Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\Downloads\475cc4ea-47d3-4719-886a-b512df37d391.tmp

PDF document, version 1.4, 2 pages

dropped

C:\Users\user\Downloads\ba1c5c95-904b-4b59-a9e0-2bcadf3f4e9a.tmp

PDF document, version 1.4, 2 pages

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

JSON data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a5482c64-51f7-4f93-89df-dcb07031c95e.tmp

JSON data

modified

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

data

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

ASCII text

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240927170953Z-166.bmp

PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15

dropped

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Certificate, Version=3

dropped

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

JSON data

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25

dropped

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

SQLite Rollback Journal

dropped

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files\ef150b1a-20f1-4839-80f8-b87da24f65a5 (copy)

Google Chrome extension, version 3

dropped

C:\Users\user\AppData\Local\Temp\MSId3f13.LOG

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9ehresj_7mxebh_55k.tmp

PDF document, version 1.6, 0 pages

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-09-27 13-09-51-635.log

ASCII text, with very long lines (393)

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

ASCII text, with very long lines (393), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\20b7badd-dfe4-48ce-814b-da5ef8b1e80d.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\983e261b-6d94-4861-9af6-5b5b392d7d7e.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\9b8180d3-eb76-4c63-9cb2-9be3401a28ac.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142

dropped

C:\Users\user\AppData\Local\Temp\acrocef_low\9e61f40f-79c1-4b9b-9377-b9d899b9aeb1.tmp

gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022

dropped

C:\Users\user\Downloads\48694a64-fe85-45ad-a776-1f3979991e0d.tmp

Google Chrome extension, version 3

dropped

C:\Users\user\Downloads\downloaded.pdf (copy)

PDF document, version 1.4, 2 pages

dropped

C:\Users\user\Downloads\downloaded.pdf.crdownload (copy)

PDF document, version 1.4, 2 pages

dropped

Chrome Cache Entry: 252

PNG image data, 22 x 17, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 253

ASCII text, with very long lines (14437)

dropped

Chrome Cache Entry: 254

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

dropped

Chrome Cache Entry: 255

ASCII text, with very long lines (47261)

downloaded

Chrome Cache Entry: 256

PNG image data, 22 x 17, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 257

MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel

downloaded

Chrome Cache Entry: 258

HTML document, ASCII text, with CRLF line terminators

downloaded

Chrome Cache Entry: 259

ASCII text, with very long lines (47261)

dropped

Chrome Cache Entry: 260

MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel

dropped

Chrome Cache Entry: 261

PDF document, version 1.4, 2 pages

downloaded

Chrome Cache Entry: 262

PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced

downloaded

Chrome Cache Entry: 263

ASCII text, with very long lines (14437)

downloaded

Chrome Cache Entry: 264

HTML document, ASCII text, with CRLF line terminators

downloaded

There are 54 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"

Details

Is windows:	true
Is dropped:	false
PID:	5796
Target ID:	0
Parent PID:	5500
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:08:25
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2036,i,7023647533614785727,15102438677442804327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	2200
Target ID:	2
Parent PID:	5796
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=2036,i,7023647533614785727,15102438677442804327,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:08:28
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://img1.wsimg.com/blobby/go/0fb15fac-f667-4c74-8a1e-27661514d143/downloads/87458256888.pdf"

Details

Is windows:	true
Is dropped:	false
PID:	6356
Target ID:	3
Parent PID:	5500
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://img1.wsimg.com/blobby/go/0fb15fac-f667-4c74-8a1e-27661514d143/downloads/87458256888.pdf"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:08:30
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"

Details

Is windows:	true
Is dropped:	false
PID:	3084
Target ID:	8
Parent PID:	2580
Name:	Acrobat.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Size:	5641176
MD5:	24EAD1C46A47022347DC0F05F6EFBB8C
Time:	13:09:48
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6bc1b0000
Modulesize:	5693440
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215

