URL:

https://urban-vpn.com

Full analysis: https://app.any.run/tasks/83c406fc-892e-4747-b8ce-bd52ad81aa15
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 28, 2020, 05:01:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MD5:

45D746379D18200889084A76FACA8F0D

SHA1:

E58B8074E363A9E0B010983F5FDD4AAC4BB1543F

SHA256:

6227B78F922FF05B99695D57CB8A7DA96DA49AF75FB5F4EF4076707C09CC5615

SSDEEP:

3:N8aihn:2aU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • UrbanVPN2.exe (PID: 3800)
      • UrbanVPN2.exe (PID: 1672)
      • UrbanVPN2.exe (PID: 3588)
      • tapinstall.exe (PID: 756)
      • tapinstall.exe (PID: 3416)
      • nsA910.tmp (PID: 2276)
      • nsAA69.tmp (PID: 3880)
      • urbanvpnserv.exe (PID: 2844)
      • urbanvpn-gui.exe (PID: 2744)
      • UrbanVPNUpdater.exe (PID: 3776)
      • UrbanVPNUpdater.exe (PID: 2736)
      • urbanvpn.exe (PID: 1760)
      • urbanvpn.exe (PID: 3792)

    • Loads dropped or rewritten executable

      • UrbanVPN2.exe (PID: 3800)
      • urbanvpnserv.exe (PID: 2844)
      • urbanvpn.exe (PID: 1760)

    • Changes settings of System certificates

      • UrbanVPN2.exe (PID: 3800)
      • tapinstall.exe (PID: 756)

    • Loads the Task Scheduler DLL interface

      • UrbanVPN2.exe (PID: 3800)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 820)
      • UrbanVPN2.exe (PID: 3800)
      • chrome.exe (PID: 4036)
      • msiexec.exe (PID: 2152)
      • MSIA731.tmp (PID: 1336)
      • tapinstall.exe (PID: 756)
      • DrvInst.exe (PID: 2192)
      • DrvInst.exe (PID: 896)

    • Reads Environment values

      • MsiExec.exe (PID: 2164)
      • MsiExec.exe (PID: 2780)
      • MsiExec.exe (PID: 1672)
      • UrbanVPNUpdater.exe (PID: 2736)

    • Application launched itself

      • UrbanVPN2.exe (PID: 3800)

    • Creates files in the user directory

      • UrbanVPN2.exe (PID: 3800)

    • Adds / modifies Windows certificates

      • UrbanVPN2.exe (PID: 3800)
      • tapinstall.exe (PID: 756)

    • Reads Internet Cache Settings

      • UrbanVPN2.exe (PID: 3800)
      • UrbanVPNUpdater.exe (PID: 2736)

    • Reads internet explorer settings

      • UrbanVPN2.exe (PID: 3800)

    • Executed as Windows Service

      • vssvc.exe (PID: 2296)
      • urbanvpnserv.exe (PID: 2844)

    • Creates files in the program directory

      • MSIA731.tmp (PID: 1336)
      • UrbanVPNUpdater.exe (PID: 2736)
      • urbanvpn-gui.exe (PID: 2744)

    • Starts application with an unusual extension

      • MSIA731.tmp (PID: 1336)

    • Executed via COM

      • DrvInst.exe (PID: 2192)
      • DrvInst.exe (PID: 896)
      • DllHost.exe (PID: 2648)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2192)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2192)
      • DrvInst.exe (PID: 896)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2192)
      • DrvInst.exe (PID: 896)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 896)
      • DrvInst.exe (PID: 2192)

    • Creates a software uninstall entry

      • MSIA731.tmp (PID: 1336)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 2152)

    • Reads the machine GUID from the registry

      • urbanvpnserv.exe (PID: 2844)

    • Low-level read access rights to disk partition

      • urbanvpnserv.exe (PID: 2844)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 820)
      • msiexec.exe (PID: 2152)

    • Reads the hosts file

      • chrome.exe (PID: 820)
      • chrome.exe (PID: 4036)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 820)

    • Reads settings of System Certificates

      • UrbanVPN2.exe (PID: 3800)
      • chrome.exe (PID: 4036)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2164)
      • MsiExec.exe (PID: 2780)
      • MSIA731.tmp (PID: 1336)
      • MsiExec.exe (PID: 1672)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2296)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2152)

    • Searches for installed software

      • msiexec.exe (PID: 2152)

    • Application was dropped or rewritten from another process

      • MSIA731.tmp (PID: 1336)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2192)

    • Creates files in the program directory

      • msiexec.exe (PID: 2152)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2152)

    • Manual execution by user

      • UrbanVPNUpdater.exe (PID: 2736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
44
Malicious processes
9
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs urbanvpn2.exe no specs chrome.exe no specs urbanvpn2.exe chrome.exe no specs msiexec.exe msiexec.exe no specs chrome.exe no specs urbanvpn2.exe no specs vssvc.exe no specs msiexec.exe msia731.tmp nsa910.tmp no specs tapinstall.exe no specs nsaa69.tmp no specs tapinstall.exe drvinst.exe rundll32.exe no specs drvinst.exe msiexec.exe urbanvpnupdater.exe HNetCfg.FwPolicy2 no specs urbanvpnserv.exe urbanvpnupdater.exe urbanvpn-gui.exe urbanvpn.exe no specs urbanvpn.exe

