URL:

https://haffnetworkm2.com/4309?cam=mm&clkid=60d65930-816e-11ee-ba82-4b2f01229433&cam_id=5398_6058394&site=

Full analysis: https://app.any.run/tasks/409e99ea-d8e4-498a-b3d1-f953ac97e785
Verdict: Malicious activity
Analysis date: November 12, 2023, 15:16:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
SHA1:

14CC6AED34C1317B982A266534CCED6CD3992340

SHA256:

BE2A3B5EFC67BB55F41A4C7AE9FA25655EE311BB6747D529F8B0A79DBD276902

SSDEEP:

3:N84A5STKZIGAMuZBC/nXQWWaEHq6TVQ19:246WKmGAZ8nXQRaEhTVQD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Hola-Setup-C-Mmv42.exe (PID: 3464)
      • Hola-Setup-x64-1.217.339.exe (PID: 3920)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • net_updater64.exe (PID: 124)
      • 7zr.exe (PID: 3376)
      • Hola-Setup-x64-1.217.339.exe (PID: 4004)

    • Creates a writable file the system directory

      • net_updater64.exe (PID: 544)

    • Actions looks like stealing of personal data

      • Hola-Setup-x64-1.217.339.exe (PID: 4004)
      • hola_svc.exe (PID: 2436)
      • hola.exe (PID: 3784)
      • hola_cr.exe (PID: 648)
      • 7zr.exe (PID: 3376)
      • hola_cr.exe (PID: 2996)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 4048)
      • hola_cr.exe (PID: 124)
      • hola_cr.exe (PID: 3368)
      • hola_cr.exe (PID: 2648)
      • hola_cr.exe (PID: 3580)
      • hola_cr.exe (PID: 3720)
      • hola_cr.exe (PID: 1632)
      • hola_cr.exe (PID: 2420)
      • hola_cr.exe (PID: 1652)
      • hola_cr.exe (PID: 944)
      • hola_cr.exe (PID: 3640)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • Hola-Setup-Core.exe (PID: 3496)
      • Hola-Setup-Core.exe (PID: 3576)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • net_updater64.exe (PID: 124)

    • Adds/modifies Windows certificates

      • Hola-Setup-C-Mmv42.exe (PID: 3464)

    • Reads the Internet Settings

      • Hola-Setup-Core.exe (PID: 3496)
      • Hola-Setup-Core.exe (PID: 3576)
      • hola_cr.exe (PID: 3064)

    • Application launched itself

      • Hola-Setup-Core.exe (PID: 3496)
      • hola_svc.exe (PID: 2436)
      • hola_cr.exe (PID: 3064)

    • Reads settings of System Certificates

      • Hola-Setup-Core.exe (PID: 3576)
      • Hola-Setup-Core.exe (PID: 3496)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 3064)
      • hola_cr.exe (PID: 3064)

    • Executes as Windows Service

      • PresentationFontCache.exe (PID: 3660)
      • net_updater64.exe (PID: 544)
      • hola_svc.exe (PID: 2436)

    • Reads security settings of Internet Explorer

      • Hola-Setup-Core.exe (PID: 3576)
      • Hola-Setup-Core.exe (PID: 3496)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 3064)

    • Drops 7-zip archiver for unpacking

      • Hola-Setup-x64-1.217.339.exe (PID: 3920)

    • Drops a system driver (possible attempt to evade defenses)

      • Hola-Setup-x64-1.217.339.exe (PID: 3920)

    • The process drops C-runtime libraries

      • net_updater64.exe (PID: 3964)

    • Process drops legitimate windows executable

      • net_updater64.exe (PID: 3964)
      • 7zr.exe (PID: 3376)

    • Detected use of alternative data streams (AltDS)

      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • net_updater64.exe (PID: 124)

    • Connects to unusual port

      • hola_svc.exe (PID: 2436)

    • Process requests binary or script from the Internet

      • hola.exe (PID: 3784)

  • INFO

    • Drops the executable file immediately after the start

      • firefox.exe (PID: 2700)

    • Application launched itself

      • firefox.exe (PID: 2700)

