Analysis
- max time kernel
123s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/08/2024, 03:48
General
- Target Hola-Setup-C-Sof1.exe
- Size 3.2MB
- Sample240807-ecq32atdph
- SHA256 9e65b85e4e33aaca1a3bd8aa5e2c5f67d9ec82224386b5b713479b4073fda32d
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 43 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 13 IoCs
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 64 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 7 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 46 IoCs
- Suspicious use of SendNotifyMessage 31 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Sof1.exe"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Sof1.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Sof1.exe"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-Sof1.exe" --monitor 18762⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe" --silent --agree --app vpn --campaign sof1 --no-run-uis --no-rmt-conf --no-updater --no-hola-cr2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\net_updater64.exe"C:\Program Files\Hola\app\net_updater64.exe" --install win_hola.org --campaign sof13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files\Hola\app\net_updater64.exe"C:\Program Files\Hola\app\net_updater64.exe" --uuid3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe" --silent --agree --app vpn --campaign sof1 --no-run-uis --no-rmt-conf --no-updater --no-svc --hola-cr-path "C:\\Users\\Admin\\AppData\\Local\\Temp\\chromium-123.0.6312.52.1227615.zip"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\7zr.exe"C:\Program Files\Hola\app\7zr.exe" x -o"C:\Program Files\Hola\temp" "C:\\Users\\Admin\\AppData\\Local\\Temp\\chromium-123.0.6312.52.1227615.zip" "chromium"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.228.101.exe" --post-install-run --no-rmt-conf --app vpn2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer "C:\Program Files\Hola\temp\hola_run.lnk"3⤵
-
-
-
C:\Program Files\Hola\app\net_updater64.exe"C:/Program Files/Hola/app/net_updater64.exe" --updater win_hola.org1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe --id 61842 --screen2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe --id 976522⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\hola_svc.exe"C:\Program Files\Hola\app\hola_svc.exe" --service1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\net_updater64.exe"C:\Program Files\Hola\app\net_updater64.exe" --uuid2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Program Files\Hola\app\hola_svc.exe"C:\Program Files\Hola\app\hola_svc.exe" --report-idle2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Program Files\Hola\app\hola_svc.exe"C:\Program Files\Hola\app\hola_svc.exe" --report-idle2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_chrome_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_edge_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_firefox_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_opera_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_ext_vpn_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_ext_vpn_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_noconsent_nopeer_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_h2o_noconsent_nopeer_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_h2ous_noconsent_nopeer_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_noconsent_hola_org2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_noconsent_nopeer_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_noconsent_nopeer_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_agreed_noconsent_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_vpn2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_mac_hola_svc_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_browser_updater2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_hola2e2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_prem2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_amazon2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_samsung2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_huawei2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_free2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_org_hola_play2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_com_hvpnmobile2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_pro_hola_org2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_org_ext2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_org_p22⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_un_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_in_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_chrome_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_chrome_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_edge_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_edge_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_firefox_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_firefox_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_opera_ext_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_opera_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_ext_vpn_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_banner_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_email_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_auto_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_on_abtest_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_off_abtest_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_svc_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_h2o_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_h2ous_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_auto_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_ios_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_agreed_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_agreed_sdk_hola_org2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc query luminati_net_updater_win_hola_browser_and_vpn_agreed_sdk_hola_org2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Program Files\Hola\app\net_updater64.exe"C:\Program Files\Hola\app\net_updater64.exe" --uuid2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exeC:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\sc.exesc query hola_svc2⤵
- Launches sc.exe
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Program Files\Hola\app\hola_svc.exe"C:\Program Files\Hola\app\hola_svc.exe" --report-idle2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\rasdial.exerasdial2⤵
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\hola.exe"C:\Program Files\Hola\app\hola.exe" --install2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-default-browser-check --component-updater=fast-update --proxy-pac-url=http://127.0.0.1:6880/ui_proxy.pac?key=899889283 --disable-gpu --window-size=696,679 --hola-disable-translate --disable-sync --app=https://hola.org/vpn_config?app_ver=1.228.101&ui_cache_ver=2&appid=win_hola.org&uuid=win-96b3e7355b48461e90a63b79b4da0cfb&campaign=sof13⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Hola\chromium_profile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Crashpad --annotation=plat=Win32 "--annotation=prod=Hola Browser" --annotation=ver=123.0.6312.52 --initial-client-data=0x15c,0x160,0x164,0x138,0x168,0x7577bc30,0x7577bc3c,0x7577bc484⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1772,i,15597276558411574232,6145139873824632618,262144 --field-trial-handle=1916,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=network --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=1984,i,7102568334470233277,12823865950665186147,524288 --field-trial-handle=2100,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=2272,i,17544450204695502157,16875966239602725214,524288 --field-trial-handle=2692,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=3044,i,18225889389892936714,2355010779200366859,262144 --field-trial-handle=3180,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --metrics-shmem-handle=3336,i,10391924085977078088,16177636668974760651,262144 --field-trial-handle=3332,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=proxy_resolver.mojom.ProxyResolverFactory --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=3988,i,13723701079361068014,14699377190832765373,524288 --field-trial-handle=4004,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=4132,i,6971662446309605587,18180090396711668385,524288 --field-trial-handle=4148,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=3992,i,9172773019933335982,15536496280473887288,524288 --field-trial-handle=4156,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4344,i,12909117903757080746,5336636264500928850,2097152 --field-trial-handle=4280,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4360,i,10629163996129020304,18010356478934604674,2097152 --field-trial-handle=4368,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4772,i,13940711256043666309,8919207664246055220,2097152 --field-trial-handle=4796,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4780,i,261429392802511840,12775364610072370586,2097152 --field-trial-handle=4928,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4804,i,13834654627961909764,195003067501545559,2097152 --field-trial-handle=5060,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5244,i,7327131502559156968,8248309319268253353,2097152 --field-trial-handle=5360,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5312,i,6672825720533057618,6295468854405304067,2097152 --field-trial-handle=5264,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5688,i,10457197340200865100,16577896674013233283,2097152 --field-trial-handle=5676,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=5980,i,16088324960929573628,5295289396507884005,2097152 --field-trial-handle=5212,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=6112,i,17352172385647349015,13798527811512676161,524288 --field-trial-handle=6124,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:84⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6424,i,7545697647495284677,5646860792662554131,2097152 --field-trial-handle=6380,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=4308,i,3962593341136999870,9144785515669025687,2097152 --field-trial-handle=6056,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=4204,i,18189557044423905252,10375414986786959001,2097152 --field-trial-handle=4228,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6436,i,5718525430472275991,4288514423774953965,2097152 --field-trial-handle=6524,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=5664,i,2240499645203676094,17324021528400125285,2097152 --field-trial-handle=6644,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6652,i,18109568580332223338,3164280282199834668,2097152 --field-trial-handle=6780,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6988,i,1973153857421181489,13637926167363289244,2097152 --field-trial-handle=7000,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=7008,i,8466352897267003057,11096965750536288701,2097152 --field-trial-handle=7136,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=6384,i,455530670474452804,3012690387604380102,2097152 --field-trial-handle=6020,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7404,i,10920822220731219345,13277943674396532766,2097152 --field-trial-handle=7024,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6420,i,11508675337172803111,16234711082337096268,2097152 --field-trial-handle=6128,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6120,i,8001950768971062006,11818683806657729292,2097152 --field-trial-handle=6740,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7196,i,6862108605299532130,11054631728721895728,2097152 --field-trial-handle=6632,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7020,i,9741806944577687694,1766159677651843688,2097152 --field-trial-handle=7476,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=6660,i,15614386634685317571,15990004020431763249,2097152 --field-trial-handle=6888,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=7032,i,6991582478644115961,6790043645042446659,2097152 --field-trial-handle=6180,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=7072,i,1954236142362251827,6415216674948035283,2097152 --field-trial-handle=7048,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=6508,i,17807647803662934208,7821311094538631301,2097152 --field-trial-handle=7228,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=7308,i,1827561156010510216,694553050660789102,2097152 --field-trial-handle=7380,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:24⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=6536,i,7290195163915465791,1512779013684435876,2097152 --field-trial-handle=6584,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=7084,i,12013366563259067744,13138038055242596996,2097152 --field-trial-handle=6696,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=7504,i,16458844127451610890,10949499056954014290,2097152 --field-trial-handle=7600,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=6684,i,17084368893605071077,12674488013789975556,2097152 --field-trial-handle=7208,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:14⤵
- Executes dropped EXE
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=7672,i,5294217068693701084,10781746403489293648,2097152 --field-trial-handle=7680,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=6068,i,11057974837169261544,17145819819110908188,2097152 --field-trial-handle=6624,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=7176,i,4742391756723510074,9897293108796365555,2097152 --field-trial-handle=6044,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=7288,i,17414928925112415154,4193426577106657689,2097152 --field-trial-handle=7220,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14⤵
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=7400,i,3701952574727425886,9904996506522085206,2097152 --field-trial-handle=7648,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=7608,i,1720100636288936451,11335462626901632073,2097152 --field-trial-handle=7828,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:14⤵
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=7832,i,3327415496353798991,7753207146180790114,2097152 --field-trial-handle=7960,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7868 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=8084,i,9283438038929177404,6041308256693065105,2097152 --field-trial-handle=8108,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8104 /prefetch:14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=8116,i,15252970780604945327,2108451546627892742,2097152 --field-trial-handle=8240,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=8372,i,9128899369387367492,10976792505386063463,2097152 --field-trial-handle=8388,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=8516,i,17219825511587237465,1286046381342666611,2097152 --field-trial-handle=8532,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8528 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=8552,i,3077838831056392512,2510594941822582488,2097152 --field-trial-handle=8676,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=8816,i,2875631247896429181,10567182671124705513,2097152 --field-trial-handle=8844,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:24⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=6012,i,8663790171925846446,16088259032261159884,2097152 --field-trial-handle=7468,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14⤵
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=7812,i,5345469648069056874,11782503066523393472,2097152 --field-trial-handle=7928,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:14⤵
