URL:

https://hola.org

Full analysis: https://app.any.run/tasks/e0c07a72-0bb5-41c3-a8c9-f9b22ef37425
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 03, 2025, 22:21:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
loader
Indicators:
MD5:

175AFEE5D480278EB57F95329E50BC9B

SHA1:

138B4A2E91D206813CA537823C19009F3C1502C7

SHA256:

61EE1EFE67D650974E654BA68D23D1B34DCF09258E2830D0E3852FB443315C67

SSDEEP:

3:N82JpS:22fS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Hola-Setup-x64-1.233.367.exe (PID: 6912)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6596)

    • Application launched itself

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • hola_svc.exe (PID: 2216)
      • hola_cr.exe (PID: 7572)
      • Hola-Setup-C-HPE.exe (PID: 4952)

    • Creates a software uninstall entry

      • Hola-Setup-x64-1.233.367.exe (PID: 6912)

    • Executable content was dropped or overwritten

      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6016)
      • 7zr.exe (PID: 6596)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)

    • Drops 7-zip archiver for unpacking

      • Hola-Setup-x64-1.233.367.exe (PID: 6912)

    • Drops a system driver (possible attempt to evade defenses)

      • Hola-Setup-x64-1.233.367.exe (PID: 6912)

    • Checks Windows Trust Settings

      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)

    • The process drops C-runtime libraries

      • net_updater64.exe (PID: 7048)

    • Process drops legitimate windows executable

      • net_updater64.exe (PID: 7048)

    • Executes as Windows Service

      • net_updater64.exe (PID: 6736)
      • hola_svc.exe (PID: 2216)
      • WmiApSrv.exe (PID: 6664)

    • Detected use of alternative data streams (AltDS)

      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6016)

    • Creates file in the systems drive root

      • hola_svc.exe (PID: 2216)

    • Connects to unusual port

      • hola_svc.exe (PID: 2216)

    • Checks for external IP

      • net_updater64.exe (PID: 6736)

    • The process checks if it is being run in the virtual environment

      • net_updater64.exe (PID: 6736)

    • Process requests binary or script from the Internet

      • hola.exe (PID: 7860)

  • INFO

    • Checks supported languages

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-C-HPE.exe (PID: 3540)
      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • test_wpf.exe (PID: 6708)
      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)
      • test_wpf.exe (PID: 2796)
      • hola_svc.exe (PID: 2216)
      • test_wpf.exe (PID: 6784)
      • net_updater64.exe (PID: 6016)
      • test_wpf.exe (PID: 6964)
      • idle_report.exe (PID: 5640)
      • 7zr.exe (PID: 6596)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)
      • hola_cr.exe (PID: 7572)
      • Hola-Setup-x64-1.233.367.exe (PID: 7304)
      • hola.exe (PID: 7860)
      • hola_cr.exe (PID: 7772)
      • hola_cr.exe (PID: 3988)
      • hola_cr.exe (PID: 7828)
      • hola_cr.exe (PID: 1868)
      • hola_cr.exe (PID: 7948)
      • hola_cr.exe (PID: 7200)
      • hola_cr.exe (PID: 7088)
      • hola_cr.exe (PID: 7764)
      • hola_cr.exe (PID: 7688)
      • hola_cr.exe (PID: 4668)
      • hola_cr.exe (PID: 7520)

    • Disables trace logs

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-C-HPE.exe (PID: 3540)
      • net_updater64.exe (PID: 6736)
      • hola_svc.exe (PID: 2216)
      • rasdial.exe (PID: 776)
      • rasdial.exe (PID: 6212)

    • Reads the computer name

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • net_updater64.exe (PID: 7048)
      • test_wpf.exe (PID: 6708)
      • test_wpf.exe (PID: 2796)
      • test_wpf.exe (PID: 6784)
      • hola_svc.exe (PID: 2216)
      • net_updater64.exe (PID: 6596)
      • idle_report.exe (PID: 5640)
      • 7zr.exe (PID: 6596)
      • Hola-Setup-x64-1.233.367.exe (PID: 7304)
      • hola_cr.exe (PID: 4668)
      • hola_cr.exe (PID: 3988)
      • hola_cr.exe (PID: 7828)

    • Application launched itself

      • chrome.exe (PID: 6348)
      • msedge.exe (PID: 4500)
      • msedge.exe (PID: 4128)

    • Create files in a temporary directory

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)
      • Hola-Setup-x64-1.233.367.exe (PID: 7304)
      • hola_cr.exe (PID: 7572)

    • Reads the machine GUID from the registry

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 3540)
      • net_updater64.exe (PID: 7048)
      • test_wpf.exe (PID: 6708)
      • net_updater64.exe (PID: 6736)
      • test_wpf.exe (PID: 2796)
      • net_updater64.exe (PID: 6596)
      • test_wpf.exe (PID: 6784)
      • hola_svc.exe (PID: 2216)
      • test_wpf.exe (PID: 6964)
      • net_updater64.exe (PID: 6016)
      • idle_report.exe (PID: 5640)
      • Hola-Setup-C-HPE.exe (PID: 4952)

    • Checks proxy server information

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-C-HPE.exe (PID: 3540)
      • net_updater64.exe (PID: 7048)
      • hola_cr.exe (PID: 7572)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 6348)

    • Process checks computer location settings

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6016)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • hola_cr.exe (PID: 7572)
      • hola_cr.exe (PID: 7088)
      • hola_cr.exe (PID: 7200)
      • hola_cr.exe (PID: 7764)
      • hola_cr.exe (PID: 7520)

    • Reads the software policy settings

      • Hola-Setup-C-HPE.exe (PID: 3220)
      • Hola-Setup-C-HPE.exe (PID: 4952)
      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6016)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)
      • hola.exe (PID: 7860)

