URL:

zagent2570.hola.org

Full analysis: https://app.any.run/tasks/25d87da9-e693-4935-bf6e-82da1588eda1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 10, 2025, 13:00:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
evasion
loader
Indicators:
MD5:

52C62010A21AB7D849E499B705B2967D

SHA1:

115FE944BCB235A891E0DA1ADA008AB3FA9D832C

SHA256:

FB8C4D3004338D5C5F933C3D06987425E483D31D101461F4A1C228F3E9B50FFB

SSDEEP:

3:8RbSc:EbP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • msedge.exe (PID: 5744)
      • msedge.exe (PID: 4980)

    • Changes the autorun value in the registry

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7808)

    • Application launched itself

      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 7796)
      • hola_svc.exe (PID: 7472)
      • hola_cr.exe (PID: 8212)
      • hola_cr.exe (PID: 5172)

    • Drops 7-zip archiver for unpacking

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)

    • Creates a software uninstall entry

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)

    • Executable content was dropped or overwritten

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7324)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • net_updater64.exe (PID: 7808)
      • net_updater64.exe (PID: 7508)
      • 7zr.exe (PID: 8640)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • net_updater64.exe (PID: 8936)

    • Drops a system driver (possible attempt to evade defenses)

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)

    • The process drops C-runtime libraries

      • net_updater64.exe (PID: 4336)

    • Process drops legitimate windows executable

      • net_updater64.exe (PID: 4336)

    • Executes as Windows Service

      • net_updater64.exe (PID: 7324)
      • hola_svc.exe (PID: 7472)
      • WmiApSrv.exe (PID: 8356)

    • Detected use of alternative data streams (AltDS)

      • net_updater64.exe (PID: 7808)
      • net_updater64.exe (PID: 7324)
      • net_updater64.exe (PID: 7508)
      • net_updater64.exe (PID: 8936)

    • Creates file in the systems drive root

      • hola_svc.exe (PID: 7472)

    • Checks for external IP

      • net_updater64.exe (PID: 7324)

    • Connects to unusual port

      • hola_svc.exe (PID: 7472)

    • The process checks if it is being run in the virtual environment

      • net_updater64.exe (PID: 7324)
      • hola_cr.exe (PID: 5172)

    • Process requests binary or script from the Internet

      • hola.exe (PID: 9040)

    • Windows service management via SC.EXE

      • sc.exe (PID: 2896)
      • sc.exe (PID: 8372)
      • sc.exe (PID: 8796)
      • sc.exe (PID: 3240)
      • sc.exe (PID: 8916)
      • sc.exe (PID: 8988)
      • sc.exe (PID: 9164)
      • sc.exe (PID: 8936)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 9032)
      • sc.exe (PID: 8696)
      • sc.exe (PID: 8584)
      • sc.exe (PID: 7620)
      • sc.exe (PID: 6892)
      • sc.exe (PID: 8960)
      • sc.exe (PID: 9156)
      • sc.exe (PID: 9212)
      • sc.exe (PID: 7832)
      • sc.exe (PID: 7232)
      • sc.exe (PID: 8464)
      • sc.exe (PID: 2796)
      • sc.exe (PID: 540)
      • sc.exe (PID: 8404)
      • sc.exe (PID: 8732)
      • sc.exe (PID: 7844)
      • sc.exe (PID: 7744)
      • sc.exe (PID: 8700)
      • sc.exe (PID: 7936)
      • sc.exe (PID: 5376)
      • sc.exe (PID: 9284)
      • sc.exe (PID: 9232)
      • sc.exe (PID: 9240)
      • sc.exe (PID: 9264)
      • sc.exe (PID: 9292)
      • sc.exe (PID: 8380)
      • sc.exe (PID: 8712)
      • sc.exe (PID: 4728)
      • sc.exe (PID: 8568)
      • sc.exe (PID: 7376)
      • sc.exe (PID: 9308)
      • sc.exe (PID: 9332)
      • sc.exe (PID: 9340)
      • sc.exe (PID: 9408)
      • sc.exe (PID: 9368)
      • sc.exe (PID: 9464)
      • sc.exe (PID: 9452)
      • sc.exe (PID: 9428)
      • sc.exe (PID: 9488)
      • sc.exe (PID: 9508)
      • sc.exe (PID: 9532)
      • sc.exe (PID: 9540)
      • sc.exe (PID: 9576)
      • sc.exe (PID: 9316)
      • sc.exe (PID: 9324)
      • sc.exe (PID: 9356)
      • sc.exe (PID: 9388)
      • sc.exe (PID: 9568)
      • sc.exe (PID: 9628)
      • sc.exe (PID: 9664)
      • sc.exe (PID: 9708)
      • sc.exe (PID: 11128)
      • sc.exe (PID: 9600)
      • sc.exe (PID: 9612)
      • sc.exe (PID: 9648)

