File name:

Hola-Setup-C-HPE.exe

Full analysis: https://app.any.run/tasks/84cc9043-1824-442d-92bf-aa5ac95df18c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 23, 2025, 18:22:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
evasion
loader
nodejs
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

4B3285AF71292E71621652D581FE6E66

SHA1:

2EBB20AFE428FB144BA8403982D9A4943210D814

SHA256:

F4442BC2B0B06C677752715767D6AA5D271CBCDA73C39406E7DDD0213E3FE685

SSDEEP:

98304:zINMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM:th

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • Hola-Setup-C-HPE.exe (PID: 3632)

    • Changes the autorun value in the registry

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • net_updater64.exe (PID: 1036)
      • net_updater64.exe (PID: 5896)

    • Application launched itself

      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 3632)
      • hola_svc.exe (PID: 4476)
      • hola_cr.exe (PID: 6368)
      • hola_cr.exe (PID: 6376)
      • updater.exe (PID: 6768)

    • Executable content was dropped or overwritten

      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • net_updater64.exe (PID: 1036)
      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 2620)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • 7zr.exe (PID: 2460)
      • net_updater64.exe (PID: 10920)

    • Creates a software uninstall entry

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)

    • Drops 7-zip archiver for unpacking

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)

    • The process drops C-runtime libraries

      • net_updater64.exe (PID: 1036)

    • Executes as Windows Service

      • net_updater64.exe (PID: 2680)
      • hola_svc.exe (PID: 4476)
      • WmiApSrv.exe (PID: 2528)

    • Drops a system driver (possible attempt to evade defenses)

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)

    • Process drops legitimate windows executable

      • net_updater64.exe (PID: 1036)

    • Detected use of alternative data streams (AltDS)

      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2620)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 10920)

    • Creates file in the systems drive root

      • hola_svc.exe (PID: 4476)

    • Connects to unusual port

      • hola_svc.exe (PID: 4476)

    • The process checks if it is being run in the virtual environment

      • net_updater64.exe (PID: 2680)
      • hola_cr.exe (PID: 6376)

    • Checks for external IP

      • net_updater64.exe (PID: 2680)

    • Process requests binary or script from the Internet

      • hola.exe (PID: 7544)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8872)
      • sc.exe (PID: 8864)
      • sc.exe (PID: 8892)
      • sc.exe (PID: 8912)
      • sc.exe (PID: 9016)
      • sc.exe (PID: 8856)
      • sc.exe (PID: 8808)
      • sc.exe (PID: 8820)
      • sc.exe (PID: 9200)
      • sc.exe (PID: 8944)
      • sc.exe (PID: 9196)
      • sc.exe (PID: 8940)
      • sc.exe (PID: 9212)
      • sc.exe (PID: 9064)
      • sc.exe (PID: 8888)
      • sc.exe (PID: 8804)
      • sc.exe (PID: 6372)
      • sc.exe (PID: 5368)
      • sc.exe (PID: 6216)
      • sc.exe (PID: 8308)
      • sc.exe (PID: 9208)
      • sc.exe (PID: 640)
      • sc.exe (PID: 6232)
      • sc.exe (PID: 7156)
      • sc.exe (PID: 3396)
      • sc.exe (PID: 6796)
      • sc.exe (PID: 2272)
      • sc.exe (PID: 1080)
      • sc.exe (PID: 3800)
      • sc.exe (PID: 5928)
      • sc.exe (PID: 2028)
      • sc.exe (PID: 8780)
      • sc.exe (PID: 7032)
      • sc.exe (PID: 8732)
      • sc.exe (PID: 8632)
      • sc.exe (PID: 8760)
      • sc.exe (PID: 3644)
      • sc.exe (PID: 8628)
      • sc.exe (PID: 3028)
      • sc.exe (PID: 9112)
      • sc.exe (PID: 7128)
      • sc.exe (PID: 9052)
      • sc.exe (PID: 5716)
      • sc.exe (PID: 3832)
      • sc.exe (PID: 9252)
      • sc.exe (PID: 9280)
      • sc.exe (PID: 9300)
      • sc.exe (PID: 9316)
      • sc.exe (PID: 9348)
      • sc.exe (PID: 9416)
      • sc.exe (PID: 7120)
      • sc.exe (PID: 9232)
      • sc.exe (PID: 9268)
      • sc.exe (PID: 9440)
      • sc.exe (PID: 9508)
      • sc.exe (PID: 9372)
      • sc.exe (PID: 9384)
      • sc.exe (PID: 9392)
      • sc.exe (PID: 9536)
      • sc.exe (PID: 9424)
      • sc.exe (PID: 9480)
      • sc.exe (PID: 8772)
      • sc.exe (PID: 9584)
      • sc.exe (PID: 8620)

