8eb9297e5b993955a9d958fd1359ca4711f45a4bf8f0bcfd491001d95c860202

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
101s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Hola-Setup-C-prads55.exe
Size 4.1MB
Sample260711-raz95sct8k
SHA256 8eb9297e5b993955a9d958fd1359ca4711f45a4bf8f0bcfd491001d95c860202
MD5 a91fcee45bcee512eb903844492b332c
SHA1 839e26ba66052afc7ced482ce05414dbd040758b
SHA512 7832ff6d16894f3c6cc6c27e9f2567e208016a18172d56222322cee344bf7021086b2d2b586591e17bf6fe1e75c61e2eedaa073c2a10f962536f3a05a2729141
SSDEEP 49152:piAJHa29L2Zw8cvxe2Fbg2D+zWCSA/Bkj02Sn2w:pnayL2ZwTxe2tgHtSAXnr
TLSH
T12016AE52F7F6451AF26F2BB4D0B1072142B6FC6A5AEAD74F1984B89998B7740CF10323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 17 IoCs

pid	Process
5540	Hola-Setup-x64-1.255.468.exe
2844	net_updater64.exe
1264	hola_split_tunnel.sys
2360	hola_svc.exe
2000	test_wpf.exe
2736	net_updater64.exe
5440	net_updater64.exe
1216	test_wpf.exe
3348	hola_svc.exe
3712	net_updater64.exe
4544	hola_svc.exe
5080	test_wpf.exe
1172	idle_report.exe
5428	Hola-Setup-x64-1.255.468.exe
3176	7zr.exe
252	hola_svc.exe
2976	Hola-Setup-x64-1.255.468.exe

Loads dropped DLL 15 IoCs

pid	Process
2844	net_updater64.exe
2844	net_updater64.exe
2844	net_updater64.exe
2844	net_updater64.exe
2844	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
3712	net_updater64.exe
3712	net_updater64.exe
3712	net_updater64.exe
3712	net_updater64.exe
3712	net_updater64.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	82	208.67.222.222	3348	hola_svc.exe
Destination IP	83	209.244.0.3	3348	hola_svc.exe
Destination IP	90	208.67.222.222	3348	hola_svc.exe
Destination IP	91	209.244.0.3	3348	hola_svc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hola = "C:\\Program Files\\Hola\\app\\hola.exe --auto-start"	Hola-Setup-x64-1.255.468.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
77	api64.ipify.org
381	api64.ipify.org

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\BrightData	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\BrightData	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2	net_updater64.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2	net_updater64.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c55c-28.dat	upx
behavioral2/memory/5540-33-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5540-101-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5540-244-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5540-282-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5540-285-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5428-296-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5428-440-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/5428-458-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx
behavioral2/memory/2976-467-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Hola\app\README.txt	Hola-Setup-x64-1.255.468.exe
File opened for modification	C:\Program Files\Hola\log\install.log	Hola-Setup-x64-1.255.468.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\es-419.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\tr.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\zh-cn.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ro.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\sr.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\th.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\chrome_100_percent.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\es-419.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\et.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\pt-pt.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\sw.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\zh-tw.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\da.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\he.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\hr.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\sv.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\libglesv2.dll	7zr.exe
File opened for modification	C:\Program Files\Hola\log\install.log	Hola-Setup-x64-1.255.468.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\es.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\fi.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ko.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\nl.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\app\net_updater64.exe	Hola-Setup-x64-1.255.468.exe
File created	\??\c:\Program Files\Hola\db\svc.cid	hola_svc.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\chrome_200_percent.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ja.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\libegl.dll	7zr.exe
File created	C:\Program Files\Hola\temp\hola_run.lnk	Hola-Setup-x64-1.255.468.exe
File opened for modification	C:\Program Files\Hola\app\hola_svc.exe	Hola-Setup-x64-1.255.468.exe
File created	\??\c:\Program Files\Hola\db\hola.ndconf	hola_svc.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\fr.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\hr.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ro.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ta.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\smalllogo.png	7zr.exe
File created	C:\Program Files\Hola\app\hola_svc.exe	Hola-Setup-x64-1.255.468.exe
File opened for modification	C:\Program Files\Hola\log\svc.log	hola_svc.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\142.0.7444.135.manifest	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\bn.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\sk.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\uk.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\resources.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\meipreload	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\en-gb.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\th.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\zh-tw.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\de.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ta.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\libegl.dll	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\cs.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\lv.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\nl.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\logo.png	7zr.exe
File opened for modification	C:\Program Files\Hola\log\install.log	Hola-Setup-x64-1.255.468.exe
File created	C:\Program Files\Hola\app\7zr.exe	Hola-Setup-x64-1.255.468.exe
File created	C:\Program Files\Hola\app\hola_split_tunnel.sys	Hola-Setup-x64-1.255.468.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\icudtl.dat	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\en-us.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\gu.pak	7zr.exe
File opened for modification	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\ko.pak	7zr.exe
File created	C:\Program Files\Hola\temp\chromium\142.0.7444.135\locales\nb.pak	7zr.exe

