download:

/kingparks/cursor-vip/releases/download/latest/cursor-vip_windows_amd64.exe

Full analysis: https://app.any.run/tasks/266ddfcc-4447-436d-9406-47bc4039a487
Verdict: Malicious activity
Analysis date: January 31, 2025, 17:19:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 9 sections
MD5:

BA0EF9C8A17A2D74E69D0FDC16F5997D

SHA1:

FF1CD2914DCD257381A7D792748C2F5CAA8B47B8

SHA256:

3BA2CE5EADB71ED9F39F0AC92402137FFF7C6C471E69649CFAFEB81138C30FAD

SSDEEP:

98304:iIGI4qThGHFKDCP6XO91aOhMOCsXQU0DP6n7KytOHD9wfuBC7KOKhq5+ywtlhRZo:Ni

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)

    • Starts POWERSHELL.EXE for commands execution

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Uses TASKKILL.EXE to kill process

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 1740)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • Executable content was dropped or overwritten

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • The process creates files with name similar to system file names

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • Get information on the list of running processes

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)
      • cmd.exe (PID: 7140)

    • Starts CMD.EXE for commands execution

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • Drops 7-zip archiver for unpacking

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

  • INFO

    • Drops encrypted JS script (Microsoft Script Encoder)

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 5064)
      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Reads the computer name

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Checks supported languages

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • SearchApp.exe (PID: 5064)
      • cursor-vip_windows_amd64.exe (PID: 3420)
      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • Reads the software policy settings

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • SearchApp.exe (PID: 5064)
      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cursor-vip_windows_amd64.exe (PID: 3420)

    • Detects GO elliptic curve encryption (YARA)

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)

    • Application based on Golang

      • cursor-vip_windows_amd64.exe (PID: 5728)
      • cursor-vip_windows_amd64.exe (PID: 2804)

    • Manual execution by a user

      • cursor-vip_windows_amd64.exe (PID: 2804)
      • cmd.exe (PID: 2452)
      • cursor-vip_windows_amd64.exe (PID: 3420)
      • cmd.exe (PID: 4576)
      • firefox.exe (PID: 4648)

    • Process checks computer location settings

      • SearchApp.exe (PID: 5064)

    • Application launched itself

      • firefox.exe (PID: 3900)
      • firefox.exe (PID: 4648)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3900)

    • The sample compiled with english language support

      • firefox.exe (PID: 3900)
      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)

    • Create files in a temporary directory

      • Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe (PID: 1016)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 5879296
InitializedDataSize: 552960
UninitializedDataSize: -
EntryPoint: 0x6e1c0
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
37
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cursor-vip_windows_amd64.exe conhost.exe no specs powershell.exe no specs taskkill.exe no specs cursor-vip_windows_amd64.exe conhost.exe no specs powershell.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs cmd.exe conhost.exe no specs certutil.exe no specs cursor-vip_windows_amd64.exe conhost.exe no specs powershell.exe no specs taskkill.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cursor setup 0.45.5 - build 250128loaeyulq8-x64.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
848"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2716 -childID 3 -isForBrowser -prefsHandle 2616 -prefMapHandle 5008 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed45798a-a919-4b4d-b412-9108c199fbcc} 3900 "\\.\pipe\gecko-crash-server-pipe.3900" 19af3f33850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1016"C:\Users\admin\Downloads\Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe" C:\Users\admin\Downloads\Cursor Setup 0.45.5 - Build 250128loaeyulq8-x64.exe
firefox.exe
User:
admin
Company:
Cursor AI, Inc.
Integrity Level:
MEDIUM
Description:
Cursor is an AI-first coding environment.
Version:
250128loaeyulq8
Modules
Images
c:\users\admin\downloads\cursor setup 0.45.5 - build 250128loaeyulq8-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356powershell "Get-Culture | select -exp Name"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cursor-vip_windows_amd64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1740certutil -addstore root C:\Users\admin\.cursor-vip\ca-cert.cerC:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2076powershell "Get-Culture | select -exp Name"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cursor-vip_windows_amd64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2160taskkill /IM Cursor.exe /FC:\Windows\System32\taskkill.exe—cursor-vip_windows_amd64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2452"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
2804"C:\Users\admin\Desktop\cursor-vip_windows_amd64.exe" C:\Users\admin\Desktop\cursor-vip_windows_amd64.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\cursor-vip_windows_amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\powrprof.dll
3040"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4820 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 4576 -prefMapHandle 4596 -prefsLen 36588 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a33adef-c867-4c11-9965-f0c021525123} 3900 "\\.\pipe\gecko-crash-server-pipe.3900" 19af510ef10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
47 792
Read events
47 692
Write events
97
Delete events
3