Process information

PID
CMD
Path
Indicators
Parent process
308"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=752 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
756"C:\Program Files\TAP-Windows\bin\tapinstall.exe" install "C:\Program Files\TAP-Windows\driver\OemVista.inf" tap0901C:\Program Files\TAP-Windows\bin\tapinstall.exe
nsAA69.tmp
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.10011.16384
Modules
Images
c:\program files\tap-windows\bin\tapinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,3967033850194922197,14717606820820930368,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=13315751511874919929 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2532 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
820"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://urban-vpn.com"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
832"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=956,3967033850194922197,14717606820820930368,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8668111439679436218 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2504 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
848"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=956,3967033850194922197,14717606820820930368,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=2349242509746621106 --mojo-platform-channel-handle=500 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
896DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oemvista.inf:tap0901.NTx86:tap0901.ndi:9.24.2.601:tap0901" "6d14a44ff" "000005D4" "000005F8" "00000600"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1336"C:\Windows\Installer\MSIA731.tmp" /S /SELECT_UTILITIES=1C:\Windows\Installer\MSIA731.tmp
msiexec.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\installer\msia731.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1668"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=956,3967033850194922197,14717606820820930368,131072 --enable-features=PasswordImport --lang=en-US --no-sandbox --service-request-channel-token=10957066122812151702 --mojo-platform-channel-handle=632 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1672"C:\Users\admin\Downloads\UrbanVPN2.exe" C:\Users\admin\Downloads\UrbanVPN2.exe—chrome.exe
User:
admin
Company:
Urban Security
Integrity Level:
MEDIUM
Description:
UrbanVPN Installer
Exit code:
3221226540
Version:
2.2.0
Modules
Images
c:\users\admin\downloads\urbanvpn2.exe
c:\systemroot\system32\ntdll.dll
Total events
3 770
Read events
2 787
Write events
913
Delete events
70

Modification events

(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(308) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:820-13240386099953750
Value:
259
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(820) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2832-13239195546717773
Value:
0
(PID) Process:(820) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
63
Suspicious files
94
Text files
322
Unknown types
24

Dropped files

PID
Process
Filename
Type
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\5d6b3fc7-03dd-44a5-8f4c-52020c8f1f0d.tmp —
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RFd6aef.TMPtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase\000001.dbtmp —
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFd6ad0.TMPtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.oldtext
MD5:—
SHA256:—
820chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFd6ac0.TMPtext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
50
DNS requests
38
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4036
chrome.exe
GET
200
192.124.249.36:80
http://ocsp.starfieldtech.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D
US
der
1.70 Kb
whitelisted
4036
chrome.exe
GET
200
192.124.249.36:80
http://ocsp.starfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D
US
der
1.74 Kb
whitelisted
4036
chrome.exe
GET
200
192.124.249.36:80
http://ocsp.starfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQDvWScomp%2Fa2w%3D%3D
US
der
1.80 Kb
whitelisted
2844
urbanvpnserv.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2844
urbanvpnserv.exe
GET
200
207.38.88.85:80
http://config.urban-vpn.com/enc
US
prg
1.95 Kb
suspicious
2780
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2780
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2780
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2780
MsiExec.exe
POST
200
148.72.152.76:40004
http://analytics.urban-vpn.com:40004/tickets
US
—
—
malicious
2736
UrbanVPNUpdater.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAPn4jAHZaPK76ctC%2FxFPsQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4036
chrome.exe
147.75.102.199:443
static.hotjar.com
Packet Host, Inc.
US
unknown
4036
chrome.exe
91.201.28.212:443
urban-vpn.postaffiliatepro.com
—
—
unknown
4036
chrome.exe
147.75.33.233:443
script.hotjar.com
Packet Host, Inc.
US
unknown
4036
chrome.exe
185.60.216.19:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
4036
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
4036
chrome.exe
184.168.131.241:443
urban-vpn.com
GoDaddy.com, LLC
US
shared
4036
chrome.exe
172.217.18.109:443
accounts.google.com
Google Inc.
US
suspicious
4036
chrome.exe
192.124.249.36:80
ocsp.starfieldtech.com
Sucuri
US
suspicious
4036
chrome.exe
185.60.216.35:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
4036
chrome.exe
167.172.175.225:443
cdn.webpushr.com
—
GB
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
urban-vpn.com
  • 184.168.131.241
malicious
accounts.google.com
  • 172.217.18.109
shared
ocsp.starfieldtech.com
  • 192.124.249.36
  • 192.124.249.24
  • 192.124.249.22
  • 192.124.249.23
  • 192.124.249.41
whitelisted
clients2.google.com
  • 172.217.21.206
whitelisted
ssl.gstatic.com
  • 172.217.16.163
whitelisted
www.urban-vpn.com
  • 35.233.137.224
malicious
www.googletagmanager.com
  • 172.217.23.168
whitelisted
static.hotjar.com
  • 147.75.102.199
  • 147.75.102.13
  • 147.75.100.245
  • 147.75.101.5
  • 147.75.100.205
  • 147.75.102.197
  • 147.75.33.229
  • 147.75.102.203
whitelisted
urban-vpn.postaffiliatepro.com
  • 91.201.28.212
  • 91.201.28.211
suspicious

Threats

PID
Process
Class
Message
—
—
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
—
—
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
—
—
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
—
—
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
—
—
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Process
Message
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
UrbanVPNUpdater.exe
Logger::SetLogFile( C:\ProgramData\UrbanVPN\updates\updater.log ) while OLD path is:
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
UrbanVPNUpdater.exe
Logger::SetLogFile( C:\ProgramData\UrbanVPN\updates\updater.log ) while OLD path is:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://urban-vpn.com