    • Starts SC.EXE for service management

      • hola_svc.exe (PID: 4476)

    • Searches for installed software

      • explorer.exe (PID: 1080)

    • The process executes via Task Scheduler

      • updater.exe (PID: 6768)

  • INFO

    • Disables trace logs

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 5372)
      • hola_svc.exe (PID: 4476)
      • rasdial.exe (PID: 2528)
      • rasdial.exe (PID: 5060)
      • rasdial.exe (PID: 856)
      • rasdial.exe (PID: 3736)
      • rasdial.exe (PID: 7348)
      • rasdial.exe (PID: 8196)
      • rasdial.exe (PID: 8728)
      • rasdial.exe (PID: 8616)
      • rasdial.exe (PID: 8936)
      • rasdial.exe (PID: 8328)
      • rasdial.exe (PID: 9184)
      • rasdial.exe (PID: 8620)
      • rasdial.exe (PID: 8740)
      • net_updater64.exe (PID: 2680)
      • rasdial.exe (PID: 9632)
      • rasdial.exe (PID: 8800)
      • rasdial.exe (PID: 8892)
      • rasdial.exe (PID: 9980)
      • rasdial.exe (PID: 10228)
      • rasdial.exe (PID: 8296)
      • rasdial.exe (PID: 10496)
      • rasdial.exe (PID: 5372)
      • rasdial.exe (PID: 11048)
      • rasdial.exe (PID: 6956)
      • rasdial.exe (PID: 7464)
      • rasdial.exe (PID: 10044)
      • rasdial.exe (PID: 9492)
      • rasdial.exe (PID: 9840)
      • rasdial.exe (PID: 2028)
      • rasdial.exe (PID: 9912)
      • rasdial.exe (PID: 10160)
      • rasdial.exe (PID: 9496)
      • rasdial.exe (PID: 9520)
      • rasdial.exe (PID: 9876)
      • rasdial.exe (PID: 10360)
      • rasdial.exe (PID: 8748)
      • rasdial.exe (PID: 6796)
      • rasdial.exe (PID: 10964)
      • rasdial.exe (PID: 10664)
      • rasdial.exe (PID: 10564)
      • rasdial.exe (PID: 9572)
      • rasdial.exe (PID: 8800)
      • rasdial.exe (PID: 11060)
      • rasdial.exe (PID: 10332)
      • rasdial.exe (PID: 8576)
      • rasdial.exe (PID: 9560)
      • rasdial.exe (PID: 8344)
      • rasdial.exe (PID: 9500)
      • rasdial.exe (PID: 9508)
      • rasdial.exe (PID: 10728)
      • rasdial.exe (PID: 10172)
      • rasdial.exe (PID: 11120)
      • rasdial.exe (PID: 11108)
      • rasdial.exe (PID: 9264)
      • rasdial.exe (PID: 8860)
      • rasdial.exe (PID: 9708)
      • rasdial.exe (PID: 7048)
      • rasdial.exe (PID: 2972)
      • rasdial.exe (PID: 10424)
      • rasdial.exe (PID: 9516)
      • rasdial.exe (PID: 8328)
      • rasdial.exe (PID: 10588)
      • rasdial.exe (PID: 3800)
      • rasdial.exe (PID: 4236)
      • rasdial.exe (PID: 10844)
      • rasdial.exe (PID: 10368)
      • rasdial.exe (PID: 8920)
      • rasdial.exe (PID: 6152)
      • rasdial.exe (PID: 10984)
      • rasdial.exe (PID: 10336)
      • rasdial.exe (PID: 6192)
      • rasdial.exe (PID: 10284)
      • rasdial.exe (PID: 10620)
      • rasdial.exe (PID: 8072)
      • rasdial.exe (PID: 9464)
      • rasdial.exe (PID: 8116)
      • rasdial.exe (PID: 8840)
      • rasdial.exe (PID: 9240)
      • rasdial.exe (PID: 8772)
      • rasdial.exe (PID: 9772)
      • rasdial.exe (PID: 11036)
      • rasdial.exe (PID: 8144)
      • rasdial.exe (PID: 10516)
      • rasdial.exe (PID: 3732)
      • rasdial.exe (PID: 11164)
      • rasdial.exe (PID: 10236)
      • rasdial.exe (PID: 316)
      • rasdial.exe (PID: 10012)
      • rasdial.exe (PID: 9528)
      • rasdial.exe (PID: 9884)
      • rasdial.exe (PID: 8900)
      • rasdial.exe (PID: 11216)
      • rasdial.exe (PID: 984)
