URL:

https://www.urban-vpn.com/thank-you-safe-browsing/

Full analysis: https://app.any.run/tasks/7220ae54-f6c3-4420-a8e9-4c75a7d3ef52
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: December 20, 2020, 11:43:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
loader
buerloader
Indicators:
MD5:

C677BE0EE351CE825E5BA3211DB39D58

SHA1:

0D80EE4BA0863EC0EDCE67CEDED76AC271E28E90

SHA256:

905F9D2EE033EB9FBA21C83848E31078B90CE87BC05A3A086809B587CC64C323

SSDEEP:

3:N8DSLEUKNiOelKWLCKn:2OLE22K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • UrbanVPN2.exe (PID: 2396)
      • UrbanVPN2.exe (PID: 2508)
      • UrbanVPN2.exe (PID: 3152)
      • tapinstall.exe (PID: 2176)
      • tapinstall.exe (PID: 3372)
      • ns3A18.tmp (PID: 1720)
      • ns3BDE.tmp (PID: 3980)
      • UrbanVPNUpdater.exe (PID: 2592)
      • urbanvpnserv.exe (PID: 1672)
      • UrbanVPNUpdater.exe (PID: 1536)
      • urbanvpn-gui.exe (PID: 3864)
      • urbanvpn.exe (PID: 636)
      • urbanvpn.exe (PID: 2544)

    • Drops executable file immediately after starts

      • UrbanVPN2.exe (PID: 2508)
      • MSI3803.tmp (PID: 2664)
      • DrvInst.exe (PID: 2772)

    • Changes settings of System certificates

      • UrbanVPN2.exe (PID: 2508)
      • tapinstall.exe (PID: 3372)

    • Loads dropped or rewritten executable

      • UrbanVPN2.exe (PID: 2508)
      • urbanvpnserv.exe (PID: 1672)
      • urbanvpn.exe (PID: 636)
      • urbanvpn.exe (PID: 2544)

    • BuerLoader was detected

      • MSI3803.tmp (PID: 2664)

    • Changes the autorun value in the registry

      • DrvInst.exe (PID: 664)

    • Loads the Task Scheduler DLL interface

      • UrbanVPN2.exe (PID: 2508)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • chrome.exe (PID: 184)
      • UrbanVPN2.exe (PID: 2508)
      • msiexec.exe (PID: 2536)
      • MSI3803.tmp (PID: 2664)
      • tapinstall.exe (PID: 3372)
      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 184)
      • UrbanVPN2.exe (PID: 2508)
      • msiexec.exe (PID: 2536)
      • MSI3803.tmp (PID: 2664)
      • tapinstall.exe (PID: 3372)
      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)

    • Creates files in the user directory

      • UrbanVPN2.exe (PID: 2508)

    • Adds / modifies Windows certificates

      • UrbanVPN2.exe (PID: 2508)
      • tapinstall.exe (PID: 3372)

    • Reads internet explorer settings

      • UrbanVPN2.exe (PID: 2508)

    • Reads Environment values

      • MsiExec.exe (PID: 3860)
      • MsiExec.exe (PID: 2668)
      • MsiExec.exe (PID: 2776)
      • UrbanVPNUpdater.exe (PID: 1536)

    • Application launched itself

      • UrbanVPN2.exe (PID: 2508)

    • Executed as Windows Service

      • vssvc.exe (PID: 3044)
      • urbanvpnserv.exe (PID: 1672)

    • Creates a directory in Program Files

      • MSI3803.tmp (PID: 2664)
      • msiexec.exe (PID: 2536)

    • Creates files in the program directory

      • MSI3803.tmp (PID: 2664)
      • UrbanVPNUpdater.exe (PID: 1536)
      • urbanvpn-gui.exe (PID: 3864)

    • Starts application with an unusual extension

      • MSI3803.tmp (PID: 2664)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)

    • Executed via COM

      • DrvInst.exe (PID: 2772)
      • DrvInst.exe (PID: 664)
      • iexplore.exe (PID: 3916)
      • DllHost.exe (PID: 1920)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2772)

    • Drops a file with a compile date too recent

      • DrvInst.exe (PID: 2772)
      • tapinstall.exe (PID: 3372)
      • DrvInst.exe (PID: 664)

    • Creates a software uninstall entry

      • MSI3803.tmp (PID: 2664)

    • Drops a file with too old compile date

      • UrbanVPN2.exe (PID: 2508)
      • msiexec.exe (PID: 2536)

    • Low-level read access rights to disk partition

      • urbanvpnserv.exe (PID: 1672)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 184)
      • chrome.exe (PID: 532)