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4636	sc.exe
3804	sc.exe
1044	sc.exe
1552	sc.exe
4232	sc.exe
1668	sc.exe
2680	sc.exe
3264	sc.exe
3212	sc.exe
1968	sc.exe
4132	sc.exe
2016	sc.exe
2972	sc.exe
5632	sc.exe
1832	sc.exe
4384	sc.exe
3124	sc.exe
2592	sc.exe
2648	sc.exe
4392	sc.exe
916	sc.exe
4200	sc.exe
1484	sc.exe
4128	sc.exe
2696	sc.exe
2256	sc.exe
2864	sc.exe
4620	sc.exe
5652	sc.exe
2356	sc.exe
4340	sc.exe
2424	sc.exe
6052	sc.exe
5348	sc.exe
4576	sc.exe
1156	sc.exe
5008	sc.exe
4116	sc.exe
1972	sc.exe
1628	sc.exe
6128	sc.exe
4556	sc.exe
900	sc.exe
1284	sc.exe
2740	sc.exe
2960	sc.exe
5644	sc.exe
1500	sc.exe
1428	sc.exe
1988	sc.exe
4748	sc.exe
2432	sc.exe
5844	sc.exe
2692	sc.exe
2752	sc.exe
3132	sc.exe
4204	sc.exe
2848	sc.exe
5744	sc.exe
4880	sc.exe
4100	sc.exe
4280	sc.exe
3740	sc.exe
3256	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	1676	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test_wpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idle_report.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hola-Setup-C-prads55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hola-Setup-C-prads55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test_wpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test_wpf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7040	hola_cr.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	net_updater64.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	net_updater64.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\lum_sdk_session_id:LUM:$DATA	net_updater64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1624	Hola-Setup-C-prads55.exe
1624	Hola-Setup-C-prads55.exe
1624	Hola-Setup-C-prads55.exe
1624	Hola-Setup-C-prads55.exe
1624	Hola-Setup-C-prads55.exe
5540	Hola-Setup-x64-1.255.468.exe
5540	Hola-Setup-x64-1.255.468.exe
5540	Hola-Setup-x64-1.255.468.exe
5540	Hola-Setup-x64-1.255.468.exe
2844	net_updater64.exe
5540	Hola-Setup-x64-1.255.468.exe
5540	Hola-Setup-x64-1.255.468.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
3348	hola_svc.exe
3348	hola_svc.exe
3712	net_updater64.exe
3712	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
3712	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5428	Hola-Setup-x64-1.255.468.exe
5428	Hola-Setup-x64-1.255.468.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
3348	hola_svc.exe
3348	hola_svc.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe
5440	net_updater64.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	Hola-Setup-C-prads55.exe
Token: SeDebugPrivilege	1676	Hola-Setup-C-prads55.exe
Token: SeDebugPrivilege	2844	net_updater64.exe
Token: SeDebugPrivilege	5440	net_updater64.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeShutdownPrivilege	3348	hola_svc.exe
Token: SeCreatePagefilePrivilege	3348	hola_svc.exe
Token: SeDebugPrivilege	3712	net_updater64.exe
Token: SeShutdownPrivilege	5440	net_updater64.exe
Token: SeCreatePagefilePrivilege	5440	net_updater64.exe
Token: SeShutdownPrivilege	5440	net_updater64.exe
Token: SeCreatePagefilePrivilege	5440	net_updater64.exe
Token: SeBackupPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeShutdownPrivilege	5440	net_updater64.exe
Token: SeCreatePagefilePrivilege	5440	net_updater64.exe
Token: SeShutdownPrivilege	5440	net_updater64.exe
Token: SeCreatePagefilePrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe
Token: SeSecurityPrivilege	5440	net_updater64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5540	Hola-Setup-x64-1.255.468.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 1676	1624	Hola-Setup-C-prads55.exe	88
PID 1624 wrote to memory of 5540	1624	Hola-Setup-C-prads55.exe	93
PID 5540 wrote to memory of 2844	5540	Hola-Setup-x64-1.255.468.exe	96
PID 2844 wrote to memory of 2000	2844	net_updater64.exe	101
PID 5440 wrote to memory of 1216	5440	net_updater64.exe	105
PID 3348 wrote to memory of 3712	3348	hola_svc.exe	108
PID 3348 wrote to memory of 4984	3348	hola_svc.exe	110
PID 3348 wrote to memory of 4544	3348	hola_svc.exe	111
PID 3712 wrote to memory of 5080	3712	net_updater64.exe	122
PID 5440 wrote to memory of 1172	5440	net_updater64.exe	114
PID 1624 wrote to memory of 5428	1624	Hola-Setup-C-prads55.exe	118
PID 5428 wrote to memory of 3176	5428	Hola-Setup-x64-1.255.468.exe	359
PID 3348 wrote to memory of 252	3348	hola_svc.exe	123
PID 1624 wrote to memory of 2976	1624	Hola-Setup-C-prads55.exe	125
PID 2976 wrote to memory of 5340	2976	Hola-Setup-x64-1.255.468.exe	126
PID 3348 wrote to memory of 2432	3348	hola_svc.exe	289
PID 3348 wrote to memory of 4620	3348	hola_svc.exe	129
PID 3348 wrote to memory of 1628	3348	hola_svc.exe	130
PID 3348 wrote to memory of 1484	3348	hola_svc.exe	131
PID 3348 wrote to memory of 5348	3348	hola_svc.exe	132
PID 3348 wrote to memory of 1968	3348	hola_svc.exe	133
PID 3348 wrote to memory of 2360	3348	hola_svc.exe	134
PID 3348 wrote to memory of 1972	3348	hola_svc.exe	135
PID 3348 wrote to memory of 4200	3348	hola_svc.exe	367
PID 3348 wrote to memory of 2864	3348	hola_svc.exe	271
PID 3348 wrote to memory of 1500	3348	hola_svc.exe	138
PID 3348 wrote to memory of 2680	3348	hola_svc.exe	139
PID 3348 wrote to memory of 3256	3348	hola_svc.exe	140
PID 3348 wrote to memory of 1044	3348	hola_svc.exe	312
PID 3348 wrote to memory of 3132	3348	hola_svc.exe	142
PID 3348 wrote to memory of 4100	3348	hola_svc.exe	143
PID 3348 wrote to memory of 916	3348	hola_svc.exe	144
PID 3348 wrote to memory of 3740	3348	hola_svc.exe	145
PID 3348 wrote to memory of 6052	3348	hola_svc.exe	288
PID 3348 wrote to memory of 4392	3348	hola_svc.exe	147
PID 3348 wrote to memory of 1668	3348	hola_svc.exe	148
PID 3348 wrote to memory of 5644	3348	hola_svc.exe	149
PID 3348 wrote to memory of 2972	3348	hola_svc.exe	150
PID 3348 wrote to memory of 4748	3348	hola_svc.exe	151
PID 3348 wrote to memory of 2648	3348	hola_svc.exe	152
PID 3348 wrote to memory of 4232	3348	hola_svc.exe	153
PID 3348 wrote to memory of 5844	3348	hola_svc.exe	154
PID 3348 wrote to memory of 2752	3348	hola_svc.exe	155
PID 3348 wrote to memory of 4116	3348	hola_svc.exe	157
PID 3348 wrote to memory of 4204	3348	hola_svc.exe	158
PID 3348 wrote to memory of 4556	3348	hola_svc.exe	159
PID 3348 wrote to memory of 3212	3348	hola_svc.exe	160
PID 3348 wrote to memory of 3804	3348	hola_svc.exe	161
PID 3348 wrote to memory of 2256	3348	hola_svc.exe	162
PID 3348 wrote to memory of 2692	3348	hola_svc.exe	163
PID 3348 wrote to memory of 2592	3348	hola_svc.exe	164
PID 3348 wrote to memory of 2696	3348	hola_svc.exe	319
PID 3348 wrote to memory of 3264	3348	hola_svc.exe	166
PID 3348 wrote to memory of 2960	3348	hola_svc.exe	167
PID 3348 wrote to memory of 4340	3348	hola_svc.exe	168
PID 3348 wrote to memory of 2356	3348	hola_svc.exe	170
PID 3348 wrote to memory of 3124	3348	hola_svc.exe	171
PID 3348 wrote to memory of 4636	3348	hola_svc.exe	172
PID 3348 wrote to memory of 900	3348	hola_svc.exe	173
PID 3348 wrote to memory of 4128	3348	hola_svc.exe	174
PID 3348 wrote to memory of 1552	3348	hola_svc.exe	175
PID 3348 wrote to memory of 2740	3348	hola_svc.exe	176
PID 3348 wrote to memory of 4880	3348	hola_svc.exe	177
PID 3348 wrote to memory of 2016	3348	hola_svc.exe	178

C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-prads55.exe
"C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-prads55.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-prads55.exe
  "C:\Users\Admin\AppData\Local\Temp\Hola-Setup-C-prads55.exe" --monitor 1988
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1168
    3⤵
    - Program crash
    PID:4792
- C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe
  "C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe" --silent --agree --force-appid win_hola.sdk.hola.org --campaign prads55 --app vpn --no-run-uis --no-rmt-conf --no-updater --no-hola-cr
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Program Files\Hola\app\net_updater64.exe
    "C:\Program Files\Hola\app\net_updater64.exe" --install win_hola.org --campaign prads55 --dlg-app-name HolaVPN --set-uuid e6da511122484ff797f248a1566580b6
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
      C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000
- C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe
  "C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe" --silent --agree --force-appid win_hola.sdk.hola.org --campaign prads55 --app vpn --no-run-uis --no-rmt-conf --no-updater --no-svc --hola-cr-path "C:\\Users\\Admin\\AppData\\Local\\Temp\\chromium-142.0.7444.135.1255458.zip"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Program Files\Hola\app\7zr.exe
    "C:\Program Files\Hola\app\7zr.exe" x -o"C:\Program Files\Hola\temp" "C:\\Users\\Admin\\AppData\\Local\\Temp\\chromium-142.0.7444.135.1255458.zip" "chromium"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3176
- C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe
  "C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe" --post-install-run --no-rmt-conf --app vpn
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\explorer.exe
    explorer "C:\Program Files\Hola\temp\hola_run.lnk"
    3⤵
    PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1676 -ip 1676
1⤵
PID:4920

C:\Program Files\Hola\app\hola_split_tunnel.sys
"C:\Program Files\Hola\app\hola_split_tunnel.sys"
1⤵
- Executes dropped EXE
PID:1264

C:\Program Files\Hola\app\hola_svc.exe
"C:\Program Files\Hola\app\hola_svc.exe" --service
1⤵
- Executes dropped EXE
PID:2360

C:\Program Files\Hola\app\net_updater64.exe
"C:/Program Files/Hola/app/net_updater64.exe" --updater win_hola.org
1⤵
- Executes dropped EXE
PID:2736

C:\Program Files\Hola\app\net_updater64.exe
"C:/Program Files/Hola/app/net_updater64.exe" --updater win_hola.org
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
  C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1216
- C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe
  C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe --id 83661 --screen
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1172
- C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe
  C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe --id 19275 --screen
  2⤵
  PID:7100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4280