      • rasdial.exe (PID: 3756)
      • rasdial.exe (PID: 10300)
      • rasdial.exe (PID: 9732)
      • rasdial.exe (PID: 7332)
      • rasdial.exe (PID: 9588)
      • rasdial.exe (PID: 8336)
      • rasdial.exe (PID: 10592)
      • rasdial.exe (PID: 9548)
      • rasdial.exe (PID: 6504)
      • rasdial.exe (PID: 9912)
      • rasdial.exe (PID: 5288)
      • rasdial.exe (PID: 416)
      • rasdial.exe (PID: 10704)
      • rasdial.exe (PID: 3644)
      • rasdial.exe (PID: 8372)
      • rasdial.exe (PID: 7128)
      • rasdial.exe (PID: 9316)
      • rasdial.exe (PID: 7156)
      • rasdial.exe (PID: 10148)
      • rasdial.exe (PID: 1324)
      • rasdial.exe (PID: 7236)
      • rasdial.exe (PID: 6808)
      • rasdial.exe (PID: 9308)
      • rasdial.exe (PID: 9500)
      • rasdial.exe (PID: 6016)
      • rasdial.exe (PID: 10964)
      • rasdial.exe (PID: 8104)
      • rasdial.exe (PID: 7120)
      • rasdial.exe (PID: 11012)
      • rasdial.exe (PID: 8800)
      • rasdial.exe (PID: 11132)
      • rasdial.exe (PID: 11144)
      • rasdial.exe (PID: 9848)
      • rasdial.exe (PID: 8832)
      • rasdial.exe (PID: 4748)
      • rasdial.exe (PID: 8388)
      • rasdial.exe (PID: 5080)
      • rasdial.exe (PID: 10172)
      • rasdial.exe (PID: 10540)
      • rasdial.exe (PID: 7460)
      • rasdial.exe (PID: 10028)
      • rasdial.exe (PID: 9588)
      • rasdial.exe (PID: 7380)
      • rasdial.exe (PID: 8300)
      • rasdial.exe (PID: 9312)
      • rasdial.exe (PID: 9004)
      • rasdial.exe (PID: 3756)
      • rasdial.exe (PID: 7180)
      • rasdial.exe (PID: 9888)
      • rasdial.exe (PID: 9840)
      • rasdial.exe (PID: 7172)
      • rasdial.exe (PID: 10616)
      • rasdial.exe (PID: 10352)
      • rasdial.exe (PID: 9660)
      • rasdial.exe (PID: 9060)
      • rasdial.exe (PID: 10676)
      • rasdial.exe (PID: 1508)
      • rasdial.exe (PID: 6080)
      • rasdial.exe (PID: 9808)
      • rasdial.exe (PID: 9428)
      • rasdial.exe (PID: 10384)
      • rasdial.exe (PID: 9812)
      • rasdial.exe (PID: 1324)
      • rasdial.exe (PID: 6384)
      • rasdial.exe (PID: 10964)
      • rasdial.exe (PID: 1704)
      • rasdial.exe (PID: 8096)
      • rasdial.exe (PID: 3840)
      • rasdial.exe (PID: 5008)
      • rasdial.exe (PID: 9928)
      • rasdial.exe (PID: 8592)
      • rasdial.exe (PID: 3852)
      • rasdial.exe (PID: 11084)
      • rasdial.exe (PID: 11012)
      • rasdial.exe (PID: 4040)
      • rasdial.exe (PID: 6216)
      • rasdial.exe (PID: 9136)
      • rasdial.exe (PID: 3732)
      • rasdial.exe (PID: 9200)
      • rasdial.exe (PID: 6268)
      • rasdial.exe (PID: 11112)
      • rasdial.exe (PID: 6232)
      • rasdial.exe (PID: 9988)
      • rasdial.exe (PID: 1180)
      • rasdial.exe (PID: 10540)
      • rasdial.exe (PID: 9516)
      • rasdial.exe (PID: 9400)
      • rasdial.exe (PID: 9696)
      • rasdial.exe (PID: 9304)
      • rasdial.exe (PID: 10688)
      • rasdial.exe (PID: 2168)
      • rasdial.exe (PID: 2028)
      • rasdial.exe (PID: 10664)
      • rasdial.exe (PID: 9432)
      • rasdial.exe (PID: 9708)
      • rasdial.exe (PID: 10820)
      • rasdial.exe (PID: 1580)
      • rasdial.exe (PID: 10376)
      • rasdial.exe (PID: 6224)
      • rasdial.exe (PID: 2964)
      • rasdial.exe (PID: 8416)
      • rasdial.exe (PID: 10428)
      • rasdial.exe (PID: 4444)
      • rasdial.exe (PID: 5060)
      • rasdial.exe (PID: 420)

