50.19.48[.]59IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 3 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Critical Vulnerabilities in PaperCut Print Management Software“On 4/22/23 new exploitation was seen where the first stage pulled down a .bat file (hxxp://50.19.48[.]59:82/me1.bat):”
Indicators reported together
named in the same reports- hxxp://upd488.windowservicecemter[.]com/download/setup.msiin 1 report
- upd488.windowservicecemter[.]comin 1 report
- f9947c5763542b31…42641983aabbin 1 report
- gmx[.]comin 1 report
- windowservicecemter[.]comin 1 report
- c0f8aeeb2d11c6e7…8738b6cc4125in 1 report
- anydeskupdate[.]comin 1 report
- anydeskupdates[.]comin 1 report
- netviewremote[.]comin 1 report
- updateservicecenter[.]comin 1 report
- windowcsupdates[.]comin 1 report
- windowservicecentar[.]comin 1 report
- windowservicecenter[.]comin 1 report
- winserverupdates[.]comin 1 report
- hxxp://50.19.48[.]59:82/me1.batin 1 report
- hxxp://50.19.48[.]59:82/me2.batin 1 report
- hxxps://cdn.papercut[.]com/web/products/ng-mf/installers/ng/$_version_prefix/pcng-setup-$pkgver.$_build.shin 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2023-27351, CVE-2023-27350
Thanks — we review every report.