Details

Is windows:	true
Is dropped:	false
PID:	6368
Target ID:	9
Parent PID:	3084
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	13:09:49
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff74bb60000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1668,i,17237931326109661874,6457796863689161635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	5572
Target ID:	10
Parent PID:	6368
Name:	AcroCEF.exe
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1668,i,17237931326109661874,6457796863689161635,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Size:	3581912
MD5:	9B38E8E8B6DD9622D24B53E095C5D9BE
Time:	13:09:49
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff74bb60000
Modulesize:	3620864
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://logirumola.xenina.co.za/584079126977960726?setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom"

Details

Is windows:	true
Is dropped:	false
PID:	5088
Target ID:	13
Parent PID:	5500
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "https://logirumola.xenina.co.za/584079126977960726?setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom"
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:10:13
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

Details

Is windows:	true
Is dropped:	false
PID:	7040
Target ID:	14
Parent PID:	5088
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 --field-trial-handle=2016,i,8706345328099913665,10503408173490149234,262144 /prefetch:8
Size:	3242272
MD5:	45DE480806D1B5D462A7DDE4DCEFC4E4
Time:	13:10:13
Date:	27/09/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff76e190000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://img1.wsimg.com/blobby/go/0fb15fac-f667-4c74-8a1e-27661514d143/downloads/87458256888.pdf

https://mikedownload.net/s/?file=ACDn9mZsZQUAwXACAFVTFwASAAAAAACF.what_is_a_payment_direction_letter.zip

https://logirumola.xenina.co.za/584079126977960726?setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom&__cf_chl_rt_tk=xAf_rjmC0UL.3kEE_C4UH46eE5SZPsQm5p7a.iqPcNA-1727457018-0.0.1.1-6100

https://logirumola.xenina.co.za/584079126977960726?setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom&__cf_chl_tk=xAf_rjmC0UL.3kEE_C4UH46eE5SZPsQm5p7a.iqPcNA-1727457018-0.0.1.1-6100

http://x1.i.lencr.org/

unknown

https://mikedownload.net/s/style/style.avg.css?cid=ACDn9mZsZQUAwXACAFVTFwASAAAAAACF

188.72.236.196

https://a.nel.cloudflare.com/report/v4?s=vFIaNZwbmH%2FNO0DkdJdnsAORjN%2Ff6jFL4ounSDbFZ8EOAUAhNBgD6hFwp3v95odGnA0iO5XmyPWKlKsTKfyUaPKWcoawjTd4hFJ3nS5%2ByIqpBgvhYrPmVDDcoH78YJY8Uq%2BPoYVLte1%2FgA%3D%3D

35.190.80.1

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/pat/8c9d1b5a7d34430f/1727457025829/63e532ccd3a59f1d7b62be15f2900ffaf3cfbed33e28e576a7314a2f013c83b0/UjKCFvV_7Si9FEw

104.18.94.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/flow/ov1/1589085305:1727453907:1RsfApQOi2l4imAkjPzViOYCWZxaWTs258PDkPh2-V0/8c9d1b5a7d34430f/ef43fae13f1de97

104.18.94.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/turnstile/if/ov2/av0/rcv0/0/o0544/0x4AAAAAAAAjq6WYeRDKmebM/light/fbE/normal/auto/

104.18.94.41

https://mikedownload.net/s/service/v?cid=ACDn9mZsZQUAwXACAFVTFwASAAAAAACF

188.72.236.196

https://fingerprint.com)

unknown

https://logirumola.xenina.co.za/favicon.ico

104.21.83.87

https://mikedownload.net/favicon.ico

188.72.236.196

http://www.opensource.org/licenses/mit-license.php)

unknown

file:///C:/Users/user/Downloads/downloaded.pdf

https://logirumola.xenina.co.za/cdn-cgi/challenge-platform/h/g/flow/ov1/446626791:1727453790:v4YRBnvmKWa4skf9c288VYZReaIyuHs_T_rT04KpOFI/8c9d1b3bea5b423f/4a62de4115e709e

104.21.83.87

https://voltagreenierkeckle.monster/ErrVS1b017d718d39d53863901f2cbb0837e6ed6f4cff?q=what+is+a+payment+direction+letter&s1=t7uh6g5v7ol7

