File name:

Hola-Setup-Agreed.exe

Full analysis: https://app.any.run/tasks/c7ba5005-c722-4a03-a8da-3c34b9fdeff4
Verdict: Malicious activity
Analysis date: May 23, 2021, 04:36:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

A87E711748C09435E7BB06564C252EAE

SHA1:

0C75651C7325E501C611C10D1F02BEC9034D386D

SHA256:

E3D193D7FB4CB60F01AFD1B881F7DED1772C7348DA2AE77411452E94867EA404

SSDEEP:

12288:es21lKazlmoSte0Avv4YYFKXu30pSNZHQ3v/yDT8on6zVeoi6XBi6rAK7l481pDH:eseKaQA9Yqu30pSNSnyf8on6RJg6MkdD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Hola-Setup-Agreed.exe (PID: 1248)

    • Changes settings of System certificates

      • Hola-Setup-Core.exe (PID: 3692)
      • net_updater32.exe (PID: 2676)
      • net_updater32.exe (PID: 1456)

    • Application was dropped or rewritten from another process

      • Hola-Setup-Core.exe (PID: 3692)
      • Hola-Setup-Core.exe (PID: 4044)
      • Hola-Setup-1.184.894.exe (PID: 2936)
      • hola_updater.exe (PID: 2752)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • hola_svc.exe (PID: 2600)
      • net_updater32.exe (PID: 2676)
      • Hola-Setup-1.184.894.exe (PID: 3204)
      • hola_svc.exe (PID: 1584)
      • 7za.exe (PID: 3176)
      • net_updater32.exe (PID: 1456)
      • hola.exe (PID: 2648)
      • test_wpf.exe (PID: 2700)
      • hola_svc.exe (PID: 3660)
      • hola_svc.exe (PID: 1768)
      • net_svc.exe (PID: 1520)
      • net_svc.exe (PID: 2756)
      • net_svc.exe (PID: 3040)

    • Changes the autorun value in the registry

      • Hola-Setup-1.184.894.exe (PID: 3388)

    • Actions looks like stealing of personal data

      • Hola-Setup-1.184.894.exe (PID: 3204)
      • net_updater32.exe (PID: 1456)
      • hola_svc.exe (PID: 2600)
      • 7za.exe (PID: 3176)

    • Loads dropped or rewritten executable

      • net_updater32.exe (PID: 1456)

  • SUSPICIOUS

    • Adds / modifies Windows certificates

      • Hola-Setup-Core.exe (PID: 3692)
      • net_updater32.exe (PID: 2676)
      • net_updater32.exe (PID: 1456)

    • Drops a file that was compiled in debug mode

      • Hola-Setup-Agreed.exe (PID: 1248)
      • Hola-Setup-1.184.894.exe (PID: 2936)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • 7za.exe (PID: 3176)
      • net_updater32.exe (PID: 1456)

    • Drops a file with a compile date too recent

      • Hola-Setup-Agreed.exe (PID: 1248)
      • Hola-Setup-Core.exe (PID: 3692)
      • Hola-Setup-1.184.894.exe (PID: 2936)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • net_updater32.exe (PID: 1456)

    • Application launched itself

      • Hola-Setup-Core.exe (PID: 3692)
      • hola_svc.exe (PID: 2600)
      • net_svc.exe (PID: 2756)

    • Executable content was dropped or overwritten

      • Hola-Setup-Core.exe (PID: 3692)
      • Hola-Setup-1.184.894.exe (PID: 2936)
      • Hola-Setup-Agreed.exe (PID: 1248)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • 7za.exe (PID: 3176)
      • net_updater32.exe (PID: 1456)

    • Creates a directory in Program Files

      • Hola-Setup-1.184.894.exe (PID: 2936)
      • hola_updater.exe (PID: 2752)
      • net_updater32.exe (PID: 2676)
      • 7za.exe (PID: 3176)
      • net_updater32.exe (PID: 1456)
      • net_svc.exe (PID: 2756)