    • Checks supported languages

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 5372)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • net_updater64.exe (PID: 1036)
      • test_wpf.exe (PID: 5968)
      • net_updater64.exe (PID: 2680)
      • test_wpf.exe (PID: 4196)
      • test_wpf.exe (PID: 1512)
      • net_updater64.exe (PID: 5896)
      • test_wpf.exe (PID: 6148)
      • hola_svc.exe (PID: 4476)
      • hola_svc.exe (PID: 3888)
      • net_updater64.exe (PID: 2620)
      • idle_report.exe (PID: 3924)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • 7zr.exe (PID: 2460)
      • Hola-Setup-x64-1.243.946.exe (PID: 3720)
      • hola_cr.exe (PID: 6376)
      • hola.exe (PID: 7544)
      • hola_cr.exe (PID: 5124)
      • hola_cr.exe (PID: 6368)
      • hola_cr.exe (PID: 3460)
      • hola_cr.exe (PID: 3948)
      • hola_cr.exe (PID: 2876)
      • hola_cr.exe (PID: 6264)
      • hola_cr.exe (PID: 316)
      • hola_cr.exe (PID: 6216)
      • hola_cr.exe (PID: 1296)
      • hola_cr.exe (PID: 7932)
      • hola_cr.exe (PID: 5168)
      • hola_cr.exe (PID: 8024)
      • identity_helper.exe (PID: 8332)
      • hola_cr.exe (PID: 8216)
      • hola_cr.exe (PID: 8224)
      • hola_cr.exe (PID: 8852)
      • hola_svc.exe (PID: 8868)
      • hola_cr.exe (PID: 9120)
      • hola_cr.exe (PID: 8712)
      • hola_cr.exe (PID: 8720)
      • net_updater64.exe (PID: 10920)
      • test_wpf.exe (PID: 9944)
      • hola_cr.exe (PID: 8300)
      • hola_cr.exe (PID: 11148)
      • idle_report.exe (PID: 9020)
      • hola_cr.exe (PID: 3760)
      • hola_svc.exe (PID: 7364)
      • hola_cr.exe (PID: 7808)
      • hola_cr.exe (PID: 9508)
      • idle_report.exe (PID: 10400)
      • hola_cr.exe (PID: 10512)
      • hola_svc.exe (PID: 8892)
      • hola_cr.exe (PID: 8920)
      • updater.exe (PID: 6768)
      • updater.exe (PID: 9804)
      • hola_cr.exe (PID: 10284)
      • idle_report.exe (PID: 9240)
      • hola_cr.exe (PID: 11044)
      • hola_cr.exe (PID: 2732)
      • hola_cr.exe (PID: 8844)
      • hola_svc.exe (PID: 10068)

