Malware analysis https://cdn4.hola.org/static/v2/Hola-Setup-C-HPE.exe?web_installer_v2=1.227.226&product=vpn Malicious activity

analyze malware

Huge database of samples and IOCs
Custom VM setup
Unlimited submissions
Interactive approach

Add for printing

URL:	https://cdn4.hola.org/static/v2/Hola-Setup-C-HPE.exe?web_installer_v2=1.227.226&product=vpn
Full analysis:	https://app.any.run/tasks/efc55bfa-cf81-4153-b4f3-2ae4e3ec6c98
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Malware Trends Tracker >>>
Analysis date:	January 10, 2025 at 22:49:46
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	evasion loader
Indicators:
MD5:	3927D0BE52F0AE4F0032DE75EE67957E
SHA1:	5699C09E9B556D27D8B89BDA3BBD7D7582FC2B53
SHA256:	F4C858A7F7EF1D14786045D185586B96970121211846BBC74903E2506702328D
SSDEEP:	3:N8cDLoHKELnIA3iJOXaYpcY1:2cDUj53qOXTeY1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 6368)
- Application launched itself
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - hola_svc.exe (PID: 6920)
  - hola_cr.exe (PID: 5036)
  - hola_cr.exe (PID: 5212)
- Executable content was dropped or overwritten
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 7740)
  - 7zr.exe (PID: 1468)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
- Drops 7-zip archiver for unpacking
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
- Drops a system driver (possible attempt to evade defenses)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
- Creates a software uninstall entry
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
- Checks Windows Trust Settings
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 7740)
  - net_updater64.exe (PID: 10004)
- The process drops C-runtime libraries
  - net_updater64.exe (PID: 6284)
- Process drops legitimate windows executable
  - net_updater64.exe (PID: 6284)
- Executes as Windows Service
  - net_updater64.exe (PID: 7444)
  - hola_svc.exe (PID: 6920)
  - WmiApSrv.exe (PID: 7136)
- Detected use of alternative data streams (AltDS)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 7740)
  - net_updater64.exe (PID: 10004)
- Creates file in the systems drive root
  - hola_svc.exe (PID: 6920)
- The process checks if it is being run in the virtual environment
  - net_updater64.exe (PID: 7444)
  - hola_cr.exe (PID: 5212)
- Checks for external IP
  - net_updater64.exe (PID: 7444)
- Potential Corporate Privacy Violation
  - net_updater64.exe (PID: 7444)
- Connects to unusual port
  - hola_svc.exe (PID: 6920)
- Process requests binary or script from the Internet
  - hola.exe (PID: 7336)
- Windows service management via SC.EXE
  - sc.exe (PID: 2040)
  - sc.exe (PID: 3140)
  - sc.exe (PID: 6756)
  - sc.exe (PID: 2776)
  - sc.exe (PID: 7064)
  - sc.exe (PID: 7700)
  - sc.exe (PID: 1704)
  - sc.exe (PID: 3040)
  - sc.exe (PID: 1356)
  - sc.exe (PID: 6460)
  - sc.exe (PID: 2132)
  - sc.exe (PID: 4500)
  - sc.exe (PID: 7664)
  - sc.exe (PID: 5028)
  - sc.exe (PID: 2392)
  - sc.exe (PID: 6736)
  - sc.exe (PID: 7584)
  - sc.exe (PID: 6288)
  - sc.exe (PID: 6876)
  - sc.exe (PID: 2828)
  - sc.exe (PID: 7924)
  - sc.exe (PID: 7620)
  - sc.exe (PID: 7080)
  - sc.exe (PID: 7564)
  - sc.exe (PID: 8928)
  - sc.exe (PID: 6480)
  - sc.exe (PID: 6308)
  - sc.exe (PID: 6304)
  - sc.exe (PID: 7704)
  - sc.exe (PID: 6560)
  - sc.exe (PID: 8136)
  - sc.exe (PID: 3364)
  - sc.exe (PID: 6188)
  - sc.exe (PID: 8924)
  - sc.exe (PID: 6516)
  - sc.exe (PID: 3544)
  - sc.exe (PID: 6328)
  - sc.exe (PID: 6856)
  - sc.exe (PID: 7676)
  - sc.exe (PID: 4512)
  - sc.exe (PID: 6908)
  - sc.exe (PID: 6660)
  - sc.exe (PID: 6400)
  - sc.exe (PID: 6592)
  - sc.exe (PID: 2280)
  - sc.exe (PID: 5032)
  - sc.exe (PID: 8908)
  - sc.exe (PID: 6924)
  - sc.exe (PID: 396)