    • Creates files in the program directory

      • Hola-Setup-1.184.894.exe (PID: 2936)
      • hola_updater.exe (PID: 2752)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • net_updater32.exe (PID: 2676)
      • 7za.exe (PID: 3176)
      • net_updater32.exe (PID: 1456)
      • hola.exe (PID: 2648)
      • net_svc.exe (PID: 2756)
      • hola_svc.exe (PID: 2600)

    • Executed as Windows Service

      • hola_updater.exe (PID: 2752)
      • hola_svc.exe (PID: 2600)
      • net_updater32.exe (PID: 1456)

    • Uses REG.EXE to modify Windows registry

      • hola_svc.exe (PID: 2600)
      • hola_updater.exe (PID: 2752)

    • Creates a software uninstall entry

      • Hola-Setup-1.184.894.exe (PID: 3388)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 1516)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 1792)
      • cmd.exe (PID: 1512)
      • cmd.exe (PID: 3868)
      • cmd.exe (PID: 2908)
      • cmd.exe (PID: 788)
      • cmd.exe (PID: 2176)
      • cmd.exe (PID: 3528)
      • cmd.exe (PID: 2948)

    • Starts CMD.EXE for commands execution

      • hola_svc.exe (PID: 2600)

    • Drops a file with too old compile date

      • 7za.exe (PID: 3176)

    • Removes files from Windows directory

      • net_updater32.exe (PID: 1456)

    • Creates files in the Windows directory

      • net_updater32.exe (PID: 1456)

  • INFO

    • Reads settings of System Certificates

      • Hola-Setup-Core.exe (PID: 3692)
      • Hola-Setup-1.184.894.exe (PID: 2936)
      • Hola-Setup-1.184.894.exe (PID: 3388)
      • Hola-Setup-1.184.894.exe (PID: 3204)
      • net_updater32.exe (PID: 1456)

    • Dropped object may contain Bitcoin addresses

      • 7za.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

ProductVersion: 1
ProductName: Hola-Setup
OriginalFileName: Hola-Setup.exe
LegalCopyright: Copyright (c) 2015 Hola Networks Ltd.
InternalName: Hola-Setup.exe
FileVersion: 1
FileDescription: Hola Setup
CompanyName: Hola Networks Ltd.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x30cd0
UninitializedDataSize: 135168
InitializedDataSize: 32768
CodeSize: 65536
LinkerVersion: 6
PEType: PE32
TimeStamp: 2010:11:18 17:27:35+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Nov-2010 16:27:35
Detected languages:
  • English - United States
CompanyName: Hola Networks Ltd.
FileDescription: Hola Setup
FileVersion: 1.0
InternalName: Hola-Setup.exe
LegalCopyright: Copyright (c) 2015 Hola Networks Ltd.
OriginalFilename: Hola-Setup.exe
ProductName: Hola-Setup
ProductVersion: 1.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 18-Nov-2010 16:27:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
UPX0
0x00001000
0x00021000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
UPX1
0x00022000
0x00010000
0x0000FA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.97588
.rsrc
0x00032000
0x00008000
0x00007E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.4269

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.17884
1873
Latin 1 / Western European
English - United States
RT_MANIFEST
2
7.96919
22872
Latin 1 / Western European
English - United States
RT_ICON
3
4.10639
4264
Latin 1 / Western European
English - United States
RT_ICON
5
5.49361
52
Latin 1 / Western European
English - United States
RT_STRING
500
6.93639
184
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