188.114.96.3

https://logirumola.xenina.co.za/b.js

104.21.83.87

https://logirumola.xenina.co.za/584079126977960726?setawadonevusufasekojuvamedefaporujojavukomir=jos

unknown

https://logirumola.xenina.co.za/gdy?setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom&setawadonevusufasekojuvamedefaporujojavukomir=josozubanefigowowotosoxesijagifawanuparovitizudetukewalalanoxetewafabolosakiferovelanazizisirisesowatubunidofazovutajosegowakuzukinitagedatebupefulugefuraderuliduvowibavavososaregivotopesigojataxufebebaraz&utm_term=what+is+a+payment+direction+letter&zemanexevasixijakunigitenofizedigunefemovodosolezetisigaluzojarudipoxawagititisowaxevema=jebabeletepobagazesevimekunubofelumajuvonaguxogewetoxifivixewosopinixofuwovofijokifasepekekedamepefilulitolezodobetivipipudaboxisoromexulojom

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/cmg/1/wh0E0SXYnx6pTBdJW%2Fl926I%2BPRUplRdtQz3K9lHXs%2Fs%3D

104.18.94.41

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/i/8c9d1b5a7d34430f/1727457025833/3x74113NPFaU8a9

104.18.94.41

https://img1.wsimg.com/blobby/go/0fb15fac-f667-4c74-8a1e-27661514d143/downloads/87458256888.pdf

https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_api/v1?ray=8c9d1b5a7d34430f&lang=auto

104.18.94.41

https://logirumola.xenina.co.za/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=8c9d1b3bea5b423f

104.21.83.87

https://a.nel.cloudflare.com/report/v4?s=zzWEF62GUh1RWqZ%2FKR5qoGGxjQg%2BuM1j%2B8CDQuC8lb6WyPL%2F0%2FjqmbTwAtY9EgM9i%2FfHwSPwDu9943q0LbEOKneX2d9AGeQa8xAckYa758zARDGpKBXu9IqWa1fyDqvnkLtban28N5HYYQ%3D%3D

35.190.80.1

There are 17 hidden URLs, click here to show them.

Domains

Name

Malicious

logirumola.xenina.co.za

104.21.83.87

Details

Name:	logirumola.xenina.co.za
IP:	104.21.83.87
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
AI detected phishing page	Phishing
Clickable URLs found in PDF	System Summary	Spearphishing Link
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

a.nel.cloudflare.com

35.190.80.1

Details

Name:	a.nel.cloudflare.com
IP:	35.190.80.1
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable / 403 Forbidden)	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer

voltagreenierkeckle.monster

188.114.96.3

Details

Name:	voltagreenierkeckle.monster
IP:	188.114.96.3
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

mikedownload.net

188.72.236.196

Details

Name:	mikedownload.net
IP:	188.72.236.196
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Detected suspicious crossdomain redirect	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

challenges.cloudflare.com

104.18.95.41

Details

Name:	challenges.cloudflare.com
IP:	104.18.95.41
TargetID:	14
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

www.google.com

142.250.185.68

Details

Name:	www.google.com
IP:	142.250.185.68
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

img1.wsimg.com

unknown

Details

Name:	img1.wsimg.com
TargetID:	2
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

x1.i.lencr.org

unknown

IPs

Domain

Country

Malicious

104.21.83.87

logirumola.xenina.co.za

United States

188.72.236.196

mikedownload.net

Netherlands

104.18.94.41

unknown

United States

192.168.2.4

unknown

192.168.2.23

unknown

35.190.80.1

a.nel.cloudflare.com

United States

142.250.185.68

www.google.com

United States

216.58.212.132

unknown

United States

104.18.95.41

challenges.cloudflare.com

United States

239.255.255.250

unknown

Reserved

192.168.2.13

unknown

188.114.96.3

voltagreenierkeckle.monster

European Union

23.195.92.153

unknown

United States

There are 3 hidden IPs, click here to show them.