  - sc.exe (PID: 6676)
  - sc.exe (PID: 7864)
  - sc.exe (PID: 1140)
  - sc.exe (PID: 6816)
  - sc.exe (PID: 3568)
  - sc.exe (PID: 1200)
  - sc.exe (PID: 7528)
  - sc.exe (PID: 7536)
  - sc.exe (PID: 7680)
  - sc.exe (PID: 5096)
  - sc.exe (PID: 1576)
  - sc.exe (PID: 732)
  - sc.exe (PID: 5192)
  - sc.exe (PID: 6572)
  - sc.exe (PID: 6908)
- Starts SC.EXE for service management
  - hola_svc.exe (PID: 6920)
INFO
- Disables trace logs
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - net_updater64.exe (PID: 7444)
  - rasdial.exe (PID: 7684)
  - rasdial.exe (PID: 8180)
  - rasdial.exe (PID: 7292)
  - rasdial.exe (PID: 7480)
  - rasdial.exe (PID: 8220)
  - rasdial.exe (PID: 8468)
  - rasdial.exe (PID: 8828)
  - rasdial.exe (PID: 8380)
  - rasdial.exe (PID: 9844)
  - rasdial.exe (PID: 9576)
  - rasdial.exe (PID: 4164)
  - rasdial.exe (PID: 9500)
  - rasdial.exe (PID: 8924)
  - rasdial.exe (PID: 9636)
  - rasdial.exe (PID: 9552)
  - rasdial.exe (PID: 9400)
  - rasdial.exe (PID: 9936)
  - rasdial.exe (PID: 9504)
  - rasdial.exe (PID: 9484)
  - rasdial.exe (PID: 7752)
  - rasdial.exe (PID: 9124)
  - rasdial.exe (PID: 10160)
  - rasdial.exe (PID: 9520)
  - rasdial.exe (PID: 4520)
  - rasdial.exe (PID: 8900)
  - rasdial.exe (PID: 8380)
  - rasdial.exe (PID: 8564)
  - rasdial.exe (PID: 8252)
  - rasdial.exe (PID: 9692)
  - rasdial.exe (PID: 6624)
  - rasdial.exe (PID: 5028)
  - rasdial.exe (PID: 6856)
  - rasdial.exe (PID: 6764)
  - rasdial.exe (PID: 9308)
  - rasdial.exe (PID: 9660)
  - rasdial.exe (PID: 8536)
  - rasdial.exe (PID: 10200)
  - rasdial.exe (PID: 8520)
  - rasdial.exe (PID: 9800)
  - rasdial.exe (PID: 7236)
  - rasdial.exe (PID: 6376)
  - rasdial.exe (PID: 3680)
  - rasdial.exe (PID: 8564)
  - rasdial.exe (PID: 9872)
  - rasdial.exe (PID: 7380)
  - rasdial.exe (PID: 8716)
  - rasdial.exe (PID: 6908)
  - rasdial.exe (PID: 8864)
  - rasdial.exe (PID: 6380)
  - rasdial.exe (PID: 9356)
  - rasdial.exe (PID: 6288)
  - rasdial.exe (PID: 9776)
  - rasdial.exe (PID: 3124)
  - rasdial.exe (PID: 8424)
  - rasdial.exe (PID: 2212)
  - rasdial.exe (PID: 9268)
  - rasdial.exe (PID: 8148)
  - rasdial.exe (PID: 2040)
  - rasdial.exe (PID: 8352)
  - rasdial.exe (PID: 6500)
  - rasdial.exe (PID: 4504)
  - rasdial.exe (PID: 2312)
  - rasdial.exe (PID: 9452)
  - rasdial.exe (PID: 9516)
  - rasdial.exe (PID: 10108)
  - rasdial.exe (PID: 9580)
- Reads the computer name
  - identity_helper.exe (PID: 7844)
  - identity_helper.exe (PID: 1944)
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - identity_helper.exe (PID: 4076)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - net_updater64.exe (PID: 6284)
  - test_wpf.exe (PID: 6416)
  - net_updater64.exe (PID: 6368)
  - test_wpf.exe (PID: 5588)
  - net_updater64.exe (PID: 7740)
  - test_wpf.exe (PID: 7700)
  - idle_report.exe (PID: 7572)
  - hola_cr.exe (PID: 5212)
  - hola_cr.exe (PID: 5036)
  - hola_cr.exe (PID: 6220)
  - net_updater64.exe (PID: 10004)
  - hola_cr.exe (PID: 8088)
  - idle_report.exe (PID: 6524)
- Create files in a temporary directory
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
  - Hola-Setup-x64-1.233.367.exe (PID: 6548)
  - hola_cr.exe (PID: 5212)
- Executable content was dropped or overwritten
  - msedge.exe (PID: 3220)
  - msedge.exe (PID: 6504)
- Reads Environment values
  - identity_helper.exe (PID: 7844)
  - identity_helper.exe (PID: 1944)
  - identity_helper.exe (PID: 4076)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 10004)
- Reads the software policy settings
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 7740)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
  - Hola-Setup-x64-1.233.367.exe (PID: 6548)
  - net_updater64.exe (PID: 10004)