    • Starts SC.EXE for service management

      • hola_svc.exe (PID: 7472)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 5744)

    • Checks supported languages

      • identity_helper.exe (PID: 7364)
      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • test_wpf.exe (PID: 6656)
      • net_updater64.exe (PID: 7324)
      • test_wpf.exe (PID: 7788)
      • test_wpf.exe (PID: 5968)
      • net_updater64.exe (PID: 7808)
      • hola_svc.exe (PID: 7472)
      • hola_svc.exe (PID: 8104)
      • idle_report.exe (PID: 7468)
      • test_wpf.exe (PID: 8248)
      • net_updater64.exe (PID: 7508)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • 7zr.exe (PID: 8640)
      • Hola-Setup-x64-1.233.367.exe (PID: 8924)
      • hola.exe (PID: 9040)
      • hola_cr.exe (PID: 5172)
      • hola_cr.exe (PID: 8236)
      • hola_cr.exe (PID: 8212)
      • hola_cr.exe (PID: 8392)
      • hola_cr.exe (PID: 8348)
      • hola_cr.exe (PID: 6752)
      • hola_cr.exe (PID: 7672)
      • hola_cr.exe (PID: 7916)
      • hola_cr.exe (PID: 8580)
      • hola_cr.exe (PID: 8604)
      • hola_cr.exe (PID: 8612)
      • hola_cr.exe (PID: 8944)
      • hola_cr.exe (PID: 8952)
      • hola_cr.exe (PID: 5200)
      • hola_cr.exe (PID: 5036)
      • hola_cr.exe (PID: 6640)
      • hola_cr.exe (PID: 8372)
      • hola_svc.exe (PID: 3028)
      • hola_cr.exe (PID: 8932)
      • hola_cr.exe (PID: 8784)
      • hola_cr.exe (PID: 7800)
      • net_updater64.exe (PID: 8936)
      • hola_cr.exe (PID: 11012)
      • hola_cr.exe (PID: 9236)
      • hola_cr.exe (PID: 9536)
      • hola_cr.exe (PID: 5380)
      • test_wpf.exe (PID: 10612)
      • hola_cr.exe (PID: 11256)
      • idle_report.exe (PID: 11244)
      • hola_cr.exe (PID: 10828)
      • hola_svc.exe (PID: 9552)
      • hola_cr.exe (PID: 8512)
      • hola_cr.exe (PID: 8828)
      • hola_cr.exe (PID: 10088)
      • idle_report.exe (PID: 10340)
      • hola_cr.exe (PID: 7744)
      • hola_svc.exe (PID: 10192)
      • hola_cr.exe (PID: 9404)
      • hola_cr.exe (PID: 10736)
      • idle_report.exe (PID: 10040)
      • hola_cr.exe (PID: 6372)
      • hola_cr.exe (PID: 9340)
      • hola_svc.exe (PID: 9148)

    • Reads the computer name

      • identity_helper.exe (PID: 7364)
      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • test_wpf.exe (PID: 6656)
      • net_updater64.exe (PID: 7324)
      • test_wpf.exe (PID: 7788)
      • net_updater64.exe (PID: 7808)
      • test_wpf.exe (PID: 5968)
      • hola_svc.exe (PID: 7472)
      • net_updater64.exe (PID: 7508)
      • idle_report.exe (PID: 7468)
      • test_wpf.exe (PID: 8248)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • 7zr.exe (PID: 8640)
      • Hola-Setup-x64-1.233.367.exe (PID: 8924)
      • hola.exe (PID: 9040)
      • hola_cr.exe (PID: 8212)
      • hola_cr.exe (PID: 5172)
      • hola_cr.exe (PID: 8392)
      • hola_cr.exe (PID: 8348)
      • hola_cr.exe (PID: 7672)
      • hola_cr.exe (PID: 7800)
      • net_updater64.exe (PID: 8936)
      • test_wpf.exe (PID: 10612)
      • idle_report.exe (PID: 11244)
      • idle_report.exe (PID: 10340)
      • hola_cr.exe (PID: 7916)
      • idle_report.exe (PID: 10040)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 4980)
      • msedge.exe (PID: 5744)
      • msedge.exe (PID: 7764)