    • Reads the computer name

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 5372)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 1036)
      • test_wpf.exe (PID: 1512)
      • net_updater64.exe (PID: 5896)
      • test_wpf.exe (PID: 5968)
      • test_wpf.exe (PID: 4196)
      • hola_svc.exe (PID: 4476)
      • net_updater64.exe (PID: 2620)
      • test_wpf.exe (PID: 6148)
      • idle_report.exe (PID: 3924)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • 7zr.exe (PID: 2460)
      • Hola-Setup-x64-1.243.946.exe (PID: 3720)
      • hola_cr.exe (PID: 6368)
      • hola.exe (PID: 7544)
      • hola_cr.exe (PID: 6376)
      • hola_cr.exe (PID: 6216)
      • hola_cr.exe (PID: 3460)
      • identity_helper.exe (PID: 8332)
      • hola_cr.exe (PID: 8852)
      • net_updater64.exe (PID: 10920)
      • test_wpf.exe (PID: 9944)
      • idle_report.exe (PID: 9020)
      • idle_report.exe (PID: 10400)
      • hola_cr.exe (PID: 3948)
      • updater.exe (PID: 6768)
      • idle_report.exe (PID: 9240)

    • Process checks computer location settings

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • net_updater64.exe (PID: 1036)
      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2620)
      • net_updater64.exe (PID: 2680)
      • hola_cr.exe (PID: 6376)
      • hola_cr.exe (PID: 8024)
      • hola_cr.exe (PID: 5168)
      • hola_cr.exe (PID: 8224)
      • hola_cr.exe (PID: 316)
      • hola_cr.exe (PID: 6264)
      • hola_cr.exe (PID: 8216)
      • hola_cr.exe (PID: 8720)
      • hola_cr.exe (PID: 9120)
      • hola_cr.exe (PID: 7932)
      • net_updater64.exe (PID: 10920)

    • Reads the machine GUID from the registry

      • Hola-Setup-C-HPE.exe (PID: 5372)
      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • net_updater64.exe (PID: 1036)
      • test_wpf.exe (PID: 5968)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 5896)
      • test_wpf.exe (PID: 4196)
      • hola_svc.exe (PID: 4476)
      • test_wpf.exe (PID: 1512)
      • test_wpf.exe (PID: 6148)
      • net_updater64.exe (PID: 2620)
      • idle_report.exe (PID: 3924)
      • hola_cr.exe (PID: 6376)
      • net_updater64.exe (PID: 10920)
      • test_wpf.exe (PID: 9944)
      • idle_report.exe (PID: 9020)
      • idle_report.exe (PID: 10400)
      • hola_cr.exe (PID: 3948)
      • idle_report.exe (PID: 9240)

    • Checks proxy server information

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 5372)
      • net_updater64.exe (PID: 1036)
      • hola_cr.exe (PID: 6376)
      • slui.exe (PID: 8972)

    • Create files in a temporary directory

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • Hola-Setup-x64-1.243.946.exe (PID: 3720)
      • hola_cr.exe (PID: 6376)

    • Reads the software policy settings

      • Hola-Setup-C-HPE.exe (PID: 3632)
      • Hola-Setup-C-HPE.exe (PID: 3676)
      • Hola-Setup-C-HPE.exe (PID: 5372)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • net_updater64.exe (PID: 1036)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2620)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • Hola-Setup-x64-1.243.946.exe (PID: 3720)
      • hola.exe (PID: 7544)
      • net_updater64.exe (PID: 10920)
      • slui.exe (PID: 8972)

    • The sample compiled with english language support

      • Hola-Setup-C-HPE.exe (PID: 3676)
      • net_updater64.exe (PID: 1036)
      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • 7zr.exe (PID: 2460)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)

    • Launching a file from a Registry key

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)

    • Creates files in the program directory

      • Hola-Setup-x64-1.243.946.exe (PID: 4520)
      • net_updater64.exe (PID: 2680)
      • net_updater64.exe (PID: 1036)
      • hola_svc.exe (PID: 4476)
      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2620)
      • 7zr.exe (PID: 2460)
      • Hola-Setup-x64-1.243.946.exe (PID: 6852)
      • Hola-Setup-x64-1.243.946.exe (PID: 3720)
      • hola.exe (PID: 7544)
      • net_updater64.exe (PID: 10920)