C:\Program Files\Hola\app\hola_svc.exe
"C:\Program Files\Hola\app\hola_svc.exe" --service
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Program Files\Hola\app\net_updater64.exe
  "C:\Program Files\Hola\app\net_updater64.exe" --uuid
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
    C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5080
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4984
- C:\Program Files\Hola\app\hola_svc.exe
  "C:\Program Files\Hola\app\hola_svc.exe" --report-idle
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Program Files\Hola\app\hola_svc.exe
  "C:\Program Files\Hola\app\hola_svc.exe" --report-idle
  2⤵
  - Executes dropped EXE
  PID:252
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_org
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:4620
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_chrome_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1628
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_edge_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1484
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_firefox_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:5348
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_opera_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1968
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_ext_vpn_noconsent_hola_org
  2⤵
  PID:2360
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_ext_vpn_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1972
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_noconsent_nopeer_hola_org
  2⤵
  - Launches sc.exe
  PID:4200
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:2864
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1500
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_h2o_noconsent_nopeer_hola_org
  2⤵
  - Launches sc.exe
  PID:2680
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_h2ous_noconsent_nopeer_hola_org
  2⤵
  - Launches sc.exe
  PID:3256
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_hola_org
  2⤵
  - Launches sc.exe
  PID:1044
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:3132
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_noconsent_nopeer_hola_org
  2⤵
  - Launches sc.exe
  PID:4100
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:916
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_hola_org
  2⤵
  - Launches sc.exe
  PID:3740
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:6052
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_noconsent_nopeer_hola_org
  2⤵
  - Launches sc.exe
  PID:4392
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_agreed_noconsent_hola_org
  2⤵
  - Launches sc.exe
  PID:1668
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_vpn
  2⤵
  - Launches sc.exe
  PID:5644
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_mac_hola_svc_hola_org
  2⤵
  - Launches sc.exe
  PID:2972
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_browser_updater
  2⤵
  - Launches sc.exe
  PID:4748
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_hola2e
  2⤵
  - Launches sc.exe
  PID:2648
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola
  2⤵
  - Launches sc.exe
  PID:4232
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_prem
  2⤵
  - Launches sc.exe
  PID:5844
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_amazon
  2⤵
  - Launches sc.exe
  PID:2752
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_samsung
  2⤵
  - Launches sc.exe
  PID:4116
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_huawei
  2⤵
  - Launches sc.exe
  PID:4204
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_free
  2⤵
  - Launches sc.exe
  PID:4556
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_org_hola_play
  2⤵
  - Launches sc.exe
  PID:3212
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_com_hvpnmobile
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_pro_hola_org
  2⤵
  - Launches sc.exe
  PID:2256
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_org_ext
  2⤵
  - Launches sc.exe
  PID:2692
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_org_p2
  2⤵
  - Launches sc.exe
  PID:2592
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_un_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:2696
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_in_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:3264
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_chrome_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:2960
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_chrome_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:4340
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_edge_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:2356
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_edge_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:3124
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_firefox_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:4636
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_firefox_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:900
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_opera_ext_hola_org
  2⤵
  - Launches sc.exe
  PID:4128
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_opera_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:1552
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_ext_vpn_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:2740
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_banner_hola_org
  2⤵
  - Launches sc.exe
  PID:4880
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_email_hola_org
  2⤵
  - Launches sc.exe
  PID:2016
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:5652
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_auto_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:5744
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_on_abtest_hola_org
  2⤵
  - Launches sc.exe
  PID:2848
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_off_abtest_hola_org
  2⤵
  - Launches sc.exe
  PID:2424
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_svc_hola_org
  2⤵
  - Launches sc.exe
  PID:1284
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_h2o_hola_org
  2⤵
  - Launches sc.exe
  PID:5008
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_h2ous_hola_org
  2⤵
  - Launches sc.exe
  PID:4280
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_group1_abtest_hola_org
  2⤵
  - Launches sc.exe
  PID:1988
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:1832
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:1428
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_auto_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:6128
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_ios_hola_org
  2⤵
  - Launches sc.exe
  PID:1156
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_agreed_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:4576
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_agreed_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:4132
- C:\Windows\system32\sc.exe
  sc query luminati_net_updater_win_hola_browser_and_vpn_agreed_sdk_hola_org
  2⤵
  - Launches sc.exe
  PID:5632
- C:\Program Files\Hola\app\net_updater64.exe
  "C:\Program Files\Hola\app\net_updater64.exe" --uuid
  2⤵
  PID:264
- - C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
    C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
    3⤵
    PID:2796
- C:\Windows\system32\sc.exe
  sc query hola_svc
  2⤵
  - Launches sc.exe
  PID:4384
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1964
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:7088
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2928
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4796
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2864
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2636
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3964
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2496
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6408
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1816
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3664
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6876
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4200
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4088
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:980
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3580
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6404
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4316
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3652
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6876
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2696
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:5796
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1988
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6224
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4976
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6648
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2664
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3892
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:7088
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2324
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2940
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:3388
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2020
- C:\Windows\system32\rasdial.exe
  rasdial hola_vpn_ca 21759105-win-e6da511122484ff797f248a1566580b6 03387511 /phonebook:C:\Windows\TEMP\hola_vpn.pbk
  2⤵
  PID:1212
- C:\Windows\system32\rasdial.exe
  rasdial hola_vpn_ca 21759105-win-e6da511122484ff797f248a1566580b6 03387511 /phonebook:C:\Windows\TEMP\hola_vpn.pbk
  2⤵
  PID:6516
- C:\Windows\system32\rasdial.exe
  rasdial hola_vpn_ca 21759105-win-e6da511122484ff797f248a1566580b6 03387511 /phonebook:C:\Windows\TEMP\hola_vpn.pbk
  2⤵
  PID:6216
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:4452
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:5792
- C:\Program Files\Hola\app\hola_svc.exe
  "C:\Program Files\Hola\app\hola_svc.exe" --report-idle
  2⤵
  PID:4200
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1052
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1064
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:7048
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:7156
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:6556
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:2324
- C:\Windows\system32\rasdial.exe
  rasdial
  2⤵
  PID:1672

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3800

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:5080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:2468
- C:\Program Files\Hola\app\hola.exe
  "C:\Program Files\Hola\app\hola.exe" --install
  2⤵
  PID:4268
- - C:\Program Files\Hola\app\chromium\hola_cr.exe
    "C:\Program Files\Hola\app\chromium\hola_cr.exe" --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-default-browser-check --component-updater=fast-update --proxy-pac-url=http://127.0.0.1:6880/ui_proxy.pac?key=1027626719 --disable-gpu --window-size=696,679 --hola-disable-translate --disable-sync --app=https://hola.org/vpn_config?app_ver=1.255.468&ui_cache_ver=2&appid=win_hola.sdk.hola.org&uuid=win-e6da511122484ff797f248a1566580b6&campaign=prads55&affiliate=
    3⤵
    PID:7072
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\Hola\chromium_profile /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Crashpad --annotation=plat=Win32 "--annotation=prod=Hola Browser" --annotation=ver=142.0.7444.135 --initial-client-data=0x170,0x174,0x178,0x14c,0x17c,0x74fc6cbc,0x74fc6cc8,0x74fc6cd4
      4⤵
      PID:6588
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=gpu-process --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAMAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --metrics-shmem-handle=1684,i,9296887884139054656,10499927221125469827,262144 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=1653604857 --mojo-platform-channel-handle=1948 /prefetch:2
      4⤵
      PID:6180
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2292,i,12453804150887543946,6462525554606136561,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=3684750470 --mojo-platform-channel-handle=2464 /prefetch:13
      4⤵
      PID:6884
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=network --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,16028063508392620754,16303019930340657305,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=521694016 --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      System Time Discovery
      PID:7040
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=proxy_resolver.mojom.ProxyResolverFactory --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=3324,i,6499131384002747218,8839286305968897083,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=2320163559 --mojo-platform-channel-handle=3348 /prefetch:14
      4⤵
      PID:6788
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4320,i,12747171020831781705,15735873681272228207,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=1854811418 --mojo-platform-channel-handle=4332 /prefetch:9
      4⤵
      PID:6968
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4368,i,11755010480036026383,9094978222229375768,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=3885957031 --mojo-platform-channel-handle=4400 /prefetch:9
      4⤵
      PID:936
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4976,i,11245478195050406258,250549812567900613,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=1622135348 --mojo-platform-channel-handle=5020 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5004,i,2871973123959754435,9202991851679585386,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=490224507 --mojo-platform-channel-handle=5060 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4984,i,12792322433563687449,4597795335156928578,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=2754046190 --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:1284
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5232,i,42602646868982252,9938054415872485218,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=3653280961 --mojo-platform-channel-handle=5412 /prefetch:9
      4⤵
      PID:6904
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --extension-process --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5252,i,4390438060090693798,16998695810915108751,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=2521370119 --mojo-platform-channel-handle=5424 /prefetch:9
      4⤵
      PID:2180
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4604,i,6597477945492575691,4559021716578546317,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=1389459278 --mojo-platform-channel-handle=5948 /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6056,i,16921629554764208249,9241598149324820435,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=257548436 --mojo-platform-channel-handle=4480 /prefetch:1
      4⤵
      PID:4168
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6760,i,11852939317275221097,13813374740534133105,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=3420604891 --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:6712
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6824,i,16563745259975025317,11870317453278402575,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=2288694049 --mojo-platform-channel-handle=6684 /prefetch:1
      4⤵
      PID:7024
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,17416978390661807014,14907217536430672660,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=1156783208 --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:7136
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=renderer --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-GB --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6520,i,420413658757407992,2566174850310447263,2097152 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=24872366 --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files\Hola\app\chromium\hola_cr.exe
      "C:\Program Files\Hola\app\chromium\hola_cr.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --user-data-dir="C:\\Users\\Admin\\AppData\\Roaming\\Hola\\chromium_profile" --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,11657152585879235551,8670005651853763919,524288 --field-trial-handle=1944,i,4838671196139807125,12581840747123723404,262144 --variations-seed-version --trace-process-track-uuid=3187928821 --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zr.exe

Path C:\Program Files\Hola\app\7zr.exe
Size 582KB
SHA256 eda69648c5a2725c6c1f3984c79d9b2d25bffec7cc652a4793bff8b537605978
MD5 4f628aff3cda8f99636325ecf3d1b5ed
SHA1 a3a1bde3072da1fd969af552c786484bba73b5ff
SHA512 97d94bd8d33eea7bcde9ec5a2f8a1ff22b7b66c8003d2163fbfbb27ea5856d61e670d76d366d3f30b0bcd40905fb7379869dcc292577b9bc8a15280661cc84bd
SSDEEP 12288:sSjMK6lrdOCdlki5Zc0EyR35ksye/X16PJz5tghj+R:sSjieCd+i5s+Jks1foxz5Whj+R
TLSH
T1C0C49F163AE5C07EC66215318B5C6BB5D1FA93640B224CC763804E6D2F349EAD73B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Program Files\Hola\app\README.txt
Size 1003B
SHA256 a2b79e73f4f317ad3f44a383722f05e739cf260c49e54ad6b7001cb7af6bd252
MD5 e2f387b53a340a507bbb2a28d7917484
SHA1 26cdf020bc52b57b91d8b8a9ba6cfc1424ef3099
SHA512 987fcd22e16915e9059d820a18dd69bd10950d5674e21f38a00f46ebb1d90d4ee3d652e2edffe7decf7584a0631f10e86db2ad90da5c00fe5af57693c52b8a89
TLSH
T1F111026BEF11315805100FC7DE64CB19D3FBA48826B718CBBC1A826823A1B776337396
MD5 SHA1 SHA512 TLSH

Submit Download

brd_config.json

Path C:\Program Files\Hola\app\brd_config.json
Size 23B
SHA256 a8a98543314fda9c0e1afd290e6b4d430b56b755e9e4bb3eb0408f0f1c3a13c9
MD5 106968caecc3d8687ee903fadd6475dc
SHA1 6e206deabfb5769509280a626133a8601e69f068
SHA512 2a55f0716ecff44209e4b7f02232ecad5a5c3a90e10e3a5a982bba3f70b0a7a8b21de7b3da2598cd372a2f33f24e577a66ac5460519bc5a1cacfb97ab680854c
MD5 SHA1 SHA512

Submit Download

hola.exe

Path C:\Program Files\Hola\app\hola.exe
Size 4.0MB
SHA256 43afcc4c378ef4943bfb0dcab3c2a820e0193cbf9006adec0a95862c0e546cb3
MD5 8f75d02226876372fb06efc739062925
SHA1 5988a0e60c2d16589e560ac7400f1b7d9faabc95
SHA512 1d1351f8641f7441f50cdb6df9dae150b6c6ec823ef1d71c008397183659c67af8dfc75b34e69758ebb77c0b3a7bd29149e90f64331a35c707a3c827273e27ff
SSDEEP 49152:5YhuqbVeRcwOyRpbAks8tmrjwEJ6WSmO0otyPBnnfcPM+Mn9ksUx:Rq0RLP46WSmMinnv+M9jUx
TLSH
T17616E4D1A27580E5C9A79134C85246F79262BC54F3E0A6DB13B4BF6A3E336D11F3A213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hola_split_tunnel.sys

Path C:\Program Files\Hola\app\hola_split_tunnel.sys
Size 83KB
SHA256 bd76f8d8f877bbcceb1b7bff0d527b7e20bee680f4772b84c15c4a9a1c6429a2
MD5 1b0b2b41d0cee1fd73f3145f32618032
SHA1 a9b739f119f233ffe72a9f742f7432953fee05da
SHA512 a30b811385fd13f3e300b17e30b86f701239b1096afba632fec853ddf1b26e36cff7dd0533f42ab0f2c0ab01e99a3156c9f86acb60ec8954637b9f46d3665769
SSDEEP 1536:i9OljLQ0RmeQ3uhu3fwMoQ1jrTAc/r/BMzmi:ia80ByuhEwMoQxAcTWqi
TLSH
T14B836D45A6B42488EAE79A78F6B14527EFF4B8422B3047DF0364C5490F337C56E393A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hola_svc.exe

Path C:\Program Files\Hola\app\hola_svc.exe
Size 23.2MB
SHA256 6dd14dfd42da60a8231fb6d90b90f0d6610a0c7e1fa4e7e6f110b2d147d9eefb
MD5 4fffae9876162a8eb5b1040e03bf87f5
SHA1 b72fbfb50e5078919d4a40950c6c6a3c0f466e81
SHA512 199a286fb46bdffe1d20c80bb6837b99f6c24d3ee714711f008b8c5bf5fe82d7c54e428424a6fd3d6d5434b3d2d49023dc54d311efc036e7d6e5e6cce7f85770
SSDEEP 393216:WqZCnLgPVPqmdBJAt6wRFCBLGxiACE26mQp:Wqdimdz+Jx
TLSH
T127378D4576F104A4C173D07C8A4B4686E772B81B47349BDB309CB3681F7BAF48A7AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lum_sdk64.dll

Path C:\Program Files\Hola\app\lum_sdk64.dll
Size 7.5MB
SHA256 8a616e44ad47ca0bfcacdb4129c3f31a51773fe7989a315bbe7fa7225fa4c600
MD5 6402e84f6144ae8ce8a9b44891961d02
SHA1 fee17b8b37776404be08f2565f34a798646050f4
SHA512 f575492393dca60d6f2b03fb050b3e855ddb9de4711ede839e3d5d4f3b4a82dcfa1c11bcc60c7141de6a6b785ae8790617f4ec4d110185ad4d70a55dd9ae15d5
SSDEEP 98304:6P2p2qQwMJVbWK7njSfFp6TH3oGFJiC6H:6P2EqQwMJVb3jSfH6TtFQC0
TLSH
T192860843BBA48D26D4BAB3369B535E11B7B2F04C6F53D35B21C8D7AA2D02742AD0531E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_updater64.exe

Path C:\Program Files\Hola\app\net_updater64.exe
Size 10.6MB
SHA256 abb2d27a60a6ba32932a205d1a01462a8052cfafb9827b35c7ed426c64655cda
MD5 3705cddfe259184c3bd0d092c80ba750
SHA1 1cf0a91e642e5926f14650a86f9f9a944c31912a
SHA512 dae4ad5e9f1264f24e72cc7439845649cbe5c530b208c92de85c00f7c135bcfe5f87d04ea20f1a141058b4f374078f041c675f3bb90499a7106626f814e1bb43
SSDEEP 196608:b1ZC68JxXS7/vwRP2EqQwMJVb3jSfH6TtFQCw:b1ZCh7SLvwRP2EqJS0fKs
TLSH
T14EB63A43B7948D66D4BAE336CB535E11B7B2B0486F53D3DB11C487AA2E03782AD2631D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Program Files\Hola\log\install.log
Size 38KB
SHA256 a6f6d9d34d36272ac8c61e5022f06dc37fcc3449547c0c6ea43070c205b8206d
MD5 1bd92ea66ccb9234bf3b520e6504ccca
SHA1 e75347a8767c8558c1d3273e8e0407ffa5d8384c
SHA512 d0ca24eca23b2a4b9d8dd2c0742a628ef1de5dad71e842e46f4af200909e62091c85b36eaa254c7c2cbf3909e35a125cef3244b0e1b913756ce559f467cea46e
SSDEEP 768:5fUNiYzUWsESMSLvfF4JmUmVnYODpdceTGcywIA0Oqa16eoapwqXwmHTX:NUt4lMSLnPVYspd7arLPgpwYwATX
TLSH
T13303D0460E24DB7797EB667A0D459C3BA0F984941814FA1CBBA7FA33C2B1B4D1E5012E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.log

Path C:\Program Files\Hola\log\install.log
Size 78KB
SHA256 11bf736f406a47aabee1154f9c1ffe6c666a95b6e1cf95662e9bea7391016f8d
MD5 a76d1a3ed1ca3ee26439aaae129f6e14
SHA1 6b69496bb86e1f6efd50d4e7557220eeb9291926
SHA512 77a3b348d2f7d256c848390e1bd80ded362dd58e2db2156d3c6d7f780e500fee944cad4af44660dae719156511cf277b6017d03da47d30304b1f850ae8d96865
SSDEEP 1536:NUt4lMSLnPVYspd7arLPgpwYwATsn05tN0vCK+NUalAZ0XsNUj5alnnZa2r8:+SySLn9lYnPgG3ATooSKK+SeXiq5aO7
TLSH
T1768302820331DB66D7EB6B190D53C96EF2F844502805F7155AB7F667F2F0A4D17C1A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260711_140112_once_02_sent_cleanup_1.638.850.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\20260711_140112_once_02_sent_cleanup_1.638.850.log
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

20260711_140122_once_09_install_ok_1.638.850.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\20260711_140122_once_09_install_ok_1.638.850.log
Size 65B
SHA256 e13e091a9cec08f60f3be8b626d42ad5eb37bb742cdc8f2c76e36e98020fd916
MD5 523285dab307f61cb4a3d5db205d6d88
SHA1 ef050db0910cc1d8b4f3527456b09400181651d0
SHA512 3c2844fcd7f02b3e42798cb8599d17e3d626910c660616a7e811da94515c0dc11ce36e3f18c75c4d2e3f2c636ce58bf0524ae15663c151faa87d67e1e89669c8
TLSH
T1A2A002AD5FC1226A34309652654F51B081267D5F002C574078CE05A6745B1553BFB5A1
MD5 SHA1 SHA512 TLSH

Submit Download

20260711_140124_perr_14_init_monitor.jslog

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\20260711_140124_perr_14_init_monitor.jslog
Size 1KB
SHA256 dbe5ca4964d7c9ae7bc289e7cb0ab5b9ad9c4786bb1fb00b77f35e9ce19f50ff
MD5 247c7a521c6e540eabeeeb7ab350183e
SHA1 da3ad637ec2a1330e9ccbdf55e833165c357b7aa
SHA512 652a2583b145385b67144817da7839e3e744d29359eb5943fd91de7375791af5348d095395e03d8dc4ceb2d680dedb4ef03e09feb36edbb50fcbf85791d3333b
TLSH
T10C210ACF423CA3B4643D6E8A90D775034D9E1B63CB01C778580068D9BAE226C7CA88C8
MD5 SHA1 SHA512 TLSH

Submit Download

README.txt

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\README.txt
Size 275B
SHA256 d2417966aefbd0685d52965685886e199931f5ae572708789c82e5d34698c9ed
MD5 81b03d842ebad0b269df70bd58ce38a4
SHA1 86c50d81613319859b98918f2a877cd9bb91c8ac
SHA512 ae53e8de521a4ac7a8af16e04e2eecfb34e9258781ced755daf5906fe4aecbc18d18797d3979457cb7fc63cb79563bc721b2d93d2be1955415d7b8644d215cae
TLSH
T1B6D02B5D31DC660108436352B348267327474BCD533E929C285DD3055FB2A2802CB00B
MD5 SHA1 SHA512 TLSH

Submit Download

brd_sdk64_clr.dll

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\brd_sdk64_clr.dll
Size 5.6MB
SHA256 b50659844ae612710719d31717b041925c95b495614d51ec098bf80fd09f5517
MD5 0638be75c0a1c14b64a302c075ef2fc8
SHA1 7b9c7c3764e3328d3737936d9cf952b334bd7d25
SHA512 023c9835adae0c0c4f0564140004cb9f9b380c67b7cc6bff0d3c1fa4ce045e93f0b44aff9649da24e395e1fbace7120f6ba380b2bddc2bb2b97dbd72a64dbc30
SSDEEP 49152:w2aodsNQlyy5gP3Hk4dw4V7ysWCCopvttkIEj1aj17v1MjAmfFrN6TH3o72T6OEL:w2p2qQwMJVbWK7njSfFp6TH3oGo
TLSH
T19C56C643BBA4CD22D4B9B3379B635E1177A2F04CAF57D35B20C8D7AA2802742AD0575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

brd_sdk_service.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\brd_sdk_service.log
Size 1KB
SHA256 9736783fdb93682fd6d17deed559665b7a29e5ffa8e864ba20caf60aef222b9b
MD5 5e46671c40d0f234ea675b2a2df9aba3
SHA1 9462b54dcda8f698f3721f07ae619dd3ce5158b9
SHA512 8eb5833967d759b3176127ebb6b29af6c75f4aa030fe37d27eed28fe5277c48c786476dc3ab2949f22071aba62669193b1c2ab31a68e1561e21a0799970f4319
TLSH
T15B31B772DC668472CC50423E6A19A701B1B7A0A851133710C9EB7F351AB6BC64BB992B
MD5 SHA1 SHA512 TLSH

Submit Download

brd_sdk_service.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\brd_sdk_service.log
Size 1KB
SHA256 fee7a3a9b83f90c9062ed7841919e0d62b7551d973f0f359b703c2375b0fae48
MD5 776f9a06beb46e673109b959d898eea3
SHA1 cbd4a1969dfe85104ba502bd751be0412b2ae473
SHA512 a6489f54fd8a7de17d42b79ce19e965a07bab94675ad3fdcbafc6b849f165264176b70ae0bf174fc2c1881abc49ce944efd088898e93d7e0b4704ed8906f2dc5
TLSH
T1F731CA61DD628472CC50113E6A165701B1B7605811537710CCE77F351B7BBC65BF992F
MD5 SHA1 SHA512 TLSH

Submit Download

conf.json

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\db\conf.json
Size 201B
SHA256 5c43ede7deede301872aa3742fe8c284fd127e55d9a23f05c27679bd5e52fdfe
MD5 4143d9ae0176dd0f01f4e82eb5a6df4e
SHA1 2fed689558191a5a6a6321e664f86dcfe38c1ca3
SHA512 bcad7fbe12a69506fd90733b01f4b869c64db1b8670e13296d18de0008aebf0e954d88eb06fc768417202b9cb6a9f2fa372b02e2d1230eb52b8a3952516912a3
TLSH
T118D0229003C82A23A8223EC05396CA29028EE318580E49CEA0A23CC2859C475AA349DA
MD5 SHA1 SHA512 TLSH

Submit Download

conf.json

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\db\conf.json
Size 463B
SHA256 8f9887410a90d58ee3938db41fce41953a6ac3cc73368523fd7cbc203c49691b
MD5 f1cb0b49fc90fad7b31c3b3e5c7ec641
SHA1 c8d6b61e82dcf4fdc5fba3618dc433b03b69102f
SHA512 7d58b0c29e1aaf2d8374cc8e74c077607275150a0ecee6b50d678322fecc927bc1e88ab79fb8c4b8d69dd11aec37ddf4e5e32c6e843771f92b0e77fd6237e577
TLSH
T11AF054DFC362A18B41F8D09DD74F04AB1411B04979244507512D5015B4016114E9A534
MD5 SHA1 SHA512 TLSH

Submit Download

conf.json

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\db\conf.json
Size 6KB
SHA256 2f3356f003f1d4192d11a54cbb5f5b01dea58e86ef0b614e8d4d8a575aa4783a
MD5 5e9fbb3a51e40575d54e62731422069e
SHA1 8986cff91564b591fe1d4cfce96526273e9d0f2f
SHA512 25f02e6f1d519a0b9dbc7a00de273c6df72ae470efdf98985ccdb9d04319ce7cacab7152abec29a05baed287d09f6b74eadb2028216bbe3f9fe17ad21669bbad
SSDEEP 192:BU2azZM2b4S3WmOXDHwmLxkGQo26l7HbGnVSl:K9Gm6HwmLdt77hl
TLSH
T1A2E17C4568217F3B46A87390A8B5721D9BABC8C1F43D4BA655BF7CC33663E740521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idle_report.exe

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\idle_report.exe
Size 801KB
SHA256 f75f17c159294dc974e033e34059920e30d595db223f41602416aa067aee28cd
MD5 49b358e35cbb9e1cf05ca4a7cc5e0b74
SHA1 1c53650b8872c65b3d04994beaa171faabccd438
SHA512 72d454274220ee9c3e8cc36e74d3a7416d11c940db46f6260a55cb3fb3fbaf0560fcf637372b49eebc0ab2793ab07345105582d128dfce856a077522bd83cc48
SSDEEP 24576:J7oT1xaqq7v1MjACXjhOHlb7KfoPwTGJe:Jj17v1MjAmfFl
TLSH
T17B055B55BBE8CE57E09E3B77E8B10A182BF0E14AB362EB4F594855E81C173004D917AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lum_sdk_session_id

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\lum_sdk_session_id
Size 128B
SHA256 148ceeb9ba0f69b185fd8af45892e12f01bba158d7b84732f8ddd13adfd561b9
MD5 75217d269f684077758da37695f8d19a
SHA1 8cb7024c8e0e102fa28abe244d5a708c114fa639
SHA512 e2b41cddab5434c58393f1c469bf3037b18b8be1e63fb660e610055ac71334264c010cdc4c531a6122fa16d7bf9af45580713a970d3b58b87fe6b46923b1d4ef
TLSH
T14FB02B42309000B9343793C45C439041C5C230132D1ED920A55744FB0E010BB8840130
MD5 SHA1 SHA512 TLSH

Submit Download

msvcr120.dll

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\msvcr120.dll
Size 940KB
SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
MD5 9c861c079dd81762b6c54e37597b7712
SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
TLSH
T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_install.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\net_install.log
Size 4KB
SHA256 96b9d8afbe024f7fa166f64aab5005e9f9248317ac25a5f663243c3c2af87bd0
MD5 2799bb00d71dcbb623d74104c26410d2
SHA1 57fd955d19e44dde312959b9a20ff4aecaa7abb6
SHA512 601a8cbf5dfcae978c3febb3cafd9b8eb9550c9ac591ca177917060635b60ba451b172e5fa9e5cf458300bf1a5f4b74f7edb20319c6dfd083ea6fe0aba3c8a76
SSDEEP 96:k/sv64faxVGWakLwfTLqmOtuoPsjeXzwKYRV3WGc3RLwod:8sCDFgLqm45kIzo3WGc3xwod
TLSH
T14D814BEB39D0ECAB017004935E7E63B1144B649A372BFD2E2903BC269399F0516951BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_install.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\net_install.log
Size 4KB
SHA256 2f68656775c1810ab54be8405fd732d0374a06202e43164d973828c87d0a39dd
MD5 dfc4d7608f81d5bf80e3be1060b1f3fd
SHA1 1127a9dcd5939778ca47200cf12cf5d9f24a7e44
SHA512 a7e0423aabf10ba1189337ed13834af7c5d4a3ebabcf55922733fd70f4c3b0e61d8daaeedc914a565279cb1f94a2cefff290100c879e6d0821959632203a0915
SSDEEP 96:k/sv64faxVGWakLwfTLqmOtuoPsjeXzwKYRV3WGc3RLwok:8sCDFgLqm45kIzo3WGc3xwok
TLSH
T1E1815CEB35D0EC6B413004935E7E63B1144A645D3B2BFD2E2903BC2AC399F4616951BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net_updater.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\net_updater.log
Size 2KB
SHA256 1f852caebdea6417dee746df2d53e7b4b6f9d9625dcf40a93b2412c71da9b17f
MD5 eaf46a8330163ff10b80b5975641d2fc
SHA1 ac227a589a6dab99cc5d5b36bb7e4a6914ad3cf6
SHA512 55884a04734ab6ad8bf1ead7c28c4f036b52da799e8d0cf33be44368a99fee20610cb97ac52e1a4f221c55bc06e24771138ac6403540677a3b8b575efcea7c10
TLSH
T14A514942BE47DE7DAA41227F032E7505839E010A052172EC1BEFB803C3860A2A2CE13B
MD5 SHA1 SHA512 TLSH

Submit Download

net_updater.log

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\net_updater.log
Size 2KB
SHA256 e7f7a5850c4a9963a5aa67e957c3006f9d88b2786dc4397893f44090dfdb26c5
MD5 fa5fbe228f5c65c41a3459619cd8b2d7
SHA1 2e034eb3a870af62d951e64acbbc9e139e1d776d
SHA512 030abefec6e09069a2ddcf7c5a3277615e9acee56b8379bad926d914d0c608b2232ed6b1bd1f455a82b93b8066b295504448844ed444314c1cc34eacc3304a2c
TLSH
T173515B52FE17EA7E6A05227F032E750583AE104A192272EC1BEF7813C3454A3A2CD03F
MD5 SHA1 SHA512 TLSH

Submit Download

test_wpf.exe

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\test_wpf.exe
Size 30KB
SHA256 824955f0ee61d086759e7dca8c68643804e8056c116089dc16cc75275be67c1c
MD5 22db9b97f6cd9e2c595a088fe01beec5
SHA1 571d4bb5f504de381a47f24054a42018f4f6bd56
SHA512 faf103e112e0c6e4a78ef2d246d80baab48f8d0c649d1ef8fd06839de3dd89fbb4bf3914d4b17c3935f0f76e9600f81b97c17ca7530aacdea5585d5d9a2a9dd4
SSDEEP 384:20msPF7YgcZPaxrZlh6OWRsNyEIYi2mL4/y8Rxa8IhQIYiBVwl6y8RbmL4nNyHzm:2sfhxWRZYiDLk5uYikg5ALs
TLSH
T1A8E27DA3CDE41811DD274D30B4D49636EEB2F2966AE1C6DA3148C15ACF523433FDA2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tid

Path C:\ProgramData\BrightData\108a47921d08860d64656218998ab66204caf497\tid
Size 64B
SHA256 934c217a6d71cf8b22b99db226f9f13cff22af950eae9418fcb9d60134d73958
MD5 450701cfc2992aaba7da16b91af04631
SHA1 d267df3deced36947687cd7a417c8e546f30e8db
SHA512 768c8240d9fc36ab3f9b0f54c0c0bcaaad4736e7eb2421f4a8ab494c87a3a7507f898c7ce409eda3d06124aa7a60e7bcb0779e4f7acf7052cab5e20d9c83dc86
TLSH
T1A5A002C204D1BF6A1178C799C021C1A3035B1A95B9743765BD04ECD7890517F9001B7B
MD5 SHA1 SHA512 TLSH

Submit Download

2cd9fa95e3c904825b2bd2f286ed4ce1529c077d

Path C:\Users\Admin\AppData\Local\BrightData\2cd9fa95e3c904825b2bd2f286ed4ce1529c077d
Size 33B
SHA256 d42fb7689edad0a8e3301dceb09784e28b58fa57118222a91dc4cbf8ed6b32a3
MD5 60b30a77bcb7639d49e8a11148335955
SHA1 a82e51409e367aef548eb80adc7c17767854a713
SHA512 c8d9dcb18464024f64af0bf3d8ee7abd6b640284d4ab91313f521924cf300a725cc671c565735d1bddce25d6ca4ae61151c5e68c38c65f53d02fb1fed89bb8f6
MD5 SHA1 SHA512

Submit Download

Hola-Setup-x64-1.255.468.exe

Path C:\Users\Admin\AppData\Local\Temp\Hola-Setup-x64-1.255.468.exe
Size 10.1MB
SHA256 a0bbb45afd279ec824dd0036c1491d08981aa5026a932d120509bde8c6a83394
MD5 60f9c172f138676b69a79f7b3748068a
SHA1 5bf3a8109fa3633127e8e0cd08de18b7db0cff4a
SHA512 d2e4553762d165f2f2f4dac3cb8a7b1af8324cf592eb41ec64ce424c6d5f7d1b34344f55f3782103d8b2ca8f4329e68748756d529a011f1281c63e945913482f
SSDEEP 196608:m7AC6E5srAxq8FzsRfr28mF1FjSMCefJyDRwZpTKlfmYbrlEh8W81:jHEarYqzidFGnefJC8BqE8W81
TLSH
T1CDB63361F5625051C2C93EB0A99E2F95CF7B5EB48AD2A44B25FC3CAFD16B3025B3C064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hola_setup.log

Path C:\Users\Admin\AppData\Local\Temp\hola_setup.log
Size 10KB
SHA256 3c27eeb7a823bc01c6063b1d883b57e5f4b4d49b0de6633817ec8871fb4d2ed1
MD5 1bbdf3c0aa90f3d9a36efdc4a7d2873b
SHA1 788db2057c2388b0ab3296b0da18b1308c59ab15
SHA512 1c62d622f0760a4862131461e3b4e901c928dc4e854be412564526952914017370392f36406d489f115a0a0b3dbb57a630c50833bbfc98f639143881ed7869af
SSDEEP 192:jWMEI2SlvdHpNMhbmkjG4jyPfbP1wzd7fgK0H2VbATvmBimCDejFz+erLyE:jWMEk9GmiFjyPfb4ffQ2Voc/CDazDfyE
TLSH
T1B432C06B6FE29B28F8EBA46441AC1C56B92073E669E5F990B057B09CC43F02482F9701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9d583691-cc0c-437a-b61b-eeace0223532.tmp

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\9d583691-cc0c-437a-b61b-eeace0223532.tmp
Size 6KB
SHA256 25a20191daff7e4a14c9a8bf1815983745328a02f93b277fb9d42422e606f73c
MD5 f7a32cde84e256ee215091f07aa55470
SHA1 db662e8556666cb271704492faad3196227570bb
SHA512 db8ca981dd0800d7c3642260fe77622eb2f2673d37c5417515c3acba64d85995be8505c0634879fa7bd356888ae1533fcdbab8a41d7fff4a0e910375839a3ed4
SSDEEP 192:2aVQ+ONgQH+OUYfWDzXUGWDyRCprDUfp16+OSQnN:2aVQ+OHH+OU93XUGAyRirYNuN
TLSH
T133D1D94A5015DC7B2AE653ADB40ABDD1DF7C12135194BFD8D5EE481C0BD66DC130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Crashpad\settings.dat
Size 40B
SHA256 c0794354f8598a35944f9dfa98c928d84b9537c5531a6a96515af0c4b97ac8a8
MD5 99b4a79ba99665fa2d1afc9d52b45c1a
SHA1 7748bb964c34d42ad27102b6b6b00a5ec23f6dd9
SHA512 84f1dc6393c6eb45896bd82cf673aceeacb10e2eb8f647e2e4b0ab7e40d71409b5c7659144a362fc92cb9e1724b5633dbcb8c533d885d0220cc8dd529c2b119a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 9b71c6e0ac375b75c03a5eae7abddf24fb909ae9e9f163764c3aceb67d3727f2
MD5 6cf01aea024404edf5e1f0ffef05b5c1
SHA1 1c915699c22eafd26c8fd52d11e1943a029c04c2
SHA512 5abab333da49c2fef6c251e5d3052393fb97848cf741886cf73a9c5421e96625638dd85af6a950e7de7c1c8d258e4b9bdeb747a9e749104d8f6d4477a4b8b3fc
TLSH
T1DE31D9F011A113A4D76CCA3A1C932ECC222727971B743F1B2710F0306B06DB06906A38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5be3b5.TMP

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Code Cache\js\index-dir\the-real-index~RFe5be3b5.TMP
Size 48B
SHA256 1ceec3037c56d4655a3dece3a98e786beb9998928dfac1e92b3ff6debb8fe7b9
MD5 2b3b83182743efd6b37bd6e618e0c6d8
SHA1 5f96de846f65f7dee9c22b775458fc5bea0089fc
SHA512 7a5f19c9067c90ce21aeba93599fcdc7b13915e4263bf4ee78ee75ebb2fbaf698ecfb48b50243c0538abe13d8aeb856d92286e229dec79940ff2f60a89fa3774
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Preferences
Size 10KB
SHA256 fbc3f53c64fb7cb9680e5801ed5dfebe1473721efbb149cfc90485cf545e8f15
MD5 be02df4b38c1b5bb69f20a6229bf298c
SHA1 456017c68b1d45e6569d2fdf37f05480ffc521b5
SHA512 49f8bc8fe621327f097597259bc50af7a35f13e5ad4a6dc01e4b87010e40b92811896f58aa9b2b7a2ded56210e1d01848b2e6087646ca0335c84fd4708aeef37
SSDEEP 192:zRZP9fd8AXhbo86AcUDv7ZZFMgXsb+WNmKeileXUGWDXXFOd:zRZlKARU86AcU7jXwDleXUGAXXO
TLSH
T16E22942BFE5065376CCFD26EBA257AB3E6F9142562C04E8467FCC62C03D56CE220745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Preferences
Size 10KB
SHA256 cf86ba62629012447eeccce13d117886d347e8ddec6a523281ea5eaa331b8d44
MD5 c43d0362c77c9cc94e59ba36490afad5
SHA1 aea91599342b91e7608e18ee6a04d352fb285a0a
SHA512 b0f53df03d5067bee49a59af7268f990b52b2d45fa354d0b97e2111e14d583a810a7a00f8f79fe9036cea57b3eabd2fb36f19cae325a4f1ef312ec8d2214ae6a
SSDEEP 192:zRZP9fd8AXhbo86AcUWv7ZZFMgXsb+WNmKeileXUGWDXXFNd:zRZlKARU86AcUijXwDleXUGAXXR
TLSH
T1C922842BFE5065376CCFD26EBA257AB3E6F9142562C04E8467FCC62C03D56CE220745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5be4de.TMP

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Preferences~RFe5be4de.TMP
Size 10KB
SHA256 14c56131f6881bdb6f480d33eae02b095d184966ce2f308acf9242d9f67ddec6
MD5 96e702b6b47775b6896a1319612ab947
SHA1 c2fc1ea2c9393e63b41c8180ebfdd08525c7ec58
SHA512 40ad687a9a75bae64e28d894f96fe35ede0a4a0fa187e81fe47e335397a9cfbd0daf7169c44ab900493bcd6e44b0b26c98bc717d0203eb4967009fe54bf7f32d
SSDEEP 192:zRZP9fd8AObo86AcUxv7/ZFMgXsb+WNmKeilIXUGWDXXFOn:zRZlKAOU86AcUhJXwDlIXUGAXXo
TLSH
T14122842BFE6066376CCFD26EBA257AB3D6F9142562804E8467FCC62C03D56CE310745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Local State
Size 10KB
SHA256 4c394fa5e81e77e0d9581d95a16804b1a194481bff33c5519eb25c8295650a80
MD5 e871b2d04a7c43362e42c7b669aecdd8
SHA1 a8388b7916663bab824c3a4840a83f94ee0c3f6f
SHA512 4f8f8003e40f56ad9b5177fcad15918919b378240653cb402a96bd285d3a0abe0ff91e9dee96e913266e382d614207727a64edd31ba09b35425ac8441c449469
SSDEEP 192:2aVQ+ONgQH+OUYfWDzXUGWDyRlprDUfp16+LuFM/XeYSQnN:2aVQ+OHH+OU93XUGAyRrrYNLJ/O8N
TLSH
T1C822856AE60ACD7BACE753995705BDC6DB3842111284EAD49DD64C0C0ADFAED320F81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Local State
Size 10KB
SHA256 cd834f74d0982d98e92608cd66fe48176ecf08cdc69cd8d41c711d6f1989ff76
MD5 8904b104ee4ed432335df43412bdc75e
SHA1 1ae46fcb75475893aa635750aead1eb6f010f200
SHA512 d049cb6b21ea1e4fc2631a03fcfa6074cb5eaf8651a85f03f2df99cfef64d99d9973f35f078a0c5f9618b685d5e1473285a6cccbff3ec7c7f02bef28d6e8b0d6
SSDEEP 192:2aVQ+ONgQH+OUYfWDzXUGWDyklprDUfp16+LuFM/0eYSQnN:2aVQ+OHH+OU93XUGAykrrYNLJ/p8N
TLSH
T1A422856BE60ACD7BACE753995705BDC6DB3842121284DAD49DD64C0C0ADFAED320F81E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5b948c.TMP

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\Local State~RFe5b948c.TMP
Size 1KB
SHA256 51754965ae558a2229849408fd634ea7d2ce528a9c76b35c997cbf2524111572
MD5 d62609f1638e773025d5ebe34ece1814
SHA1 5be872dff88d8b7189e80c6f6a577e4942cac43d
SHA512 af1da0f27538c7533193df6702838d411200674313ad11069c39b3b3ecfe81f94e5c42c0e04734feb76adc1b1d70e2e4bb03e8d9e70a321274dbee65fbf21e16
TLSH
T13511A5B2A4606EA1BF4205BCA782C1A35CE52136C2850D8C93DD12040377698330B835
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\component_crx_cache\metadata.json
Size 132B
SHA256 de65875e6916430c9a596f22cc81df2a0a1243720e4eb52c212102c6dd61dc93
MD5 1df1f472f9fc202c6acb8dd6270a4e66
SHA1 e7be0d233b18f8e8ac7c60244ea936b8f2d05c3c
SHA512 55ba0baa8fc40b67c802804d593c8da21dc5a8ccdea10ea2eb46f785940507ab726f3d4b5877a3308c12e0834db8132e75979c4d5c95f62e9fcf4c0da1379ae0
TLSH
T15DC022003A0002C30FCC3B0E2C2200B80ABB00233A3A23A8B80BA8A0008EB2F0C8000A
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Roaming\Hola\chromium_profile\component_crx_cache\metadata.json
Size 252B
SHA256 5c7048f4499bbf27443740db4a738b05e2906323f2fb7254af8b5a3f01e7af0c
MD5 dd8b7ed0772ae40d7a62cd1616a8a341
SHA1 e3371917ed3cecf0a312364eafd49678af89f096
SHA512 8ff2976fa614360f20f45b4d5cd9cddcc751517c8f260d390929535398a1289f64dc5985fb73d34dbf2e0c7fc9215b450432b93748898a9bd90e894520399674
TLSH
T1C6D097881AAC02E56F8C6B3F1C3E08B6C6ABAE03383422BCB407A860246C71F1881017
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 13ee25c5b7437e10564276ce7bdc670c7d32ebab6874756a750bbbbdc42da7f1
MD5 ffa218b66065af19c70aefb5574e93af
SHA1 f98781b37ae1e110fd0ba9a825d5b99ec4c93648
SHA512 d11924658bccd2aea65a0c6c24ee642f512ba1376846d89a559dbcdc4726f5322696da9a1999fc3bbd65ab61ae7905ad980f5b59f61cc1d34a647fd49ab7fd4e
TLSH
T1C8F0DC3F547F69E22003807C25F94A353062A29D0ED7C27A303408C1CE863D6F54F916
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2
Size 727B
SHA256 b59430b73a067090b1258776ec72b800b01580d516ab9fe4abadfa414ce7f668
MD5 fdb65df4cc6e6890dc703b53b7d8d98e
SHA1 019c58a526fcccc5d3aed1b107a0bb9dafea6835
SHA512 6061fa9fe3cea9b8123d7665d62fc8630b41eed17344e237bf55411251750b3588f94b56e777c4b12dbeee49df8099927a224ce0efbb017294a4d01a6b25912f
TLSH
T14A01443785780DF55B96EC281B672BFFBB0417A079E508B9A77328C2940D318ED11229
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 0de519a6bc61698f45a98049e46845cb14bc2724558f5c1a8e368a030254bf15
MD5 e6ac9e69ee77f19d0c80ff5e5834b260
SHA1 796444616132b230bb51d4ee92d3baa8e8db3b0a
SHA512 efb6fdcea2bd008821220445a17b80a6e619ffecd5a581a863237fb3a9c959c52a3d752278ff8a2270648ce660b1c844ce0f71d925b750cc39f1816846eac261
TLSH
T15F01650314DA18D0B9115D07E6CCC47FF23B608955C453D379B410252A6E640B96B8F0
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 b8703bd3e4670a902e1ffd936eec628e48a138c0c65d49af4e471dfcfe0d2f92
MD5 034dbc10791964bb12096d9988a0d77f
SHA1 779780f8c326829cbbbca5caa8688930089c6459
SHA512 9e9dad4cbb1e2915aa4047420b0718f8572b9dc59567fbd52e1d8893cb09a3c551f3378eeec1a71b115fd20ea8252d948c22500f4007c8a949c0ccd82ed11bea
TLSH
T1ADE0262027FA202EF1A0DB7943D5919AAF3AF2032C4597BE1EC1542E9D1EA005CA2D71
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_A50F634C213670A8CF2DE94371779EF2
Size 404B
SHA256 62fd3533ae1f2e1b1e37f112f228157c644b9cb7ffe19c20d78a95f6665fb1e8
MD5 e70a85266babfe5cdd161ccda96dbbc1
SHA1 968be0bcf103178049d9119facaf44f97dce06a0
SHA512 0f6085e2b688e5447469b826d7df76e20af1fc1a820ec1dd855947e3e03cb1ae5b3547179bff3f54ed3b04fd1a9e1e8e914ebfb2ede6c50c4bbc5f033a485ec9
TLSH
T108E0C63823FA801FF2F0E43803EA9C222C9CF20A140183A80A004392EB22E804CA2930
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 580c468b9839eaa93a60ac5ba32ce55aca0294870d1035650aea70ed7749f495
MD5 cdd610866b5048067a7b47b9a1851a9e
SHA1 d49f53d94094801f8e223a1374c71c9ef2979225
SHA512 dc0abf0492205bca625a014a1dcfe7d5d6d43842bd80551ae3607fc2382bd812a5d6f303202c2101bcedbc14f2ea42d636e80871a20ad301c21813e7d4b7b99c
TLSH
T197E0D83826AB655EF0509C7546E9A1765E59E305544497B916D0430ABB2AF405C609F0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/264-484-0x000001A48DC60000-0x000001A48E604000-memory.dmp

Download

memory/1172-276-0x0000000000F50000-0x000000000101A000-memory.dmp

Download

memory/1624-16-0x000000000A6E0000-0x000000000AC9A000-memory.dmp

Download

memory/1624-0-0x0000000074722000-0x0000000074723000-memory.dmp

Download

memory/1624-5-0x0000000006CF0000-0x0000000006D2E000-memory.dmp

Download

memory/1624-4-0x0000000005C00000-0x0000000005C56000-memory.dmp

Download

memory/1624-3-0x0000000005250000-0x0000000005302000-memory.dmp

Download

memory/1624-2-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-18-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-9-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-19-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-20-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-25-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1624-10-0x0000000006F50000-0x0000000006F58000-memory.dmp

Download

memory/1624-6-0x0000000006CE0000-0x0000000006CEE000-memory.dmp

Download

memory/1624-15-0x000000000A080000-0x000000000A112000-memory.dmp

Download

memory/1624-14-0x0000000074722000-0x0000000074723000-memory.dmp

Download

memory/1624-12-0x0000000009350000-0x0000000009372000-memory.dmp

Download

memory/1624-11-0x0000000008F90000-0x0000000008FD4000-memory.dmp

Download

memory/1624-17-0x000000000A280000-0x000000000A5DB000-memory.dmp

Download

memory/1624-1-0x00000000000D0000-0x00000000004EC000-memory.dmp

Download

memory/1624-476-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1676-7-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1676-8-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/1676-13-0x0000000074710000-0x0000000074ECC000-memory.dmp

Download

memory/2000-87-0x0000000005680000-0x00000000056A2000-memory.dmp

Download

memory/2000-86-0x0000000000D80000-0x0000000000D88000-memory.dmp

Download

memory/2844-110-0x000001F8E1AC0000-0x000001F8E2042000-memory.dmp

Download

memory/2844-111-0x000001F8E2630000-0x000001F8E2652000-memory.dmp

Download

memory/2844-109-0x000001F8E2060000-0x000001F8E25FE000-memory.dmp

Download

memory/2844-157-0x000001F8C8C80000-0x000001F8C9624000-memory.dmp

Download

memory/2976-467-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/3712-262-0x0000027DF55C0000-0x0000027DF5F64000-memory.dmp

Download

memory/3712-290-0x0000027DF55C0000-0x0000027DF5F64000-memory.dmp

Download

memory/5428-458-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5428-296-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5428-440-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5440-292-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-426-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-924-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-474-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-964-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-1034-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-609-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-198-0x0000020FA6920000-0x0000020FA6E48000-memory.dmp

Download

memory/5440-245-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-461-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5440-1009-0x0000020F8C7C0000-0x0000020F8D164000-memory.dmp

Download

memory/5540-282-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5540-101-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5540-244-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5540-33-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/5540-285-0x00007FF6F4890000-0x00007FF6F7A80000-memory.dmp

Download

memory/7100-978-0x0000000005D60000-0x00000000060BB000-memory.dmp

Download