    • Reads the machine GUID from the registry

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • net_updater64.exe (PID: 4336)
      • test_wpf.exe (PID: 6656)
      • net_updater64.exe (PID: 7324)
      • test_wpf.exe (PID: 7788)
      • net_updater64.exe (PID: 7808)
      • test_wpf.exe (PID: 5968)
      • hola_svc.exe (PID: 7472)
      • net_updater64.exe (PID: 7508)
      • test_wpf.exe (PID: 8248)
      • idle_report.exe (PID: 7468)
      • hola_cr.exe (PID: 5172)
      • net_updater64.exe (PID: 8936)
      • test_wpf.exe (PID: 10612)
      • idle_report.exe (PID: 11244)
      • idle_report.exe (PID: 10340)
      • hola_cr.exe (PID: 7916)
      • idle_report.exe (PID: 10040)

    • Autorun file from Downloads

      • msedge.exe (PID: 7988)
      • msedge.exe (PID: 5744)

    • Disables trace logs

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • net_updater64.exe (PID: 7324)
      • rasdial.exe (PID: 3620)
      • hola_svc.exe (PID: 7472)
      • rasdial.exe (PID: 9144)
      • rasdial.exe (PID: 6656)
      • rasdial.exe (PID: 5132)
      • rasdial.exe (PID: 8988)
      • rasdial.exe (PID: 7376)
      • rasdial.exe (PID: 5796)
      • rasdial.exe (PID: 6032)
      • rasdial.exe (PID: 8096)
      • rasdial.exe (PID: 8964)
      • rasdial.exe (PID: 3132)
      • rasdial.exe (PID: 7144)
      • rasdial.exe (PID: 9204)
      • rasdial.exe (PID: 8724)
      • rasdial.exe (PID: 10752)
      • rasdial.exe (PID: 11184)
      • rasdial.exe (PID: 10624)
      • rasdial.exe (PID: 7232)
      • rasdial.exe (PID: 10868)
      • rasdial.exe (PID: 11056)
      • rasdial.exe (PID: 9364)
      • rasdial.exe (PID: 10360)
      • rasdial.exe (PID: 10780)
      • rasdial.exe (PID: 9208)
      • rasdial.exe (PID: 10720)
      • rasdial.exe (PID: 10888)
      • rasdial.exe (PID: 10756)
      • rasdial.exe (PID: 9328)
      • rasdial.exe (PID: 10040)
      • rasdial.exe (PID: 9528)
      • rasdial.exe (PID: 11044)
      • rasdial.exe (PID: 5188)
      • rasdial.exe (PID: 5780)
      • rasdial.exe (PID: 9880)
      • rasdial.exe (PID: 10792)
      • rasdial.exe (PID: 9920)
      • rasdial.exe (PID: 5952)
      • rasdial.exe (PID: 8620)
      • rasdial.exe (PID: 9780)
      • rasdial.exe (PID: 9488)
      • rasdial.exe (PID: 10200)
      • rasdial.exe (PID: 10628)
      • rasdial.exe (PID: 9164)
      • rasdial.exe (PID: 10148)
      • rasdial.exe (PID: 10724)
      • rasdial.exe (PID: 9752)
      • rasdial.exe (PID: 9400)
      • rasdial.exe (PID: 10156)
      • rasdial.exe (PID: 9964)
      • rasdial.exe (PID: 10664)
      • rasdial.exe (PID: 8816)
      • rasdial.exe (PID: 8868)
      • rasdial.exe (PID: 8404)
      • rasdial.exe (PID: 9480)
      • rasdial.exe (PID: 9272)
      • rasdial.exe (PID: 4728)
      • rasdial.exe (PID: 9896)
      • rasdial.exe (PID: 6468)
      • rasdial.exe (PID: 9184)
      • rasdial.exe (PID: 11248)
      • rasdial.exe (PID: 9584)
      • rasdial.exe (PID: 10360)
      • rasdial.exe (PID: 9284)
      • rasdial.exe (PID: 9884)
      • rasdial.exe (PID: 9496)
      • rasdial.exe (PID: 10180)
      • rasdial.exe (PID: 10532)
      • rasdial.exe (PID: 2968)
      • rasdial.exe (PID: 8716)
      • rasdial.exe (PID: 11228)
      • rasdial.exe (PID: 9680)
      • rasdial.exe (PID: 9424)
      • rasdial.exe (PID: 9304)
      • rasdial.exe (PID: 9924)
      • rasdial.exe (PID: 9676)
      • rasdial.exe (PID: 8736)
      • rasdial.exe (PID: 9640)
      • rasdial.exe (PID: 9824)
      • rasdial.exe (PID: 8936)
      • rasdial.exe (PID: 5512)