KERNEL32.DLL
OLEAUT32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
64
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start hola-setup-agreed.exe hola-setup-core.exe hola-setup-core.exe hola-setup-1.184.894.exe hola_updater.exe hola-setup-1.184.894.exe rasdial.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs net_updater32.exe hola_svc.exe hola-setup-1.184.894.exe rasdial.exe no specs reg.exe no specs hola_svc.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs 7za.exe reg.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs sc.exe no specs net_updater32.exe hola.exe test_wpf.exe no specs hola_svc.exe no specs hola_svc.exe no specs net_svc.exe no specs net_svc.exe net_svc.exe no specs hola-setup-agreed.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320sc start luminati_net_updater_win_hola_orgC:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
632C:\Windows\system32\reg.exe QUERY HKLM\Software\Hola /v agree_tsC:\Windows\system32\reg.exe—hola_updater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
788cmd /c sc query luminati_net_updater_win_hola_opera_ext_hola_orgC:\Windows\system32\cmd.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1248"C:\Users\admin\AppData\Local\Temp\Hola-Setup-Agreed.exe" C:\Users\admin\AppData\Local\Temp\Hola-Setup-Agreed.exe
explorer.exe
User:
admin
Company:
Hola Networks Ltd.
Integrity Level:
HIGH
Description:
Hola Setup
Exit code:
0
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\hola-setup-agreed.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1428sc query luminati_net_updater_win_hola_org_p2C:\Windows\system32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1456"C:/Program Files/Hola/app/net_updater32.exe" --updater win_hola.orgC:\Program Files\Hola\app\net_updater32.exe
services.exe
User:
SYSTEM
Company:
Luminati Networks Ltd.
Integrity Level:
SYSTEM
Description:
Luminati SDK Updater
Exit code:
0
Version:
1.234.944
Modules
Images
c:\program files\hola\app\net_updater32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1476C:\Windows\system32\reg.exe ADD HKLM\Software\Hola /v agree_sent /t REG_SZ /d 1 /fC:\Windows\system32\reg.exe—hola_updater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1512cmd /c sc query luminati_net_updater_win_hola_in_ext_hola_orgC:\Windows\system32\cmd.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1516cmd /c sc query luminati_net_updater_win_hola_org_p2C:\Windows\system32\cmd.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1520"C:\Program Files\Hola\app\luminati\net_svc.exe" --infoC:\Program Files\Hola\app\luminati\net_svc.exe—net_updater32.exe
User:
SYSTEM
Company:
Luminati Networks Ltd.
Integrity Level:
SYSTEM
Description:
Luminati SDK Engine
Exit code:
0
Version:
1.233.362
Modules
Images
c:\program files\hola\app\luminati\net_svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
Total events
5 238
Read events
5 050
Write events
187
Delete events
1