- Checks supported languages
  - identity_helper.exe (PID: 1944)
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - identity_helper.exe (PID: 7844)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - identity_helper.exe (PID: 4076)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - test_wpf.exe (PID: 6416)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 7444)
  - test_wpf.exe (PID: 7672)
  - net_updater64.exe (PID: 6368)
  - test_wpf.exe (PID: 5588)
  - idle_report.exe (PID: 7572)
  - hola_svc.exe (PID: 6920)
  - net_updater64.exe (PID: 7740)
  - hola_svc.exe (PID: 4244)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
  - Hola-Setup-x64-1.233.367.exe (PID: 6548)
  - hola.exe (PID: 7336)
  - hola_cr.exe (PID: 5212)
  - hola_cr.exe (PID: 6068)
  - hola_cr.exe (PID: 7388)
  - hola_cr.exe (PID: 6220)
  - hola_cr.exe (PID: 7772)
  - hola_cr.exe (PID: 7488)
  - hola_cr.exe (PID: 6468)
  - hola_cr.exe (PID: 6540)
  - hola_cr.exe (PID: 4076)
  - hola_cr.exe (PID: 6996)
  - hola_cr.exe (PID: 8328)
  - hola_cr.exe (PID: 6812)
  - hola_cr.exe (PID: 8620)
  - identity_helper.exe (PID: 8440)
  - hola_cr.exe (PID: 9816)
  - net_updater64.exe (PID: 10004)
  - hola_cr.exe (PID: 4280)
  - idle_report.exe (PID: 8784)
  - hola_cr.exe (PID: 9856)
  - hola_cr.exe (PID: 5588)
  - hola_cr.exe (PID: 8976)
  - hola_cr.exe (PID: 3692)
- Reads the machine GUID from the registry
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - net_updater64.exe (PID: 6284)
  - test_wpf.exe (PID: 6416)
  - test_wpf.exe (PID: 7672)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - test_wpf.exe (PID: 5588)
  - idle_report.exe (PID: 7572)
  - test_wpf.exe (PID: 7700)
  - net_updater64.exe (PID: 7740)
  - hola_svc.exe (PID: 6920)
  - hola_cr.exe (PID: 5212)
  - net_updater64.exe (PID: 10004)
  - test_wpf.exe (PID: 8568)
  - idle_report.exe (PID: 6524)
- Application launched itself
  - msedge.exe (PID: 3220)
  - msedge.exe (PID: 3140)
  - msedge.exe (PID: 3808)
  - msedge.exe (PID: 8952)
- The process uses the downloaded file
  - msedge.exe (PID: 3220)
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - net_updater64.exe (PID: 6284)
  - explorer.exe (PID: 3888)
- Checks proxy server information
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-C-HPE.exe (PID: 6820)
  - hola_cr.exe (PID: 5212)
- Process checks computer location settings
  - Hola-Setup-C-HPE.exe (PID: 3532)
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - net_updater64.exe (PID: 7740)
  - hola_cr.exe (PID: 6468)
  - hola_cr.exe (PID: 6540)
  - hola_cr.exe (PID: 4076)
  - hola_cr.exe (PID: 6996)
  - hola_cr.exe (PID: 8328)
  - hola_cr.exe (PID: 8620)
  - hola_cr.exe (PID: 9816)
- The sample compiled with english language support
  - Hola-Setup-C-HPE.exe (PID: 7372)
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - net_updater64.exe (PID: 6284)
  - 7zr.exe (PID: 1468)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
- Creates files in the program directory
  - Hola-Setup-x64-1.233.367.exe (PID: 6868)
  - net_updater64.exe (PID: 6284)
  - net_updater64.exe (PID: 7444)
  - net_updater64.exe (PID: 6368)
  - hola_svc.exe (PID: 6920)
  - net_updater64.exe (PID: 7740)
  - 7zr.exe (PID: 1468)
  - Hola-Setup-x64-1.233.367.exe (PID: 1220)
  - hola.exe (PID: 7336)
  - net_updater64.exe (PID: 10004)
- Reads the time zone
  - net_updater64.exe (PID: 7444)
- Reads CPU info
  - net_updater64.exe (PID: 7444)
- Reads security settings of Internet Explorer
  - explorer.exe (PID: 3888)
- Sends debugging messages
  - hola_cr.exe (PID: 5212)
- Creates files or folders in the user directory
  - hola_cr.exe (PID: 5212)
  - hola_cr.exe (PID: 6220)
  - hola_cr.exe (PID: 5036)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