    • Create files in a temporary directory

      • Hola-Setup-C-Mmv42.exe (PID: 3464)
      • Hola-Setup-Core.exe (PID: 3496)
      • Hola-Setup-Core.exe (PID: 3576)
      • Hola-Setup-x64-1.217.339.exe (PID: 3920)
      • Hola-Setup-x64-1.217.339.exe (PID: 4004)
      • Hola-Setup-x64-1.217.339.exe (PID: 4076)
      • hola_cr.exe (PID: 3064)

    • The process uses the downloaded file

      • firefox.exe (PID: 2700)

    • Checks supported languages

      • Hola-Setup-C-Mmv42.exe (PID: 3464)
      • Hola-Setup-Core.exe (PID: 3496)
      • Hola-Setup-Core.exe (PID: 3576)
      • PresentationFontCache.exe (PID: 3660)
      • Hola-Setup-x64-1.217.339.exe (PID: 3920)
      • net_updater64.exe (PID: 3964)
      • test_wpf.exe (PID: 4004)
      • net_updater64.exe (PID: 544)
      • test_wpf.exe (PID: 3420)
      • net_updater64.exe (PID: 3064)
      • test_wpf.exe (PID: 3440)
      • hola_svc.exe (PID: 2436)
      • idle_report.exe (PID: 3856)
      • net_updater64.exe (PID: 124)
      • hola_svc.exe (PID: 1984)
      • test_wpf.exe (PID: 2200)
      • Hola-Setup-x64-1.217.339.exe (PID: 4004)
      • 7zr.exe (PID: 3376)
      • Hola-Setup-x64-1.217.339.exe (PID: 4076)
      • hola.exe (PID: 3784)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 648)
      • hola_cr.exe (PID: 2996)
      • hola_cr.exe (PID: 124)
      • hola_cr.exe (PID: 3368)
      • hola_cr.exe (PID: 1632)
      • hola_cr.exe (PID: 2648)
      • hola_cr.exe (PID: 3580)
      • hola_cr.exe (PID: 3720)
      • hola_cr.exe (PID: 1652)
      • hola_cr.exe (PID: 944)
      • hola_cr.exe (PID: 2420)
      • hola_cr.exe (PID: 3640)
      • hola_cr.exe (PID: 4048)

    • Reads the computer name

      • Hola-Setup-Core.exe (PID: 3496)
      • Hola-Setup-Core.exe (PID: 3576)
      • PresentationFontCache.exe (PID: 3660)
      • Hola-Setup-x64-1.217.339.exe (PID: 3920)
      • net_updater64.exe (PID: 3964)
      • test_wpf.exe (PID: 4004)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • test_wpf.exe (PID: 3440)
      • hola_svc.exe (PID: 2436)
      • idle_report.exe (PID: 3856)
      • net_updater64.exe (PID: 124)
      • test_wpf.exe (PID: 2200)
      • test_wpf.exe (PID: 3420)
      • Hola-Setup-x64-1.217.339.exe (PID: 4004)
      • 7zr.exe (PID: 3376)
      • Hola-Setup-x64-1.217.339.exe (PID: 4076)
      • hola.exe (PID: 3784)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 2996)
      • hola_cr.exe (PID: 4048)
      • hola_cr.exe (PID: 3640)

    • Creates files or folders in the user directory

      • Hola-Setup-Core.exe (PID: 3496)
      • net_updater64.exe (PID: 3964)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 2996)

    • Reads the machine GUID from the registry

      • Hola-Setup-Core.exe (PID: 3576)
      • PresentationFontCache.exe (PID: 3660)
      • Hola-Setup-Core.exe (PID: 3496)
      • net_updater64.exe (PID: 3964)
      • test_wpf.exe (PID: 4004)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • test_wpf.exe (PID: 3440)
      • hola_svc.exe (PID: 2436)
      • idle_report.exe (PID: 3856)
      • net_updater64.exe (PID: 124)
      • test_wpf.exe (PID: 2200)
      • test_wpf.exe (PID: 3420)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 3640)

    • Reads Environment values

      • Hola-Setup-Core.exe (PID: 3576)
      • Hola-Setup-Core.exe (PID: 3496)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 3064)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 124)

    • Creates files in the program directory

      • Hola-Setup-x64-1.217.339.exe (PID: 3920)
      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • hola_svc.exe (PID: 2436)
      • net_updater64.exe (PID: 124)
      • 7zr.exe (PID: 3376)
      • Hola-Setup-x64-1.217.339.exe (PID: 4004)
      • Hola-Setup-x64-1.217.339.exe (PID: 4076)
      • hola.exe (PID: 3784)