      • rasdial.exe (PID: 10648)
      • rasdial.exe (PID: 9476)
      • rasdial.exe (PID: 4348)
      • rasdial.exe (PID: 4560)
      • rasdial.exe (PID: 9672)
      • rasdial.exe (PID: 8160)
      • rasdial.exe (PID: 10876)
      • rasdial.exe (PID: 4728)
      • rasdial.exe (PID: 9468)
      • rasdial.exe (PID: 8468)
      • rasdial.exe (PID: 2796)
      • rasdial.exe (PID: 10980)
      • rasdial.exe (PID: 10520)
      • rasdial.exe (PID: 11256)
      • rasdial.exe (PID: 9884)
      • rasdial.exe (PID: 7892)
      • rasdial.exe (PID: 9984)
      • rasdial.exe (PID: 9992)
      • rasdial.exe (PID: 8892)
      • rasdial.exe (PID: 6148)
      • rasdial.exe (PID: 10700)
      • rasdial.exe (PID: 9052)
      • rasdial.exe (PID: 10656)
      • rasdial.exe (PID: 11104)
      • rasdial.exe (PID: 6268)
      • rasdial.exe (PID: 10032)
      • rasdial.exe (PID: 11056)
      • rasdial.exe (PID: 10580)
      • rasdial.exe (PID: 10260)
      • rasdial.exe (PID: 2664)
      • rasdial.exe (PID: 9440)
      • rasdial.exe (PID: 10344)
      • rasdial.exe (PID: 9936)
      • rasdial.exe (PID: 5500)
      • rasdial.exe (PID: 10464)
      • rasdial.exe (PID: 6708)
      • rasdial.exe (PID: 6632)
      • rasdial.exe (PID: 10832)
      • rasdial.exe (PID: 10204)
      • rasdial.exe (PID: 10968)
      • rasdial.exe (PID: 10144)
      • rasdial.exe (PID: 10592)
      • rasdial.exe (PID: 6908)
      • rasdial.exe (PID: 7224)
      • rasdial.exe (PID: 9564)
      • rasdial.exe (PID: 9892)
      • rasdial.exe (PID: 6132)
      • rasdial.exe (PID: 8620)
      • rasdial.exe (PID: 9104)
      • rasdial.exe (PID: 10164)
      • rasdial.exe (PID: 11148)
      • rasdial.exe (PID: 9432)
      • rasdial.exe (PID: 8020)
      • rasdial.exe (PID: 7800)
      • rasdial.exe (PID: 10952)
      • rasdial.exe (PID: 10628)
      • rasdial.exe (PID: 10516)
      • rasdial.exe (PID: 7448)
      • rasdial.exe (PID: 10108)
      • rasdial.exe (PID: 10552)
      • rasdial.exe (PID: 9880)
      • rasdial.exe (PID: 10756)
      • rasdial.exe (PID: 2408)
      • rasdial.exe (PID: 11000)
      • rasdial.exe (PID: 9280)
      • rasdial.exe (PID: 10196)
      • rasdial.exe (PID: 9200)
      • rasdial.exe (PID: 5304)
      • rasdial.exe (PID: 10688)
      • rasdial.exe (PID: 10856)
      • rasdial.exe (PID: 10260)
      • rasdial.exe (PID: 10980)
      • rasdial.exe (PID: 9316)
      • rasdial.exe (PID: 10452)
      • rasdial.exe (PID: 11112)
      • rasdial.exe (PID: 8864)
      • rasdial.exe (PID: 10660)
      • rasdial.exe (PID: 8748)
      • rasdial.exe (PID: 5796)
      • rasdial.exe (PID: 7824)
      • rasdial.exe (PID: 10588)
      • rasdial.exe (PID: 10440)
      • rasdial.exe (PID: 8296)
      • rasdial.exe (PID: 9424)
      • rasdial.exe (PID: 11168)
      • rasdial.exe (PID: 10928)
      • rasdial.exe (PID: 11032)
      • rasdial.exe (PID: 10824)
      • rasdial.exe (PID: 11108)
      • rasdial.exe (PID: 10108)
      • rasdial.exe (PID: 9768)
      • rasdial.exe (PID: 10416)
      • rasdial.exe (PID: 10252)
      • rasdial.exe (PID: 1704)
      • rasdial.exe (PID: 11112)
      • rasdial.exe (PID: 10300)
      • rasdial.exe (PID: 8880)
      • rasdial.exe (PID: 10564)
      • rasdial.exe (PID: 9384)
      • rasdial.exe (PID: 7740)
      • rasdial.exe (PID: 10196)
      • rasdial.exe (PID: 980)
      • rasdial.exe (PID: 9520)
      • rasdial.exe (PID: 908)
      • rasdial.exe (PID: 3080)
      • rasdial.exe (PID: 10216)
      • rasdial.exe (PID: 9864)
      • rasdial.exe (PID: 10436)
      • rasdial.exe (PID: 9628)