    • Manual execution by user

      • UrbanVPN2.exe (PID: 2396)
      • UrbanVPN2.exe (PID: 2508)
      • UrbanVPNUpdater.exe (PID: 1536)

    • Application launched itself

      • chrome.exe (PID: 184)
      • msiexec.exe (PID: 2536)
      • iexplore.exe (PID: 3916)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3860)
      • MsiExec.exe (PID: 2668)
      • MSI3803.tmp (PID: 2664)
      • MsiExec.exe (PID: 2776)

    • Searches for installed software

      • msiexec.exe (PID: 2536)

    • Application was dropped or rewritten from another process

      • MSI3803.tmp (PID: 2664)
      • MSI78D8.tmp (PID: 1900)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3044)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2536)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2872)
      • iexplore.exe (PID: 3916)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2872)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2872)

    • Creates files in the program directory

      • msiexec.exe (PID: 2536)

    • Changes internet zones settings

      • iexplore.exe (PID: 3916)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2872)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2872)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2536)

    • Creates files in the user directory

      • iexplore.exe (PID: 2872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
87
Monitored processes
40
Malicious processes
7
Suspicious processes
6

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs urbanvpn2.exe no specs urbanvpn2.exe msiexec.exe msiexec.exe no specs urbanvpn2.exe no specs chrome.exe no specs vssvc.exe no specs msiexec.exe #BUERLOADER msi3803.tmp ns3a18.tmp no specs tapinstall.exe no specs ns3bde.tmp no specs tapinstall.exe drvinst.exe rundll32.exe no specs drvinst.exe msi78d8.tmp no specs iexplore.exe iexplore.exe msiexec.exe urbanvpnupdater.exe HNetCfg.FwPolicy2 no specs urbanvpnserv.exe urbanvpnupdater.exe urbanvpn-gui.exe urbanvpn.exe no specs urbanvpn.exe

Process information

PID
CMD
Path
Indicators
Parent process
184"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://www.urban-vpn.com/thank-you-safe-browsing/"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
532"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1004,14345771299736536923,9900199214025827053,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=12469261211033827198 --mojo-platform-channel-handle=1572 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
636urbanvpn --versionC:\Program Files\UrbanVPN\bin\urbanvpn.exe—urbanvpn-gui.exe
User:
admin
Company:
Urban Cyber Security Inc.
Integrity Level:
MEDIUM
Description:
UrbanVPN Daemon
Exit code:
1
Version:
2.2.4.0
Modules
Images
c:\program files\urbanvpn\bin\urbanvpn.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\urbanvpn\bin\libcrypto-1_1.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
664DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem4.inf" "oemvista.inf:tap0901.NTx86:tap0901.ndi:9.24.2.601:tap0901" "6d14a44ff" "000005C8" "000005D8" "000005E0"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1200"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,14345771299736536923,9900199214025827053,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12380142667893757014 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1536"C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe" /checknow -minuseractions -startappfirst -restartapp "C:\Program Files\UrbanVPN\bin\urbanvpn-gui.exe" -restartappcmd "-f"C:\Program Files\UrbanVPN\UrbanVPNUpdater.exe
explorer.exe
User:
admin
Company:
Urban Security
Integrity Level:
MEDIUM
Description:
UrbanVPNUpdater 2.2.4
Exit code:
3758096401
Version:
2.2.4
Modules
Images
c:\program files\urbanvpn\urbanvpnupdater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe"C:\Program Files\UrbanVPN\bin\urbanvpnserv.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\urbanvpn\bin\urbanvpnserv.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\urbanvpn\bin\urbanvpn.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\fwpuclnt.dll
1692"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,14345771299736536923,9900199214025827053,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2700673668782349423 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2892 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1720"C:\Users\admin\AppData\Local\Temp\nsz38AF.tmp\ns3A18.tmp" "C:\Program Files\TAP-Windows\bin\tapinstall.exe" hwids tap0901C:\Users\admin\AppData\Local\Temp\nsz38AF.tmp\ns3A18.tmp—MSI3803.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsz38af.tmp\ns3a18.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1004,14345771299736536923,9900199214025827053,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3238008968271065238 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2160 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
4 943
Read events
3 945
Write events
928
Delete events
70

Modification events

(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:184-13252938252280750
Value:
259
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(184) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3252-13245750958665039
Value:
0
(PID) Process:(184) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
65
Suspicious files
110
Text files
283
Unknown types
42

