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000007.dat
          • Size 64KB
          • SHA256 32a014ad329ac3f4aa62bf8d07d84a2dc870a8ba99392f025065e41bb96a8c21
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000008.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000008.dat
          • Size 24KB
          • SHA256 cea38cb94aed0c0b7ab5429cb057091191c57fc8b9219dc5f5087e4b79cdabf1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000009.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000009.dat
          • Size 46KB
          • SHA256 8dd1a469737fde1ea4184cfed15080c508573e0d1a99a8a1e2a7c361026a4e12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000010.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000010.dat
          • Size 18KB
          • SHA256 1d0c1e7fdb8e52ff788b733fca0228d95a7d8107f4280224b5377d6c3ba6061f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000011.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000011.dat
          • Size 43KB
          • SHA256 f681859de2c521c1d1103d39a99b43795b2305b6b4a6b2a6ecb6a7b219fcf980
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000012.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000012.dat
          • Size 24KB
          • SHA256 2381d3a163917b72d30f12edda82363a61ed507f75db11f761750c712377515f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000013.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000013.dat
          • Size 25KB
          • SHA256 abc589e2fb3a1b9ba78c56e1720e5071a4a8beae804a71e3b4003eb1bef84e5f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000014.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000014.dat
          • Size 29KB
          • SHA256 cfd47a7fbcd1bf672369bdde6bc904884e43ca45a32af461791f8d90f8ccb62e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000015.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000015.dat
          • Size 34KB
          • SHA256 cc85fc10ec91bc8c08d0f7804dfdb7adfc66dbbb87196d815498389c65aa3700
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000016.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000016.dat
          • Size 16KB
          • SHA256 a211cdcd7f505fef42e6c1ff12ccb3918e18e056c21ee7653f6dd84d9ae97a24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000017.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000017.dat
          • Size 24KB
          • SHA256 9ad428c3cefd2f7aa9bd1f98f0b7e11bbcc89782ce6cdea6eb17109df1196739
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000018.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000018.dat
          • Size 38KB
          • SHA256 d7d6a988a6dc1b91818b2e103bb46efb826368cb185a272f54d3f41c90387133
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000019.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000019.dat
          • Size 29KB
          • SHA256 eda46d00bf4bb91af0497ecfb539e1ee19cc35671e2c917e77509fd5cf258e63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000020.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000020.dat
          • Size 28KB
          • SHA256 8a68a11eb552a378704da1ce9ab68b1381143b288c105b8dd40746b25ab2a10f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000021.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000021.dat
          • Size 29KB
          • SHA256 fd49d32a240d34aa582b5ac85179605a3cc58d64e15cd3c9e8314660c88b8a6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000022.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000022.dat
          • Size 20KB
          • SHA256 c1b817de0c5bb80c3c4a22297c624c9907e0ea40415fa2ebacf3c75d532a77b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000023.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000023.dat
          • Size 24KB
          • SHA256 434663e0d95c119a10f89342b482448e961a7655094d003508b510eaab23b3f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000024.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000024.dat
          • Size 16KB
          • SHA256 f3c4652939d4561fb7ff1445d85ee7a42c8ff72ae43d612eedd27546435d950b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000025.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000025.dat
          • Size 11KB
          • SHA256 7903943b805ee59b342d246b3da8028de98daa671c92ff917dfcd15a5a508a6c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000030.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000030.dat
          • Size 172KB
          • SHA256 87336972d66c51e1e0b397cf763062512ced7c9d7ef304cd09e34ff9b2a6a6df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000031.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000031.dat
          • Size 1.8MB
          • SHA256 90a52f394c8d41300bcca1b66c6a502f5172214bbde79b9b027928bcabf00515
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000032.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000032.dat
          • Size 2KB
          • SHA256 19a4dd0b189ca32abee1cc4bd812e1f8f7178fcc9316ff0af13575b043542ee8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          000033.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000033.dat
          • Size 8KB
          • SHA256 eeb120e75669da4bcf6fa4eb0f18cc92936dbf1a16fe1a967bf4a88ef5a58e85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000034.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000034.dat
          • Size 4KB
          • SHA256 6fc9ba059eec5077b0ca2923a6926b281f85877be30ac1769173be84cc0d1f4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000035.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000035.dat
          • Size 5KB
          • SHA256 87e110f3aa192a3d594bbbd9a1133a46aee230d0e6474beaf03fcc83775326de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000036.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000036.dat
          • Size 52KB
          • SHA256 6bf5b714233fd8580ddbad25ef86271720277503cf00fda40961ca558f314ff8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000037.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000037.dat
          • Size 37KB
          • SHA256 f91f8a3a69852952f02fba259ca72690b08161491adb04289f4c8682d3ec1aa9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          000229.dat
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\ProgramFilesFolder\Mualim Al Huroof\assets\000229.dat
          • Size 211KB
          • SHA256 45abe8f6180e4abb713e6e0e163bfe8d99618d1b905222ddb9dceaabc4da5315
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          معلم الحروف.msi
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\D428654\معلم الحروف.msi
          • Size 1.9MB
          • SHA256 8911ffec3dbba7ce7614c4b4bf360d35edbc7acfe5c58ff2cbf51ffd0ba93fec
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          decoder.dll
          • Path C:\Users\Admin\AppData\Roaming\mualim\install\decoder.dll
          • Size 127KB
          • SHA256 c8c01c93f1e65e97df976c411b9714c2d8cced6847d9854bd3bc4206e3122c3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Mualim Al Huroof.lnk
          • Path C:\Users\Public\Desktop\Mualim Al Huroof.lnk
          • Size 2KB
          • SHA256 cabcd90e719de6e0caed3877c62d735099f1e0c9dd820d228538d72560ca4c26
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Mualim Al Huroof.lnk~RFe59c52b.TMP
          • Path C:\Users\Public\Desktop\Mualim Al Huroof.lnk~RFe59c52b.TMP
          • Size 2KB
          • SHA256 51d9e5b70c6dfeb3685ab856e7dc52307e16bd931d8aee7c581700c5f1c483a3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI9880.tmp
          • Path C:\Windows\Installer\MSI9880.tmp
          • Size 297KB
          • SHA256 ec4d8b3ba63d131d6c9292576f75b45a052f69f20e314816e5d19e280f91d406
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3272-0-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
          Download

          memory/3272-122-0x0000000002DA0000-0x0000000002DA1000-memory.dmp
          Download