    • Process checks computer location settings

      • net_updater64.exe (PID: 3964)
      • net_updater64.exe (PID: 544)
      • net_updater64.exe (PID: 3064)
      • net_updater64.exe (PID: 124)
      • hola_cr.exe (PID: 3064)
      • hola_cr.exe (PID: 1652)
      • hola_cr.exe (PID: 3720)
      • hola_cr.exe (PID: 944)
      • hola_cr.exe (PID: 2420)

    • Reads the Internet Settings

      • explorer.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
58
Malicious processes
29
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs hola-setup-c-mmv42.exe no specs hola-setup-c-mmv42.exe hola-setup-core.exe hola-setup-core.exe presentationfontcache.exe hola-setup-x64-1.217.339.exe net_updater64.exe test_wpf.exe no specs net_updater64.exe test_wpf.exe no specs net_updater64.exe no specs test_wpf.exe no specs hola_svc.exe idle_report.exe no specs net_updater64.exe no specs hola_svc.exe no specs rasdial.exe no specs test_wpf.exe no specs hola-setup-x64-1.217.339.exe 7zr.exe hola-setup-x64-1.217.339.exe explorer.exe no specs explorer.exe no specs hola.exe rasdial.exe no specs hola_cr.exe hola_cr.exe rasdial.exe no specs hola_cr.exe hola_cr.exe hola_cr.exe hola_cr.exe hola_cr.exe hola_cr.exe rasdial.exe no specs hola_cr.exe hola_cr.exe hola_cr.exe hola_cr.exe hola_cr.exe rasdial.exe no specs rasdial.exe no specs rasdial.exe no specs rasdial.exe no specs hola_cr.exe rasdial.exe no specs rasdial.exe no specs rasdial.exe no specs rasdial.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Hola\app\net_updater64.exe" --uuidC:\Program Files\Hola\app\net_updater64.exe—hola_svc.exe
User:
SYSTEM
Company:
BrightData Ltd. (certified)
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Exit code:
0
Version:
1.418.267
Modules
Images
c:\program files\hola\app\net_updater64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
124"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --mojo-platform-channel-handle=1564 --field-trial-handle=1228,i,8783256162927311156,13509082375797555229,131072 /prefetch:8C:\Program Files\Hola\app\chromium\hola_cr.exe
hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola Browser
Exit code:
0
Version:
109.0.5414.74
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
544"C:/Program Files/Hola/app/net_updater64.exe" --updater win_hola.orgC:\Program Files\Hola\app\net_updater64.exe
services.exe
User:
SYSTEM
Company:
BrightData Ltd. (certified)
Integrity Level:
SYSTEM
Description:
BrightData service allows free use of certain features in an app you installed
Exit code:
0
Version:
1.418.267
Modules
Images
c:\program files\hola\app\net_updater64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
648"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\Hola\chromium_profile /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\Hola\chromium_profile\Crashpad --annotation=plat=Win32 "--annotation=prod=Hola Browser" --annotation=ver=109.0.5414.74 --initial-client-data=0xec,0xf0,0xf4,0xc0,0xf8,0x745bd9f0,0x745bda00,0x745bda0cC:\Program Files\Hola\app\chromium\hola_cr.exe
hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
MEDIUM
Description:
Hola Browser
Exit code:
0
Version:
109.0.5414.74
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
944"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=3180 --field-trial-handle=1228,i,8783256162927311156,13509082375797555229,131072 /prefetch:1C:\Program Files\Hola\app\chromium\hola_cr.exe
hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola Browser
Exit code:
0
Version:
109.0.5414.74
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1220rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1296"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2700.1.1054295105\12232237" -parentBuildID 20230710165010 -prefsHandle 1408 -prefMapHandle 1404 -prefsLen 29857 -prefMapSize 244187 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fad5e577-7212-4de1-a941-da67fce30ed0} 2700 "\\.\pipe\gecko-crash-server-pipe.2700" 1420 f8d4b58 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1632"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=1180 --field-trial-handle=1228,i,8783256162927311156,13509082375797555229,131072 /prefetch:2C:\Program Files\Hola\app\chromium\hola_cr.exe
hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola Browser
Exit code:
0
Version:
109.0.5414.74
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1652"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3160 --field-trial-handle=1228,i,8783256162927311156,13509082375797555229,131072 /prefetch:1C:\Program Files\Hola\app\chromium\hola_cr.exe
hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola Browser
Exit code:
0
Version:
109.0.5414.74
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1824"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2700.0.1910655269\1732283839" -parentBuildID 20230710165010 -prefsHandle 1108 -prefMapHandle 1100 -prefsLen 29780 -prefMapSize 244187 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cd478aa-3ba7-4300-906e-e9e44f37af4f} 2700 "\\.\pipe\gecko-crash-server-pipe.2700" 1180 f8d3358 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
Total events
26 310
Read events
26 096
Write events
212
Delete events
2