    • Reads Environment values

      • net_updater64.exe (PID: 1036)
      • net_updater64.exe (PID: 5896)
      • net_updater64.exe (PID: 2620)
      • net_updater64.exe (PID: 2680)
      • identity_helper.exe (PID: 8332)
      • net_updater64.exe (PID: 10920)

    • Creates files or folders in the user directory

      • net_updater64.exe (PID: 1036)
      • hola_cr.exe (PID: 6376)
      • hola_cr.exe (PID: 3460)
      • hola_cr.exe (PID: 6368)

    • Reads CPU info

      • net_updater64.exe (PID: 2680)

    • Reads the time zone

      • net_updater64.exe (PID: 2680)

    • Application launched itself

      • msedge.exe (PID: 5012)
      • msedge.exe (PID: 5552)
      • msedge.exe (PID: 6892)

    • Manual execution by a user

      • msedge.exe (PID: 5552)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 7356)

    • Node.js compiler has been detected

      • hola_svc.exe (PID: 4476)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2001:08:06 21:39:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3019776
InitializedDataSize: 414208
UninitializedDataSize: -
EntryPoint: 0x2e32ee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.240.839.0
ProductVersionNumber: 1.240.839.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Hola VPN Ltd.
FileDescription: Hola VPN App Setup
FileVersion: 1.240.839.0
InternalName: hola_setup.exe
LegalCopyright: Copyright © 2023 Hola VPN Ltd.
LegalTrademarks: -
OriginalFileName: hola_setup.exe
ProductName: Hola Setup
ProductVersion: 1.240.839.0
AssemblyVersion: 1.240.839.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
774
Monitored processes
628
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start hola-setup-c-hpe.exe hola-setup-c-hpe.exe hola-setup-c-hpe.exe hola-setup-x64-1.243.946.exe net_updater64.exe conhost.exe no specs test_wpf.exe no specs net_updater64.exe test_wpf.exe no specs net_updater64.exe conhost.exe no specs test_wpf.exe no specs hola_svc.exe net_updater64.exe conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs test_wpf.exe no specs idle_report.exe no specs conhost.exe no specs wmiapsrv.exe no specs hola-setup-x64-1.243.946.exe 7zr.exe conhost.exe no specs msedge.exe no specs msedge.exe no specs hola-setup-x64-1.243.946.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe explorer.exe no specs msedge.exe no specs explorer.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs hola.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe hola_cr.exe no specs hola_cr.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs hola_cr.exe no specs hola_cr.exe no specs conhost.exe no specs identity_helper.exe no specs identity_helper.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_svc.exe no specs rasdial.exe no specs slui.exe conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs net_updater64.exe rasdial.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs test_wpf.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs COpenControlPanel no specs msedge.exe no specs explorer.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs updater.exe no specs updater.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --no-subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4172,i,13155376092141362358,2833516529983097016,2097152 --field-trial-handle=4188,i,7409355693710786277,602355536895999320,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2C:\Program Files\Hola\app\chromium\hola_cr.exe—hola_cr.exe
User:
admin
Company:
Hola VPN Ltd.
Integrity Level:
LOW
Description:
Hola
Exit code:
0
Version:
128.0.6613.86
Modules
Images
c:\program files\hola\app\chromium\hola_cr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\program files\hola\app\chromium\128.0.6613.86\hola_elf.dll
c:\windows\syswow64\version.dll
316rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5800,i,14520469383104222944,1157628044002031827,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
416rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\gdi32full.dll
420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
420rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
620\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640sc query luminati_net_updater_org_hola_browser_updaterC:\Windows\System32\sc.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
110 994
Read events
110 796
Write events
192
Delete events
6

Modification events

(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3632) Hola-Setup-C-HPE.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Hola-Setup-C-HPE_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
23
Suspicious files
489
Text files
131
Unknown types
178