    • Reads the software policy settings

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • slui.exe (PID: 7736)
      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7324)
      • net_updater64.exe (PID: 7808)
      • net_updater64.exe (PID: 7508)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • Hola-Setup-x64-1.233.367.exe (PID: 8924)
      • hola.exe (PID: 9040)
      • net_updater64.exe (PID: 8936)
      • slui.exe (PID: 4220)

    • Process checks computer location settings

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7324)
      • net_updater64.exe (PID: 7808)
      • net_updater64.exe (PID: 7508)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • hola_cr.exe (PID: 5172)
      • hola_cr.exe (PID: 8604)
      • hola_cr.exe (PID: 8612)
      • hola_cr.exe (PID: 8932)
      • hola_cr.exe (PID: 8944)
      • hola_cr.exe (PID: 5200)
      • hola_cr.exe (PID: 6640)
      • hola_cr.exe (PID: 5036)
      • hola_cr.exe (PID: 8372)
      • hola_cr.exe (PID: 8784)
      • hola_cr.exe (PID: 11012)
      • net_updater64.exe (PID: 8936)
      • hola_cr.exe (PID: 9536)
      • hola_cr.exe (PID: 9236)
      • hola_cr.exe (PID: 5380)
      • hola_cr.exe (PID: 8952)

    • Create files in a temporary directory

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • Hola-Setup-x64-1.233.367.exe (PID: 8924)
      • hola_cr.exe (PID: 5172)

    • Reads Environment values

      • identity_helper.exe (PID: 7364)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7324)
      • net_updater64.exe (PID: 7808)
      • net_updater64.exe (PID: 7508)
      • net_updater64.exe (PID: 8936)

    • Checks proxy server information

      • Hola-Setup-C-HPE.exe (PID: 7796)
      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-C-HPE.exe (PID: 6208)
      • net_updater64.exe (PID: 4336)
      • hola_cr.exe (PID: 5172)
      • slui.exe (PID: 4220)

    • The sample compiled with english language support

      • Hola-Setup-C-HPE.exe (PID: 1568)
      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • 7zr.exe (PID: 8640)
      • msedge.exe (PID: 7764)

    • Creates files in the program directory

      • Hola-Setup-x64-1.233.367.exe (PID: 1128)
      • net_updater64.exe (PID: 4336)
      • net_updater64.exe (PID: 7324)
      • net_updater64.exe (PID: 7808)
      • hola_svc.exe (PID: 7472)
      • net_updater64.exe (PID: 7508)
      • 7zr.exe (PID: 8640)
      • Hola-Setup-x64-1.233.367.exe (PID: 8592)
      • Hola-Setup-x64-1.233.367.exe (PID: 8924)
      • hola.exe (PID: 9040)
      • net_updater64.exe (PID: 8936)