645

Monitored processes

508

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

3220

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://cdn4.hola.org/static/v2/Hola-Setup-C-HPE.exe?web_installer_v2=1.227.226&product=vpn"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6292

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x30c,0x310,0x314,0x308,0x31c,0x7ff818545fd8,0x7ff818545fe4,0x7ff818545ff0

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6496

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2332 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6504

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6524

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2672 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6756

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3456 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6780

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3608 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6912

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4100 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6920

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6968

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5248 --field-trial-handle=2336,i,9439711685360483414,18231597846499928934,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

80 569

Read events

80 345

Write events

220

Delete events

Modification events


(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(3220) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: 73A71832F8892F00
(PID) Process:	(3220) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: AF142432F8892F00
(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328432
Operation:	write	Name:	WindowTabManagerFileMappingId
Value: {E088F868-661F-4E4F-883A-BD2992CD1259}
(PID) Process:	(7588) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:	write	Name:	{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value: 0100000000000000B04B49F9B163DB01
(PID) Process:	(3220) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:	write	Name:	S-1-5-21-1693682860-607145093-2874071422-1001
Value: AF3D9932F8892F00
(PID) Process:	(3220) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start

Add for printing

Executable files

Suspicious files

874

Text files

238

Unknown types

Dropped files

PID	Process	Filename		Type
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF13577a.TMP		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF13577a.TMP		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF13577a.TMP		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135789.TMP		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135789.TMP		—
		MD5:—	SHA256:—
3220	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