Modification events

(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicText
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicTextTruncated
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50111
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
0000438135640474DB01
(PID) Process:(5064) SearchApp.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState\DynamicSearchBox
Operation:writeName:TelemetryID
Value:
00008AEB2B640474DB01
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
50667
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:writeName:Total
Value:
929
(PID) Process:(5064) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsAADCloudSearchEnabled
Value:
0
Executable files
7
Suspicious files
606
Text files
350
Unknown types
2

Dropped files

PID
Process
Filename
Type
1356powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4ojubidq.rzb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1356powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:5D9226D4BA058405C4C840CE35F9E53A
SHA256:26F89F88CADE10C4ED93D864977876C6E13847E1036CDAD27BDB3B539C9DB450
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:E785F8C5B094E1EBFCFFC225DC2D7661
SHA256:A381A568E13A03ADC7276A7327DFB7E658AEF7ACC3336EA7B9D700BC3DF2A7B4
5728cursor-vip_windows_amd64.exeC:\Users\admin\.cursor-vip\i-need-to-trust-ca-cert.pemtext
MD5:5123888F35778F4A9E31F1DD32122C16
SHA256:80F7E8858EDDCB45648FA9FB66730A9BC2D8350EB9415345675877993E85D89A
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\vOJNaIfAXvJzmnBm845ss-M9YR8[1].csstext
MD5:87BBB1A289EDC24C9F06B88229765467
SHA256:85B291C46F9D1EEEC71DB839F649D748F48B203EA836F3ACE3B9B761947D960C
5728cursor-vip_windows_amd64.exeC:\Users\admin\.cursor-vip\ca-cert.certext
MD5:5123888F35778F4A9E31F1DD32122C16
SHA256:80F7E8858EDDCB45648FA9FB66730A9BC2D8350EB9415345675877993E85D89A
2804cursor-vip_windows_amd64.exeC:\Users\admin\.cursor-vip\cursor-vip.pidtext
MD5:4AB52371762B735317125E6446A51E8F
SHA256:322AC9C5F39FCB8A5CF2D3AD558913AD6B056D8093C50704DDA0215EE11C2A3A
1356powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lr5rp4k1.mvu.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4576A9EEC235D01185E3A55AF77732A4
SHA256:A135BF635F73DAEC819E8BE68D08D44CBC161632CDF9907D885044E4C1193963
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\5Y734AMR\67\FgBbpIj0thGWZOh_xFnM9i4O7ek[1].csstext
MD5:908111EB0FFB1360D5DD61279C21703E
SHA256:1ED87CF425DED994B05A842271AB4D28A76F399E571688CF2E7B186F70DC3059
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
119
DNS requests
140
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
firefox.exe
POST
200
142.250.185.131:80
http://o.pki.goog/s/wr3/3cs
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2160
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2160
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3692
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3900
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
3900
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
3900
firefox.exe
POST
200
142.250.185.131:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1684
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.21.65.153:443
www.bing.com
Akamai International B.V.
NL
whitelisted
5064
SearchApp.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5728
cursor-vip_windows_amd64.exe
104.21.11.16:443
cursor.jeter.eu.org
CLOUDFLARENET
—
unknown
1076
svchost.exe
23.212.90.82:443
go.microsoft.com
AKAMAI-AS
MX
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.21.65.153
  • 2.21.65.132
  • 2.21.65.154
  • 2.21.65.157
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.123
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.73
  • 40.126.31.128
  • 20.190.159.0
  • 20.190.159.23
  • 40.126.31.129
  • 20.190.159.2
  • 40.126.31.73
whitelisted
cursor.jeter.eu.org
  • 104.21.11.16
  • 172.67.147.141
unknown
go.microsoft.com
  • 23.212.90.82
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/kingparks/cursor-vip/releases/download/latest/cursor-vip_windows_amd64.exe