    • The sample compiled with english language support

      • Hola-Setup-C-HPE.exe (PID: 4952)
      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • net_updater64.exe (PID: 7048)
      • 7zr.exe (PID: 6596)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)

    • Creates files in the program directory

      • Hola-Setup-x64-1.233.367.exe (PID: 6912)
      • net_updater64.exe (PID: 7048)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6016)
      • hola_svc.exe (PID: 2216)
      • 7zr.exe (PID: 6596)
      • Hola-Setup-x64-1.233.367.exe (PID: 6496)
      • Hola-Setup-x64-1.233.367.exe (PID: 7304)
      • hola.exe (PID: 7860)

    • Creates files or folders in the user directory

      • net_updater64.exe (PID: 7048)
      • hola_cr.exe (PID: 7572)
      • hola_cr.exe (PID: 3988)

    • Reads Environment values

      • net_updater64.exe (PID: 6736)
      • net_updater64.exe (PID: 6596)
      • net_updater64.exe (PID: 6016)

    • Manual execution by a user

      • msedge.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
249
Monitored processes
116
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs hola-setup-c-hpe.exe hola-setup-c-hpe.exe hola-setup-c-hpe.exe hola-setup-x64-1.233.367.exe net_updater64.exe conhost.exe no specs test_wpf.exe no specs net_updater64.exe test_wpf.exe no specs net_updater64.exe conhost.exe no specs test_wpf.exe no specs hola_svc.exe idle_report.exe no specs conhost.exe no specs net_updater64.exe conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs test_wpf.exe no specs wmiapsrv.exe no specs hola-setup-x64-1.233.367.exe 7zr.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs hola-setup-x64-1.233.367.exe msedge.exe no specs explorer.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs explorer.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs hola.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs hola_cr.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=2460,i,12446608795754449934,2330757430073525811,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
776rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1732"C:\Program Files\Hola\app\hola_svc.exe" --report-idleC:\Program Files\Hola\app\hola_svc.exe—hola_svc.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
MEDIUM
Description:
Hola VPN Service
Exit code:
0
Version:
1.233.367
1868"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --no-subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --metrics-shmem-handle=3232,i,14434638478911079251,11783097755535968181,262144 --field-trial-handle=3064,i,15651948214768605672,4215910692537296598,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2C:\Program Files\Hola\app\chromium\hola_cr.exe—hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola
Version:
128.0.6613.86
2084"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2740 --field-trial-handle=2460,i,12446608795754449934,2330757430073525811,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—idle_report.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2216"C:\Program Files\Hola\app\hola_svc.exe" --serviceC:\Program Files\Hola\app\hola_svc.exe
services.exe
User:
SYSTEM
Company:
Hola Networks Ltd.
Integrity Level:
SYSTEM
Description:
Hola VPN Service
Version:
1.233.367
Modules
Images
c:\program files\hola\app\hola_svc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2572"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4120 --field-trial-handle=2460,i,12446608795754449934,2330757430073525811,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2796C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe—net_updater64.exe
User:
SYSTEM
Company:
BrightData Ltd. (certified)
Integrity Level:
SYSTEM
Description:
test_wpf
Exit code:
0
Version:
1.489.750
Modules
Images
c:\programdata\brightdata\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
3052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2468 --field-trial-handle=2300,i,4446554652936851293,17274566816516052359,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
Total events
44 568
Read events
44 383
Write events
181
Delete events
4

Modification events

(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6348) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3808) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
010000000000000056EE650B8A76DB01
(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57
Value:
(PID) Process:(6348) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
1
(PID) Process:(3220) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3220) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
69
Suspicious files
460
Text files
92
Unknown types
9

Dropped files

PID
Process
Filename
Type
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF1374c6.TMP —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF1374c6.TMP —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF1374d5.TMP —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF1374d5.TMP —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF1374d5.TMP —
MD5:—
SHA256:—
6348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
282
DNS requests
247
Threats
35

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6348
chrome.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAXrhBDPOQ2gaSPA09Ycq3A%3D
unknown
—
—
whitelisted
6348
chrome.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1544
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7048
net_updater64.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
7048
net_updater64.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D
unknown
—
—
whitelisted
6736
net_updater64.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1144
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6636
chrome.exe
107.22.193.119:443
hola.org
AMAZON-AES
US
whitelisted
6348
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
6636
chrome.exe
108.177.127.84:443
accounts.google.com
GOOGLE
US
whitelisted
6636
chrome.exe
142.250.185.131:443
fonts.gstatic.com
GOOGLE
US
whitelisted
6636
chrome.exe
169.150.247.37:443
cdn4.hola.org
—
GB
whitelisted
6636
chrome.exe
142.250.181.232:443
www.googletagmanager.com
GOOGLE
US
whitelisted
6636
chrome.exe
142.250.181.238:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
hola.org
  • 107.22.193.119
  • 54.225.121.9
whitelisted
accounts.google.com
  • 108.177.127.84
whitelisted
cdn4.hola.org
  • 169.150.247.37
whitelisted
fonts.gstatic.com
  • 142.250.185.131
  • 142.250.185.195
whitelisted
www.googletagmanager.com
  • 142.250.181.232
whitelisted
www.google-analytics.com
  • 142.250.181.238
whitelisted
dev.visualwebsiteoptimizer.com
  • 34.107.218.251
whitelisted
connect.facebook.net
  • 157.240.0.6
  • 157.240.252.13
whitelisted
www.facebook.com
  • 157.240.252.35
  • 157.240.0.35
whitelisted
www.clarity.ms
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
6736
net_updater64.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://hola.org