379

DNS requests

353

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3220	msedge.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D	unknown	—	—	whitelisted
3220	msedge.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAXrhBDPOQ2gaSPA09Ycq3A%3D	unknown	—	—	whitelisted
6920	hola_svc.exe	GET	200	142.250.185.132:80	http://142.250.185.132:80/blank.html	unknown	—	—	whitelisted
7444	net_updater64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAdTF0YC22Gdh8cnyPwWxE0%3D	unknown	—	—	whitelisted
5208	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5208	svchost.exe	GET	200	23.32.238.90:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
7444	net_updater64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D	unknown	—	—	whitelisted
6920	hola_svc.exe	GET	200	142.250.185.132:80	http://www.google.com/blank.html	unknown	—	—	whitelisted
7444	net_updater64.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5208	svchost.exe	23.32.238.90:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4712	MoUsoCoreWorker.exe	23.32.238.90:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5208	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4712	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5064	SearchApp.exe	104.126.37.163:443	www.bing.com	Akamai International B.V.	DE	whitelisted
6504	msedge.exe	13.107.42.16:443	config.edge.skype.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
3220	msedge.exe	239.255.255.250:1900	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
crl.microsoft.com	23.32.238.90 2.19.198.43 23.32.238.107 23.32.238.123 23.32.238.88 23.32.238.106 2.19.198.42	whitelisted
www.microsoft.com	184.30.21.171 23.35.229.160	whitelisted
google.com	142.250.185.174	whitelisted
www.bing.com	104.126.37.163 104.126.37.185 104.126.37.179 104.126.37.160 104.126.37.131 104.126.37.162 104.126.37.186 104.126.37.171 104.126.37.177 104.126.37.176 104.126.37.178 104.126.37.130 104.126.37.139 104.126.37.129 104.126.37.123 104.126.37.128 2.23.227.208 2.23.227.215	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted
cdn4.hola.org	169.150.247.36 169.150.247.38	whitelisted
edge.microsoft.com	204.79.197.239 13.107.21.239	whitelisted
business.bing.com	13.107.6.158	whitelisted
edge-mobile-static.azureedge.net	13.107.246.45	whitelisted

Threats

PID	Process	Class	Message
—	—	Misc activity	ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
—	—	Misc activity	ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI

2 ETPRO signatures available at the full report

Add for printing

Process	Message
hola_cr.exe	RecursiveDirectoryCreate( C:\\Users\\admin\\AppData\\Roaming\ directory exists )

General Info

https://cdn4.hola.org/static/v2/Hola-Setup-C-HPE.exe?web_installer_v2=1.227.226&product=vpn

3927D0BE52F0AE4F0032DE75EE67957E

5699C09E9B556D27D8B89BDA3BBD7D7582FC2B53

F4C858A7F7EF1D14786045D185586B96970121211846BBC74903E2506702328D

3:N8cDLoHKELnIA3iJOXaYpcY1:2cDUj53qOXTeY1

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SUSPICIOUS

Reads security settings of Internet Explorer

Application launched itself

Executable content was dropped or overwritten

Drops 7-zip archiver for unpacking

Drops a system driver (possible attempt to evade defenses)

Creates a software uninstall entry

Checks Windows Trust Settings

The process drops C-runtime libraries

Process drops legitimate windows executable

Executes as Windows Service

Detected use of alternative data streams (AltDS)

Creates file in the systems drive root

The process checks if it is being run in the virtual environment

Checks for external IP

Potential Corporate Privacy Violation

Connects to unusual port

Process requests binary or script from the Internet

Windows service management via SC.EXE

Starts SC.EXE for service management

INFO

Disables trace logs

Reads the computer name

Create files in a temporary directory

Executable content was dropped or overwritten

Reads Environment values

Reads the software policy settings

Checks supported languages

Reads the machine GUID from the registry

Application launched itself

The process uses the downloaded file

Checks proxy server information

Process checks computer location settings

The sample compiled with english language support

Creates files in the program directory

Reads the time zone

Reads CPU info

Reads security settings of Internet Explorer

Sends debugging messages

Creates files or folders in the user directory

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules