IOC Report
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4d28b672-d69c-43d4-88da-44aa79b18466.tmp
Unknown
modified
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)
Unknown
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF50315b.TMP (copy)
Unknown
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fb57a8d8-21cd-4f16-ba7c-595f2b05ed4f.tmp
Unknown
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log
data
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)
ASCII text
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120122657Z-192.bmp
PC bitmap, Windows 3.x format, 109 x -152 x 32, cbSize 66326, bits offset 54
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
SQLite 3.x database, last written using SQLite version 3040000, file counter 17, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 17
dropped
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D
Certificate, Version=3
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING
data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json
JSON data
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal
SQLite Rollback Journal
dropped
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin
data
dropped
C:\Users\user\AppData\Local\Temp\MSIfebc7.LOG
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91jk2z2w_7hh0i6_2ts.tmp
Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A9c0ebvu_7hh0i5_2ts.tmp
Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 07-26-55-558.log
ASCII text, with very long lines (393)
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log
ASCII text, with very long lines (393), with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\2c5f6760-2284-4515-89e0-51bc9765c094.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\86dcc7b2-f7c5-41a0-aac8-9e96069076d4.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\cc31461d-baed-4425-8612-d77585e68c19.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
dropped
C:\Users\user\AppData\Local\Temp\acrocef_low\d2a42378-052c-468d-9f12-084e5c543300.tmp
gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings
ASCII text
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl
data
dropped
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl
data
dropped
C:\Users\user\Downloads\1e21a5de-4f15-479b-b540-93d56676e759.tmp
PDF document, version 1.3, 2 pages
dropped
C:\Users\user\Downloads\downloaded.pdf (copy)
PDF document, version 1.3, 2 pages
dropped
C:\Users\user\Downloads\downloaded.pdf.crdownload
PDF document, version 1.3, 2 pages
dropped
Chrome Cache Entry: 251
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 252
ASCII text, with very long lines (3306)
dropped
Chrome Cache Entry: 253
Web Open Font Format (Version 2), TrueType, length 23196, version 1.0
downloaded
Chrome Cache Entry: 254
Unicode text, UTF-8 text, with very long lines (65441), with CRLF line terminators
downloaded
Chrome Cache Entry: 255
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 256
ASCII text, with very long lines (1372)
downloaded
Chrome Cache Entry: 257
ASCII text, with very long lines (26776), with no line terminators
downloaded
Chrome Cache Entry: 258
PDF document, version 1.3, 2 pages
downloaded
Chrome Cache Entry: 259
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 260
ASCII text, with very long lines (1372)
dropped
Chrome Cache Entry: 261
ASCII text, with very long lines (13501)
dropped
Chrome Cache Entry: 262
PNG image data, 60 x 60, 8-bit/color RGBA, non-interlaced
dropped
Chrome Cache Entry: 263
ASCII text, with very long lines (13501)
downloaded
Chrome Cache Entry: 264
ASCII text, with very long lines (1053)
downloaded
Chrome Cache Entry: 265
ASCII text, with very long lines (65324)
downloaded
Chrome Cache Entry: 266
Web Open Font Format (Version 2), TrueType, length 14888, version 1.0
downloaded
Chrome Cache Entry: 267
HTML document, ASCII text, with very long lines (815)
downloaded
Chrome Cache Entry: 268
ASCII text
downloaded
Chrome Cache Entry: 269
ASCII text, with very long lines (1053)
dropped
Chrome Cache Entry: 270
Web Open Font Format (Version 2), TrueType, length 14332, version 1.0
downloaded
Chrome Cache Entry: 271
Unicode text, UTF-8 text, with very long lines (2530)
dropped
Chrome Cache Entry: 272
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 273
ASCII text, with very long lines (1752)
downloaded
Chrome Cache Entry: 274
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 275
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 276
Unicode text, UTF-8 text, with very long lines (65441), with CRLF line terminators
dropped
Chrome Cache Entry: 277
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 278
ASCII text, with very long lines (65447)
dropped
Chrome Cache Entry: 279
ASCII text, with very long lines (57791)
dropped
Chrome Cache Entry: 280
HTML document, ASCII text, with very long lines (1452)
downloaded
Chrome Cache Entry: 281
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 282
ASCII text, with very long lines (57791)
downloaded
Chrome Cache Entry: 283
Web Open Font Format (Version 2), TrueType, length 22356, version 1.0
downloaded
Chrome Cache Entry: 284
Web Open Font Format (Version 2), CFF, length 200156, version 1.0
downloaded
Chrome Cache Entry: 285
Web Open Font Format (Version 2), TrueType, length 22908, version 1.0
downloaded
Chrome Cache Entry: 286
RIFF (little-endian) data, Web/P image
downloaded
Chrome Cache Entry: 287
Unicode text, UTF-8 text, with very long lines (2530)
downloaded
Chrome Cache Entry: 288
ASCII text, with very long lines (1223)
downloaded
Chrome Cache Entry: 289
HTML document, Unicode text, UTF-8 text, with very long lines (9521)
downloaded
Chrome Cache Entry: 290
ASCII text, with very long lines (65447)
downloaded
Chrome Cache Entry: 291
ASCII text, with very long lines (3306)
downloaded
Chrome Cache Entry: 292
HTML document, ASCII text, with very long lines (1452)
dropped
There are 87 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,3380293206825283762,15677942766615917640,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f"
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1560,i,3530712955350696723,17840097560420890255,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8

URLs

Name
IP
Malicious
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/wp-content/uploads/inst.svg
unknown
https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf
http://x1.i.lencr.org/
unknown
https://github.com/jonsuh/hamburgers
unknown
https://kreskamaki.pl/#onas
unknown
https://kreskamaki.pl/wp-content/uploads/kreska-maki-polityka-prywatnosci.pdf
unknown
https://jonsuh.com/hamburgers
unknown
https://kreskamaki.pl/wp-content/litespeed/css/5249450f0b6dbec702c6eddfd93e86c2.css?ver=e86c2
unknown
https://kreskamaki.pl/wp-content/uploads/fb.svg
unknown
https://api.w.org/
unknown
https://googleads.g.doubleclick.net
unknown
https://kreskamaki.pl/wp-content/themes/kreskamaki/img/btn-arrow.svg
unknown
https://kreskamaki.pl/#menu
unknown
https://www.instagram.com/kreska.maki/
unknown
https://getbootstrap.com/)
unknown
https://kreskamaki.pl/
unknown
https://cct.google/taggy/agent.js
unknown
https://sketchapp.com
unknown
https://kreskamaki.pl/wp-content/uploads/favicon.png
unknown
https://www.google.com
unknown
https://kreskamaki.pl/wp-content/litespeed/css/68cd2460d4d9f72fde436a1695d0cea3.css?ver=0cea3
unknown
https://kreskamaki.pl/promocje/
unknown
https://github.com/twbs/bootstrap/graphs/contributors)
unknown
file:///C:/Users/user/Downloads/downloaded.pdf
https://td.doubleclick.net
unknown
https://kreskamaki.pl/wp-content/litespeed/css/337468f3ab634f283848c9874971e922.css?ver=1e922
unknown
https://kreskamaki.pl/xmlrpc.php?rsd
unknown
https://pomelomedia.pl/
unknown
https://kreskamaki.pl/wp-content/uploads/logo.svg
unknown
http://www.npes.org/pdfx/ns/id/
unknown
https://kreskamaki.pl/wp-json/
unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)
unknown
https://kreskamaki.pl/#lokale
unknown
https://github.com/georgekosmidis/jquery-hashchange
unknown
https://google.com
unknown
https://kreskamaki.pl/wp-content/themes/kreskamaki/fonts/Holtzman-Textured-PL.woff2
unknown
https://github.com/microsoft/clarity
unknown
https://adservice.google.com/pagead/regclk?
unknown
There are 28 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
13.107.246.45
unknown
United States
54.144.73.197
unknown
United States
1.1.1.1
unknown
Australia
142.250.186.36
unknown
United States
23.47.168.24
unknown
United States
239.255.255.250
unknown
Reserved
142.250.186.164
unknown
United States
193.239.44.233
unknown
Poland

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
tFileSource
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sFileAncestors
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uFileSize
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
uPageCount
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
sAssetId
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c1
bisSharedFile
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
aFS
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tDIText
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
tFileName
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDI
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
sDate
HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral\cRecentFiles\c2
uFileSize
There are 7 hidden registries, click here to show them.

DOM / HTML

URL
Malicious
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/&ved=2ahUKEwjXsdXPoeaJAxXOV0EAHeHeI60QFnoECBgQAQ&usg=AOvVaw3Fydc_x43m7WUzJ18d737f
https://kreskamaki.pl/wp-content/uploads/KRESKA-MAKI-ULOTKA.pdf
file:///C:/Users/user/Downloads/downloaded.pdf
file:///C:/Users/user/Downloads/downloaded.pdf