Modification events

(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
0000000000000000
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Theme
Value:
1
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Enabled
Value:
1
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
0
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice
Value:
1
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|AppLastRunTime
Value:
F8B731ACA1C5D901
(PID) Process:(2700) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
40
Suspicious files
787
Text files
87
Unknown types
0

Dropped files

PID
Process
Filename
Type
2700firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\startupCache\urlCache-current.binbinary
MD5:4DF9B77C7650AF87B264E535779AE2A4
SHA256:C57071FCFEF26EE4F08A2029E547848EC015B10045ABAD705195A9F966FEAE58
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2700firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\cache2\entries\ED9826654AE8BD972BDE17A9E0A449D3F881E430binary
MD5:04F9403252E0601D3EF4069AA1AB29C9
SHA256:B00D0AD040AD563BD0FE1D21A6C86EA3902ACB909325EDBF2CCFA8E7CE31448F
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\prefs-1.jstext
MD5:142A266DC67A741D85023F01C355804F
SHA256:5A3840F7DB7DB387C632189A6D94A9C3A2B439BBB97AA7022C0E4A93E5644BEA
2700firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\nltxvmn2.default\cache2\entries\6D89348819C8881868053197CA0754F36784BF5Fcompressed
MD5:9ABA9185DBD7431022B8C234F9C8D72B
SHA256:5094AB566188EA79372E4B6C1FD4C04F501711188BE58E28BBBC708BFB56523D
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\cert9.dbbinary
MD5:DBF470C3320E7B393BD03C2BDF756CB4
SHA256:A07646BA0BDC9426AB51FAAF0F25C4C21FF84EA648E86C25FD5CDFF86F933381
2700firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\nltxvmn2.default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
741
DNS requests
263
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2700
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
2700
firefox.exe
POST
200
65.9.98.16:80
http://ocsp.r2m02.amazontrust.com/
unknown
binary
471 b
unknown
2700
firefox.exe
POST
200
23.53.40.154:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
2700
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
2700
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
2700
firefox.exe
POST
200
23.53.40.154:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
2700
firefox.exe
POST
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
2700
firefox.exe
POST
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3
unknown
binary
471 b
unknown
2700
firefox.exe
POST
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
2700
firefox.exe
POST
—
23.53.40.154:80
http://r3.o.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2700
firefox.exe
107.22.193.119:443
haffnetworkm2.com
AMAZON-AES
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2700
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
2700
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
2700
firefox.exe
35.168.31.31:443
spocs.getpocket.com
AMAZON-AES
US
unknown
2700
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
unknown
2700
firefox.exe
23.53.40.154:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
2700
firefox.exe
142.250.186.74:443
safebrowsing.googleapis.com
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
haffnetworkm2.com
  • 107.22.193.119
  • 54.225.121.9
unknown
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
spocs.getpocket.com
  • 35.168.31.31
  • 107.21.198.143
  • 3.213.241.209
  • 54.235.242.106
shared
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com
  • 3.213.241.209
  • 35.168.31.31
  • 107.21.198.143
  • 54.235.242.106
shared
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
prod.content-signature-chains.prod.webservices.mozgcp.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
544
net_updater64.exe
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
544
net_updater64.exe
Misc activity
ET INFO DropBox User Content Download Access over SSL M2
1 ETPRO signatures available at the full report
Process
Message
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
Hola-Setup-Core.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\copyout.cpp, line 1302
Hola-Setup-Core.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\amd64fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://haffnetworkm2.com/4309?cam=mm&clkid=60d65930-816e-11ee-ba82-4b2f01229433&cam_id=5398_6058394&site=