Dropped files

PID
Process
Filename
Type
3676Hola-Setup-C-HPE.exeC:\Users\admin\AppData\Local\Temp\chromium-128.0.6613.86.1242669.zip —
MD5:—
SHA256:—
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\hola_split_tunnel.sysexecutable
MD5:1B0B2B41D0CEE1FD73F3145F32618032
SHA256:4B5132A8837365D56E817D44A025768E59A0459E223D69E71052A4CDED2FD500
3676Hola-Setup-C-HPE.exeC:\Users\admin\AppData\Local\Temp\Hola-Setup-x64-1.243.946.exeexecutable
MD5:A9BE739359470CE27CF3F89FA8617191
SHA256:8CF56CF24B0013C943D0047871EA8B65AD0339A55A8ABC3A8165630B5DEFF0BF
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\lum_sdk64.dllexecutable
MD5:C3E9C29CA4F57916D3347D23D3A2279E
SHA256:CD928869686CC510559DB72656E081B025256E0C8FA5E13A716878F34ABBC243
4520Hola-Setup-x64-1.243.946.exeC:\Users\admin\AppData\Local\Temp\install.logbinary
MD5:22829919ED96BC1D912505C8E2CEA48A
SHA256:FB323D3B27646082454509FD9A7FB349C7701E6C3B56BEB8991E8AFC7CA5327F
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\brd_config.jsonbinary
MD5:106968CAECC3D8687EE903FADD6475DC
SHA256:A8A98543314FDA9C0E1AFD290E6B4D430B56B755E9E4BB3EB0408F0F1C3A13C9
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\README.txttext
MD5:E2F387B53A340A507BBB2A28D7917484
SHA256:A2B79E73F4F317AD3F44A383722F05E739CF260C49E54AD6B7001CB7AF6BD252
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\net_updater64.exeexecutable
MD5:5501D592F6FB8EAA9C7FEB1869221C89
SHA256:5FBF85A022726CD979C585497A7D74FF164C99D55E9756F6BAAD201A01684497
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\hola_svc.exeexecutable
MD5:B0887F38A8E89114A3BC6A883D684B71
SHA256:32BCCB64D963F592FBA92A055AF8324CE6410E66F51A08CBF4BFFD90DF8225A0
4520Hola-Setup-x64-1.243.946.exeC:\Program Files\Hola\app\7zr.exeexecutable
MD5:27EEF377EAED02901EDEB3BFF0E9B2E4
SHA256:E8A2AEB6F13E19F96ED9B8BFC5D70E58FC5B678D1C1028B14E2D5A6F6FD5FB3C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
115
TCP/UDP connections
349
DNS requests
232
Threats
78

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1036
net_updater64.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
436
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
2680
net_updater64.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
whitelisted
2680
net_updater64.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D
unknown
—
—
whitelisted
764
lsass.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQC17O9RFLIgInyjuvDJBQKa
unknown
—
—
whitelisted
1036
net_updater64.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D
unknown
—
—
whitelisted
4476
hola_svc.exe
GET
200
142.250.186.36:80
http://www.google.com/blank.html
unknown
—
—
whitelisted
4476
hola_svc.exe
GET
200
142.250.186.36:80
http://www.google.com/blank.html
unknown
—
—
whitelisted
7544
hola.exe
GET
200
54.243.128.120:80
http://client.hola.org/client_cgi/win_settings.json?ver=1.243.946&user_id=&uuid=win-cd473e508ec241c1a856d61469da55fa
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4172
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3632
Hola-Setup-C-HPE.exe
34.237.179.253:443
perr.hola.org
AMAZON-AES
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3632
Hola-Setup-C-HPE.exe
54.225.121.9:443
hola.org
AMAZON-AES
US
whitelisted
3676
Hola-Setup-C-HPE.exe
54.225.121.9:443
hola.org
AMAZON-AES
US
whitelisted
5372
Hola-Setup-C-HPE.exe
54.225.121.9:443
hola.org
AMAZON-AES
US
whitelisted
3676
Hola-Setup-C-HPE.exe
34.237.179.253:443
perr.hola.org
AMAZON-AES
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
perr.hola.org
  • 34.237.179.253
  • 23.22.252.240
whitelisted
hola.org
  • 54.225.121.9
  • 107.22.193.119
whitelisted
hola-rmt-update.b-cdn.net
  • 138.199.37.225
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.5
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.65
  • 20.190.160.128
  • 40.126.31.131
  • 40.126.31.0
  • 40.126.31.67
  • 40.126.31.129
  • 40.126.31.71
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.hola.org
  • 54.225.227.202
  • 54.243.128.120
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
—
—
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
Process
Message
hola_cr.exe
RecursiveDirectoryCreate( C:\\Users\\admin\\AppData\\Roaming\ directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Hola-Setup-C-HPE.exe