Modification events

(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Operation:writeName:Blob
Value:
0400000001000000100000001BFE69D191B71933A372A80FE155E5B50F000000010000003000000066B764A96581128168CF208E374DDA479D54E311F32457F4AEE0DBD2A6C8D171D531289E1CD22BFDBBD4CFD9796254830300000001000000140000002B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E0B00000001000000100000005300650063007400690067006F0000001D0000000100000010000000885010358D29A38F059B028559C95F901400000001000000140000005379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB620000000100000020000000E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD253000000010000002600000030243022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B06010505070307190000000100000010000000EA6089055218053DD01E37E1D806EEDF2000000001000000E2050000308205DE308203C6A003020102021001FD6D30FCA3CA51A81BBC640E35032D300D06092A864886F70D01010C0500308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F72697479301E170D3130303230313030303030305A170D3338303131383233353935395A308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A028202010080126517360EC3DB08B3D0AC570D76EDCD27D34CAD508361E2AA204D092D6409DCCE899FCC3DA9ECF6CFC1DCF1D3B1D67B3728112B47DA39C6BC3A19B45FA6BD7D9DA36342B676F2A93B2B91F8E26FD0EC162090093EE2E874C918B491D46264DB7FA306F188186A90223CBCFE13F087147BF6E41F8ED4E451C61167460851CB8614543FBC33FE7E6C9CFF169D18BD518E35A6A766C87267DB2166B1D49B7803C0503AE8CCF0DCBC9E4CFEAF0596351F575AB7FFCEF93DB72CB6F654DDC8E7123A4DAE4C8AB75C9AB4B7203DCA7F2234AE7E3B68660144E7014E46539B3360F794BE5337907343F332C353EFDBAAFE744E69C76B8C6093DEC4C70CDFE132AECC933B517895678BEE3D56FE0CD0690F1B0FF325266B336DF76E47FA7343E57E0EA566B1297C3284635589C40DC19354301913ACD37D37A7EB5D3A6C355CDB41D712DAA9490BDFD8808A0993628EB566CF2588CD84B8B13FA4390FD9029EEB124C957CF36B05A95E1683CCB867E2E8139DCC5B82D34CB3ED5BFFDEE573AC233B2D00BF3555740949D849581A7F9236E651920EF3267D1C4D17BCC9EC4326D0BF415F40A94444F499E757879E501F5754A83EFD74632FB1506509E658422E431A4CB4F0254759FA041E93D426464A5081B2DEBE78B7FC6715E1C957841E0F63D6E962BAD65F552EEA5CC62808042539B80E2BA9F24C971C073F0D52F5EDEF2F820F0203010001A3423040301D0603551D0E041604145379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF300D06092A864886F70D01010C050003820201005CD47C0DCFF7017D4199650C73C5529FCBF8CF99067F1BDA43159F9E0255579614F1523C27879428ED1F3A0137A276FC5350C0849BC66B4EBA8C214FA28E556291F36915D8BC88E3C4AA0BFDEFA8E94B552A06206D55782919EE5F305C4B241155FF249A6E5E2A2BEE0B4D9F7FF70138941495430709FB60A9EE1CAB128CA09A5EA7986A596D8B3F08FBC8D145AF18156490120F73282EC5E2244EFC58ECF0F445FE22B3EB2F8ED2D9456105C1976FA876728F8B8C36AFBF0D05CE718DE6A66F1F6CA67162C5D8D083720CF16711890C9C134C7234DFBCD571DFAA71DDE1B96C8C3C125D65DABD5712B6436BFFE5DE4D661151CF99AEEC17B6E871918CDE49FEDD3571A21527941CCF61E326BB6FA36725215DE6DD1D0B2E681B3B82AFEC836785D4985174B1B9998089FF7F78195C794A602E9240AE4C372A2CC9C762C80E5DF7365BCAE0252501B4DD1A079C77003FD0DCD5EC3DD4FABB3FCC85D66F7FA92DDFB902F7F5979AB535DAC367B0874AA9289E238EFF5C276BE1B04FF307EE002ED45987CB524195EAF447D7EE6441557C8D590295DD629DC2B9EE5A287484A59BB790C70C07DFF589367432D628C1B0B00BE09C4CC31CD6FCE369B54746812FA282ABD3634470C48DFF2D33BAAD8F7BB57088AE3E19CF4028D8FCC890BB5D9922F552E658C51F883143EE881DD7C68E3C436A1DA718DE7D3D16F162F9CA90A8FD
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868
Operation:writeName:Blob
Value:
0400000001000000100000001D3554048578B03F42424DBF20730A3F0F000000010000001400000009B9105C5BBA24343CA7F341C624E183F6EE7C1B03000000010000001400000002FAF3E291435468607857694DF5E45B688518681D000000010000001000000006F9583C00A763C23FB9E065A3366D55140000000100000014000000ADBD987A34B426F7FAC42654EF03BDE024CB541A620000000100000020000000687FA451382278FFF0C8B11F8D43D576671C6EB2BCEAB413FB83D965D06D2FF20B00000001000000260000005300650063007400690067006F0020002800410064006400540072007500730074002900000053000000010000002600000030243022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B0601050507030719000000010000001000000045ED9BBC5E43D3B9ECD63C060DB78E5C20000000010000003A040000308204363082031EA003020102020101300D06092A864886F70D0101050500306F310B300906035504061302534531143012060355040A130B416464547275737420414231263024060355040B131D41646454727573742045787465726E616C20545450204E6574776F726B312230200603550403131941646454727573742045787465726E616C20434120526F6F74301E170D3030303533303130343833385A170D3230303533303130343833385A306F310B300906035504061302534531143012060355040A130B416464547275737420414231263024060355040B131D41646454727573742045787465726E616C20545450204E6574776F726B312230200603550403131941646454727573742045787465726E616C20434120526F6F7430820122300D06092A864886F70D01010105000382010F003082010A0282010100B7F71A33E6F200042D39E04E5BED1FBC6C0FCDB5FA23B6CEDE9B113397A4294C7D939FBD4ABC93ED031AE38FCFE56D505AD69729945A80B0497ADB2E95FDB8CABF37382D1E3E9141AD7056C7F04F3FE8329E74CAC89054E9C65F0F789D9A403C0EAC61AA5E148F9E87A16A50DCD79A4EAF05B3A671949C71B350600AC7139D38078602A8E9A869261890AB4CB04F23AB3A4F84D8DFCE9FE1696FBBD742D76B44E4C7ADEE6D415F725A710837B37965A459A09437F7002F0DC29272DAD03872DB14A845C45D2A7DB7B4D6C4EEACCD1344B7C92BDD430025FA61B9696A582311B7A7338F567559F5CD29D746B70A2B65B6D3426F15B2B87BFBEFE95D53D5345A270203010001A381DC3081D9301D0603551D0E04160414ADBD987A34B426F7FAC42654EF03BDE024CB541A300B0603551D0F040403020106300F0603551D130101FF040530030101FF3081990603551D2304819130818E8014ADBD987A34B426F7FAC42654EF03BDE024CB541AA173A471306F310B300906035504061302534531143012060355040A130B416464547275737420414231263024060355040B131D41646454727573742045787465726E616C20545450204E6574776F726B312230200603550403131941646454727573742045787465726E616C20434120526F6F74820101300D06092A864886F70D01010505000382010100B09BE08525C2D623E20F9606929D41989CD9847981D91E5B14072336658FB0D877BBAC416C47608351B0F9323DE7FCF62613C78016A5BF5AFC87CF787989219AE24C070A8635BCF2DE51C4D296B7DC7E4EEE70FD1C39EB0C0251142D8EBD16E0C1DF4675E724ADECF442B48593701067BA9D06354A18D32B7ACC5142A17A63D1E6BBA1C52BC236BE130DE6BD637E797BA7090D40AB6ADD8F8AC3F6F68C1A420551D445F59FA76221681520433C99E77CBD24D8A9911773883F561B313818B4710F9ACDC80E9E8E2E1BE18C9883CB1F31F1444CC604734976600FC7F8BD17806B2EE9CC4C0E5A9A790F200A2ED59E63261E559294D882175A7BD0BCC78F4E8604
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
Operation:writeName:Blob
Value:
040000000100000010000000A266BB7DCC38A562631361BBF61DD11B140000000100000014000000D5F656CB8FE8A25C6268D13D94905BD7CE9A18C40300000001000000140000003B1EFD3A66EA28B16697394703A72CA340A05BD50B00000001000000540000004D006900630072006F0073006F0066007400200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F00720069007400790020003200300031003000000069000000010000000E000000300C060A2B0601040182373C03020F000000010000002000000008FBA831C08544208F5208686B991CA1B2CFC510E7301784DDF1EB5BF03932391900000001000000100000003C70FAEA25600CE3B2CC5F0B222ED6292000000001000000F1050000308205ED308203D5A003020102021028CC3A25BFBA44AC449A9B586B4339AA300D06092A864886F70D01010B0500308188310B3009060355040613025553311330110603550408130A57617368696E67746F6E3110300E060355040713075265646D6F6E64311E301C060355040A13154D6963726F736F667420436F72706F726174696F6E31323030060355040313294D6963726F736F667420526F6F7420436572746966696361746520417574686F726974792032303130301E170D3130303632333231353732345A170D3335303632333232303430315A308188310B3009060355040613025553311330110603550408130A57617368696E67746F6E3110300E060355040713075265646D6F6E64311E301C060355040A13154D6963726F736F667420436F72706F726174696F6E31323030060355040313294D6963726F736F667420526F6F7420436572746966696361746520417574686F72697479203230313030820222300D06092A864886F70D01010105000382020F003082020A0282020100B9089E28E4E4EC064E5068B341C57BEBAEB68EAF81BA22441F6534694CBE704017F2167BE279FD86ED0D39F41BA8AD92901ECB3D768F5AD9B591102E3C058D8A6D2454E71FED56AD83B4509C15A51774885920FC08C58476D368D46F2878CE5CB8F3509044FFE3635FBEA19A2C961504D607FE1E8421E0423111C4283694CF50A4629EC9D6AB7100B25B0CE696D40A2496F5FFC6D5B71BD7CBB72162AF12DCA15D37E31AFB1A4698C09BC0E7631F2A0893027E1E6A8EF29F1889E42285A2B1845740FFF50ED86F9CEDE2453101CD17E97FB08145E3AA214026A172AAA74F3C01057EEE8358B15E06639962917882B70D930C246AB41BDB27EC5F95043F934A30F59718B3A7F919A793331D01C8DB22525CD725C946F9A2FB875943BE9B62B18D2D86441A46AC78617E3009FAAE89C4412A2266039139459CC78B0CA8CA0D2FFB52EA0CF76333239DFEB01FAD67D6A75003C6047063B52CB1865A43B7FBAEF96E296E21214126068CC9C3EEB0C28593A1B985D9E6326C4B4C3FD65DA3E5B59D77C39CC055B77400E3B838AB839750E19A42241DC6C0A330D11A5AC85234F773F1C7181F33AD7AECCB4160F3239420C24845AC5C51C62E80C2E27715BD8587ED369D9691EE00B5A370EC9FE38D80688376BAAF5D70522216E266FBBAB3C5C2F73E2F77A6CADEC1A6C6484CC3375123D327D7B84E7096F0A14476AF78CF9AE166130203010001A351304F300B0603551D0F040403020186300F0603551D130101FF040530030101FF301D0603551D0E04160414D5F656CB8FE8A25C6268D13D94905BD7CE9A18C4301006092B06010401823715010403020100300D06092A864886F70D01010B05000382020100ACA5968CBFBBAEA6F6D7718743315688FD1C32715B35B7D4F091F2AF37E214F1F30226053E16147F14BAB84FFB89B2B2E7D409CC6DB95B3B64657066B7F2B15ADF1A02F3F551B8676D79F3BF567BE484B92B1E9B409C2634F947189869D81CD7B6D1BF8F61C267C4B5EF60438E101B3649E420CAADA7C1B1276509F8CDF55B2AD08433F3EF1FF2F59C0B589337A075A0DE72DE6C752A6622F58C0630569F40B930AA40771582D78BECC0D3B2BD83C5770C1EAEAF1953A04D79719F0FAF30CE67F9D62CCC22417A07F2974218CE59791055DE6F10E4B8DA836640160968235B972E269A02BB578CC5B8BA69623280899EA1FDC0927C7B2B3319842A63C5006862FA9F478D997A453AA7E9EDEE6942B5F3819B4756107BFC7036841873EAEFF9974D9E3323DD260BBA2AB73F44DC8327FFBD61592B11B7CA4FDBC58B0C1C31AE32F8F8B942F77FDC619A76B15A04E1113D6645B71871BEC92485D6F3D4BA41345D122D25B98DA613486D4BB0077D99930961817457268AAB69E3E4D9C788CC24D8EC52245C1EBC9114E296DEEB0ADA9EDD5FB35BDBD482ECC620508725403AFBC7EECDFE33E56EC3840955032539C0E9355D6531A8F6BFA009CD29C7B336322EDC95F383C15ACF8B8DF6EAB321F8A4ED1E310EB64C11AB600BA412232217A3366482910412E0AB6F1ECB500561B440FF598671D1D533697CA9738A38D7640CF169
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E
Operation:writeName:Blob
Value:
040000000100000010000000D63981C6527E9669FCFCCA66ED05F2960F000000010000002000000071B437F087F3700FFD4E2FA46F42B6B810D7BF19ADFEDF951C023EDD65B50B05030000000100000014000000B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E1D000000010000001000000054E2CD85BA79CDA018FED9E6A863AA461400000001000000140000007C0C321FA7D9307FC47D68A362A8A1CEAB075B276200000001000000200000002CE1CB0BF9D2F9E102993FBE215152C3B2DD0CABDE1C68E5319B839154DBB7F553000000010000002500000030233021060B6086480186FD6E0107170330123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B000000010000005400000053007400610072006600690065006C006400200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F00720069007400790020001320200047003200000019000000010000001000000060E2DC65295F1062E558F3FEF235ED3C2000000001000000E1030000308203DD308202C5A003020102020100300D06092A864886F70D01010B050030818F310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E3132303006035504031329537461726669656C6420526F6F7420436572746966696361746520417574686F72697479202D204732301E170D3039303930313030303030305A170D3337313233313233353935395A30818F310B30090603550406130255533110300E060355040813074172697A6F6E61311330110603550407130A53636F74747364616C6531253023060355040A131C537461726669656C6420546563686E6F6C6F676965732C20496E632E3132303006035504031329537461726669656C6420526F6F7420436572746966696361746520417574686F72697479202D20473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BDEDC103FCF68FFC02B16F5B9F48D99D79E2A2B703615618C347B6D7CA3D352E8943F7A1699BDE8A1AFD13209CB44977322956FDB9EC8CDD22FA72DC276197EEF65A84EC6E19B9892CDC845BD574FB6B5FC589A51052894655F4B8751CE67FE454AE4BF85572570219F8177159EB1E280774C59D48BE6CB4F4A4B0F364377992C0EC465E7FE16D534C62AFCD1F0B63BB3A9DFBFC7900986174CF26824063F3B2726A190D99CAD40E75CC37FB8B89C159F1627F5FB35F6530F8A7B74D765A1E765E34C0E89656998AB3F07FA4CDBDDC32317C91CFE05F11F86BAA495CD19994D1A2E3635B0976B55662E14B741D96D426D4080459D0980E0EE6DEFCC3EC1F90F10203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147C0C321FA7D9307FC47D68A362A8A1CEAB075B27300D06092A864886F70D01010B050003820101001159FA254F036F94993B9A1F828539D47605945EE128936D625D09C2A0A8D4B07538F1346A9DE49F8A862651E62CD1C62D6E95204A9201ECB88A677B31E2672E8C9503262E439D4A31F60EB50CBBB7E2377F22BA00A30E7B52FB6BBB3BC4D379514ECD90F4670719C83C467A0D017DC558E76DE68530179A24C410E004F7E0F27FD4AA0AFF421D37ED94E5645912207738D3323E3881759673FA688FB1CBCE1FC5ECFA9C7ECF7EB1F1072DB6FCBFCAA4BFD097054ABCEA18280290BD5478092171D3D17D1DD916B0A9613DD00A0022FCC77BCB0964450B3B4081F77D7C32F598CA588E7D2AEE90597364F936745E25A1F566052E7F3915A92AFB508B8E8569F4
(PID) Process:(4044) Hola-Setup-Core.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Hola-Setup-Core.exe
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hola-Setup-Core_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hola-Setup-Core_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3692) Hola-Setup-Core.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Hola-Setup-Core_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
Executable files
33
Suspicious files
53
Text files
27
Unknown types
61