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=7184,i,3068929825114083479,18186825532510739697,2097152 --field-trial-handle=9144,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=9176,i,5472587557641384723,12894090855065358756,524288 --field-trial-handle=8400,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:84⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=4348,i,2888772898906872532,16282075125849757602,2097152 --field-trial-handle=9100,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:14⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Hola\app\chromium\hola_cr.exe"C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --metrics-shmem-handle=6804,i,9573942921326704196,14352916255302069781,524288 --field-trial-handle=8876,i,1588400730113178115,7853279411031153790,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:84⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
cr_en-gb_500000_index.bin
manifest.json
manifest.json
7zr.exe
README.txt
hola.exe
hola_split_tunnel.sys
hola_svc.exe
lum_sdk64.dll
net_updater64.exe
install.log
20240807_034833_perr_user_auto_agree.jslog
20240807_034834_dll_invalid_signature_pre_1.474.630.log
20240807_034837_once_06_service_install_1.474.630.log
20240807_034839_dll_invalid_signature_pre_1.474.630.log
20240807_034840_dll_invalid_signature_pre_1.474.630.log
20240807_034841_perr_14_init_monitor.jslog
20240807_034842_perr_15_peer_start.jslog
20240807_034842_perr_16_peer_dev_init.jslog
20240807_034842_perr_17_peer_dev_testing.jslog
20240807_034842_perr_conf_update_direct_success.jslog
20240807_034842_perr_diag_data_dir.jslog
20240807_034845_perr_windows_event_log.jslog
README.txt
brd_sdk64_clr.dll
brd_sdk_service.log
conf.json
conf.json
conf.json
kbasnthasciateuhant98437uau
lum_sdk_install_id
lum_sdk_session_id
lum_sdk_session_id
lum_sdk_session_id:LUM
lum_sdk_session_id:LUM
msvcr120.dll
net_install.log
test_wpf.exe
Hola VPN.lnk
8EC9B1D0ABBD7F98B401D425828828CE_7BC6BAD757FCD9C147D141E8A9D5A2A0
8EC9B1D0ABBD7F98B401D425828828CE_7BC6BAD757FCD9C147D141E8A9D5A2A0
net_updater64.exe.log
test_wpf.exe.log
Hola-Setup-x64-1.228.101.exe
hola_setup.log
settings.dat
Preload Data
f_000001
f_000002
f_000003
f_000004
f_000005
f_000006
f_000007
f_000008
f_000009
f_00000a
f_00000b
f_00000c
f_00000d
f_00000e
f_00000f
f_000010
f_000011
f_000012
f_000013
f_00002e
f_00002f
f_000031
24b911a5367341cb_0
2607224c030ba697_0
3629fc51c1d7ebae_0
4c5c7fd4e5ecdbaa_0
530dc308dd5db682_0
6da3c92555dfb32e_0
6f4ffdebf6911d89_0
7e9f5c564bc60be9_0
94e625631b249856_0
a6167c9a3f379dc3_0
ab97ecc94b3546c7_0
ae5d5ee653617169_0
b7fce619812788dc_0
dcd0789370f251ac_0
e9720b9551401a54_0
ec65a1bb0f6dbc42_0
fc0012a5d6e2666c_0
fd56d5ae8e69f4e2_0
the-real-index
the-real-index~RFe595867.TMP
DIPS
index
data_0
data_1
data_2
data_3
index
CURRENT
MANIFEST-000001
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences~RFe58d1a3.TMP
index
index.txt
index.txt
index.txt~RFe5910ee.TMP
index
index
Local State
Local State
Local State
Local State
Local State~RFe58972a.TMP
index
memory/432-78-0x00000000008A0000-0x00000000008A8000-memory.dmp
memory/432-79-0x0000000005080000-0x00000000050A2000-memory.dmp
memory/2236-543-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2236-154-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2236-9-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2236-7-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2468-337-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/2468-30-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/2468-373-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/2664-374-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-338-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-1-0x0000000000C40000-0x0000000000F74000-memory.dmp
memory/2664-2-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-3-0x0000000005BE0000-0x0000000005C90000-memory.dmp
memory/2664-104-0x0000000074F8E000-0x0000000074F8F000-memory.dmp
memory/2664-16-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-15-0x000000000ACD0000-0x000000000B274000-memory.dmp
memory/2664-14-0x000000000A580000-0x000000000A612000-memory.dmp
memory/2664-13-0x000000000A120000-0x000000000A474000-memory.dmp
memory/2664-12-0x0000000009570000-0x0000000009592000-memory.dmp
memory/2664-11-0x00000000090A0000-0x00000000090E4000-memory.dmp
memory/2664-10-0x0000000007060000-0x0000000007068000-memory.dmp
memory/2664-153-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-4-0x0000000006510000-0x0000000006566000-memory.dmp
memory/2664-550-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-0-0x0000000074F8E000-0x0000000074F8F000-memory.dmp
memory/2664-6-0x0000000006CC0000-0x0000000006CCE000-memory.dmp
memory/2664-8-0x0000000074F80000-0x0000000075730000-memory.dmp
memory/2664-5-0x0000000006CF0000-0x0000000006D28000-memory.dmp
memory/4000-101-0x000001FEAB4B0000-0x000001FEAB96F000-memory.dmp
memory/4000-65-0x0000000180000000-0x00000001805FD000-memory.dmp
memory/4000-103-0x000001FE92B70000-0x000001FE92B92000-memory.dmp
memory/4000-102-0x000001FEAB970000-0x000001FEABE14000-memory.dmp
memory/4128-528-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/4128-375-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/4252-341-0x0000000000680000-0x0000000000688000-memory.dmp
memory/4396-539-0x00007FF6E5D80000-0x00007FF6E85C5000-memory.dmp
memory/4408-232-0x000001C1A32A0000-0x000001C1A37C8000-memory.dmp