    • Creates files or folders in the user directory

      • net_updater64.exe (PID: 4336)
      • hola_cr.exe (PID: 5172)
      • hola_cr.exe (PID: 8392)
      • hola_cr.exe (PID: 8212)

    • Reads CPU info

      • net_updater64.exe (PID: 7324)

    • Reads the time zone

      • net_updater64.exe (PID: 7324)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 8996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
814
Monitored processes
674
Malicious processes
12
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #GENERIC msedge.exe msedge.exe no specs msedge.exe no specs #GENERIC msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs hola-setup-c-hpe.exe hola-setup-c-hpe.exe hola-setup-c-hpe.exe msedge.exe no specs msedge.exe no specs hola-setup-x64-1.233.367.exe slui.exe net_updater64.exe conhost.exe no specs test_wpf.exe no specs net_updater64.exe test_wpf.exe no specs net_updater64.exe conhost.exe no specs test_wpf.exe no specs hola_svc.exe net_updater64.exe conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs hola_svc.exe no specs test_wpf.exe no specs wmiapsrv.exe no specs msedge.exe no specs hola-setup-x64-1.233.367.exe 7zr.exe conhost.exe no specs msedge.exe no specs hola-setup-x64-1.233.367.exe explorer.exe no specs explorer.exe no specs hola.exe rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs net_updater64.exe conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs test_wpf.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs hola_cr.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs idle_report.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_svc.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs hola_cr.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs msedge.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs rasdial.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
540sc query luminati_net_updater_org_hola_vpnC:\Windows\System32\sc.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7104 --field-trial-handle=2348,i,15361809225940380347,1491521978254332331,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=7096 --field-trial-handle=2348,i,15361809225940380347,1491521978254332331,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rasdial.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
908rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
980rasdialC:\Windows\System32\rasdial.exe—hola_svc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Remote Access Command Line Dial UI
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rasdial.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
Total events
95 746
Read events
95 564
Write events
178
Delete events
4

Modification events

(PID) Process:(5744) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
1BB3A67402912F00
(PID) Process:(5744) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
3047AF7402912F00
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590336
Operation:writeName:WindowTabManagerFileMappingId
Value:
{603C858D-A767-4691-B8BD-4FAFFBD93A67}
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590336
Operation:writeName:WindowTabManagerFileMappingId
Value:
{EA8871B1-50A8-47AB-945E-1F6559A039B1}
(PID) Process:(5744) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590336
Operation:writeName:WindowTabManagerFileMappingId
Value:
{3C82C9BC-4EF4-440F-9826-DCE117CEB7F5}
(PID) Process:(5744) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
5D68D37402912F00
Executable files
71
Suspicious files
968
Text files
121
Unknown types
3

Dropped files

PID
Process
Filename
Type
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b5b5.TMP —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b5c5.TMP —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b5c5.TMP —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b5c5.TMP —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b5d5.TMP —
MD5:—
SHA256:—
5744msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
151
TCP/UDP connections
383
DNS requests
330
Threats
97

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4980
msedge.exe
GET
—
216.155.134.250:80
http://zagent2570.hola.org/
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4980
msedge.exe
GET
—
216.155.134.250:80
http://zagent2570.hola.org/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6592
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6592
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5744
msedge.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
7204
svchost.exe
HEAD
200
23.50.131.74:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cf34b06a-2f53-4bd0-9d11-b58cf2e820a4?P1=1744697861&P2=404&P3=2&P4=HkF195PEpMZx%2fla3GjpDvMT8Xv8TTxf%2f43Kjd1KFsdE0yeb5XrayPDMLQ42MxO47H2thsnFe0m9qIeS3z7DBaA%3d%3d
unknown
—
—
whitelisted
5744
msedge.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAXrhBDPOQ2gaSPA09Ycq3A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5744
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
4980
msedge.exe
150.171.29.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
13.107.253.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
216.155.134.250:80
zagent2570.hola.org
AS-CHOOPA
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.29.11
  • 150.171.30.11
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
zagent2570.hola.org
  • 216.155.134.250
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.19.11.120
  • 2.19.11.100
  • 23.48.23.26
  • 23.48.23.51
whitelisted
update.googleapis.com
  • 142.250.185.227
  • 142.250.186.35
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7324
net_updater64.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
8392
hola_cr.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zagent2570.hola.org