Dropped files

PID
Process
Filename
Type
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Cab9CF5.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Tar9CF6.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Cab9D26.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Tar9D27.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Cab9E22.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Tar9E23.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Cab9EDF.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Tar9EF0.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Cab9F01.tmp —
MD5:—
SHA256:—
3692Hola-Setup-Core.exeC:\Users\admin\AppData\Local\Temp\Tar9F02.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
235
DNS requests
47
Threats
73

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2600
hola_svc.exe
GET
—
23.40.125.183:80
http://i.s-microsoft.com/library/svy/close.gif
NL
—
—
whitelisted
2600
hola_svc.exe
GET
—
3.226.172.116:80
http://http-test1.hola.org/connection/http-test1.html
US
—
—
suspicious
2600
hola_svc.exe
GET
301
23.40.125.183:80
http://i.s-microsoft.com/library/svy/close.gif
NL
—
—
whitelisted
2600
hola_svc.exe
GET
200
142.250.186.132:80
http://142.250.186.132:80/blank.html
US
—
—
whitelisted
2600
hola_svc.exe
GET
—
3.226.172.116:80
http://http-test1.hola.org/connection/http-test1.html
US
—
—
suspicious
4044
Hola-Setup-Core.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
—
—
whitelisted
4044
Hola-Setup-Core.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
—
—
whitelisted
3692
Hola-Setup-Core.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
58.4 Kb
whitelisted
3692
Hola-Setup-Core.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
58.4 Kb
whitelisted
3692
Hola-Setup-Core.exe
GET
304
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
58.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3692
Hola-Setup-Core.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3692
Hola-Setup-Core.exe
34.237.179.253:443
perr.hola.org
Amazon.com, Inc.
US
suspicious
3692
Hola-Setup-Core.exe
54.225.227.202:443
client.hola.org
Amazon.com, Inc.
US
suspicious
3692
Hola-Setup-Core.exe
107.22.193.119:443
hola.org
Amazon.com, Inc.
US
suspicious
3692
Hola-Setup-Core.exe
51.255.87.60:443
zagent853.h-cdn.com
OVH SAS
FR
malicious
2752
hola_updater.exe
23.22.252.240:443
perr.hola.org
Amazon.com, Inc.
US
suspicious
2752
hola_updater.exe
107.22.193.119:443
hola.org
Amazon.com, Inc.
US
suspicious
2752
hola_updater.exe
54.225.227.202:443
client.hola.org
Amazon.com, Inc.
US
suspicious
2752
hola_updater.exe
3.215.198.168:443
proxyjs.hola.org
—
US
unknown
3388
Hola-Setup-1.184.894.exe
23.22.252.240:443
perr.hola.org
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
perr.hola.org
  • 34.237.179.253
  • 23.22.252.240
whitelisted
hola.org
  • 107.22.193.119
  • 54.225.121.9
whitelisted
client.hola.org
  • 54.225.227.202
  • 54.243.128.120
whitelisted
zagent853.h-cdn.com
  • 51.255.87.60
unknown
proxyjs.hola.org
  • 3.215.198.168
  • 3.217.85.237
  • 3.217.12.237
  • 3.210.106.128
  • 3.217.131.101
  • 3.217.21.103
  • 3.214.232.36
  • 3.226.207.59
  • 54.90.50.83
  • 3.211.186.177
  • 3.216.157.50
unknown
www.dropbox.com
  • 162.125.66.18
shared
www.google.com
  • 142.250.186.132
malicious
dns-test1.hola.org
  • 72.249.190.125
unknown
http-test1.hola.org
  • 3.226.172.116
suspicious

Threats

PID
Process
Class
Message
2676
net_updater32.exe
Potential Corporate Privacy Violation
ET POLICY Dropbox.com Offsite File Backup in Use
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
2676
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2676
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2676
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1456
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1456
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1456
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1456
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1456
net_updater32.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hola-Setup-Agreed.exe