Dropped files

PID
Process
Filename
Type
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5FDF390D-B8.pma —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF1431cc.TMP —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\6b831184-07b8-4076-a8bd-6460d1d707e9.tmp —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000048.dbtmp —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
184chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF14348b.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
91
DNS requests
58
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2872
iexplore.exe
GET
200
23.55.163.61:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
US
der
1.37 Kb
whitelisted
2668
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2872
iexplore.exe
GET
200
23.55.163.61:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
US
der
1.37 Kb
whitelisted
2668
MsiExec.exe
POST
200
148.72.152.76:40000
http://analytics.urban-vpn.com:40000/tickets
US
—
—
malicious
2872
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D
US
der
471 b
whitelisted
2872
iexplore.exe
GET
200
172.217.23.163:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB6CSjN0CZFqBQAAAAB%2BjGs%3D
US
der
471 b
whitelisted
2872
iexplore.exe
GET
200
93.184.220.29:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAtABqX9EjIed7Z%2BU3L8uO4%3D
US
der
471 b
shared
2872
iexplore.exe
GET
200
93.184.220.29:80
http://status.rapidssl.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRhhZrQET0hvbSHUJmNfBKqR%2FiT7wQUU8oXWfxrwAMhLxqu5KqoHIJW2nUCEAtABqX9EjIed7Z%2BU3L8uO4%3D
US
der
471 b
shared
2872
iexplore.exe
GET
200
99.84.158.217:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
532
chrome.exe
35.233.137.224:443
www.urban-vpn.com
—
US
unknown
532
chrome.exe
216.58.205.237:443
accounts.google.com
Google Inc.
US
whitelisted
532
chrome.exe
172.217.23.104:443
www.googletagmanager.com
Google Inc.
US
suspicious
532
chrome.exe
91.201.28.212:443
urban-vpn.postaffiliatepro.com
—
—
unknown
532
chrome.exe
216.58.205.238:443
www.google-analytics.com
Google Inc.
US
whitelisted
532
chrome.exe
65.9.68.102:443
static.hotjar.com
AT&T Services, Inc.
US
malicious
532
chrome.exe
185.60.216.19:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
532
chrome.exe
65.9.68.77:443
script.hotjar.com
AT&T Services, Inc.
US
unknown
532
chrome.exe
173.194.76.154:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
532
chrome.exe
157.240.9.35:443
www.facebook.com
Facebook, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.urban-vpn.com
  • 35.233.137.224
malicious
accounts.google.com
  • 216.58.205.237
shared
platform.twitter.com
  • 192.229.233.25
whitelisted
www.googletagmanager.com
  • 172.217.23.104
whitelisted
static.hotjar.com
  • 65.9.68.102
  • 65.9.68.64
  • 65.9.68.19
  • 65.9.68.87
  • 13.224.194.32
  • 13.224.194.102
  • 13.224.194.58
  • 13.224.194.80
whitelisted
urban-vpn.postaffiliatepro.com
  • 91.201.28.212
  • 91.201.28.211
suspicious
www.google-analytics.com
  • 216.58.205.238
  • 64.233.180.139
  • 64.233.180.138
  • 64.233.180.102
  • 64.233.180.101
  • 64.233.180.113
  • 64.233.180.100
whitelisted
connect.facebook.net
  • 185.60.216.19
  • 31.13.92.14
whitelisted
script.hotjar.com
  • 65.9.68.77
  • 65.9.68.23
  • 65.9.68.19
  • 65.9.68.48
  • 13.224.194.129
  • 13.224.194.79
  • 13.224.194.56
  • 13.224.194.4
whitelisted
stats.g.doubleclick.net
  • 173.194.76.154
  • 173.194.76.155
  • 173.194.76.157
  • 173.194.76.156
whitelisted

Threats

PID
Process
Class
Message
2668
MsiExec.exe
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
2668
MsiExec.exe
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
2668
MsiExec.exe
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
2668
MsiExec.exe
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
1672
urbanvpnserv.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
1672
urbanvpnserv.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
3864
urbanvpn-gui.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3864
urbanvpn-gui.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
1672
urbanvpnserv.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
1672
urbanvpnserv.exe
Misc activity
ADWARE [PTsecurity] Win32/Jetmedia.A
Process
Message
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
UrbanVPNUpdater.exe
Logger::SetLogFile( C:\ProgramData\UrbanVPN\updates\updater.log ) while OLD path is:
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
MsiExec.exe
Logger::SetLogFile( C:\Users\admin\AppData\Roaming\Caphyon\Advanced Installer\AI_ResourceCleaner.log ) while OLD path is:
UrbanVPNUpdater.exe
Logger::SetLogFile( C:\ProgramData\UrbanVPN\updates\updater.log ) while OLD path is:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.urban-vpn.com/thank-you-safe-browsing/