Edit tour

Windows Analysis Report
THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf

Overview

General Information

Sample name:	THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf
Analysis ID:	1522477
MD5:	f96e40b4174c70cb18e24a5218a5083d
SHA1:	71eb30ccb9b4338842f33ab4f317a42ea88ac7d5
SHA256:	68c929f9276faf476a4cc602bda467199a2ae5e3763a8b12c1f7ffff8a3712c3
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Detected non-DNS traffic on DNS port

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7532 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7708 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1360,i,9679507563952575083,13765372778311210832,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8656 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:Nadine.McCluskey@ndis.gov.au" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8852 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4708 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4176 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

Acrobat.exe (PID: 7068 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4864 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2036 --field-trial-handle=1620,i,15769612952736250241,8455910719674616377,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cleanup

HTTP traffic detected: POST /report/v4?s=xZmKdk0HuAxAgNjcYlXe3MK3UzFXCeU6OUKptEXw2cmmoMFgZL4MFVTXLuQSRVxtlGWUqnAjK7KasSFLnMp%2F%2FyRQI8dHztYBpROrrAmCEgsNf3NjEbH5juTZ0pIRMlV71jhgTAWpHZggBkIk5A%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 481Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://ndis.gov.au/participants/creating-your-plan	HTTP Parser: No favicon
Source: https://ndis.gov.au/participants	HTTP Parser: No favicon
Source: https://ndis.gov.au/applying-access-ndis	HTTP Parser: No favicon
Source: https://ndis.gov.au/changes-ndis-legislation	HTTP Parser: No favicon
Source: https://ndis.gov.au/changes-ndis-legislation	HTTP Parser: No favicon
Source: https://ndis.gov.au/print/pdf/node/4	HTTP Parser: No favicon
Source: https://ndis.gov.au/understanding	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: file:///C:/Users/user/Downloads/downloaded.pdf	HTTP Parser: No favicon
Source: https://app-oc.readspeaker.com/cgi-bin/rsent?customerid=8973&lang=en_au&readclass=screen-reader&url=https%3A%2F%2Fndis.gov.au%2Fnode%2F4	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.4:61261 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 18.66.102.11 18.66.102.11
Source: Joe Sandbox View	IP Address: 13.33.187.19 13.33.187.19
Source: Joe Sandbox View	IP Address: 104.16.80.73 104.16.80.73
Source: Joe Sandbox View	IP Address: 23.22.254.206 23.22.254.206

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 23.46.224.162
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_487.10.dr, chromecache_555.10.dr, chromecache_382.10.dr, chromecache_528.10.dr, chromecache_765.10.dr, chromecache_409.10.dr, chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr	String found in binary or memory: <a href="https://www.facebook.com/NDISAus" data-icon="fab fa-facebook fa-fw" title="Facebook" class="nav-link" rel="nofollow"> <i class="fab fa-facebook fa-fw"></i> equals www.facebook.com (Facebook)
Source: chromecache_487.10.dr, chromecache_555.10.dr, chromecache_382.10.dr, chromecache_528.10.dr, chromecache_765.10.dr, chromecache_409.10.dr, chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr	String found in binary or memory: <a href="https://www.linkedin.com/company/national-disability-insurance-agency" data-icon="fab fa-linkedin fa-fw" title="LinkedIn" class="nav-link" rel="nofollow"> <i class="fab fa-linkedin fa-fw"></i> equals www.linkedin.com (Linkedin)
Source: chromecache_487.10.dr, chromecache_555.10.dr, chromecache_382.10.dr, chromecache_528.10.dr, chromecache_765.10.dr, chromecache_409.10.dr, chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr	String found in binary or memory: <a href="https://www.youtube.com/user/DisabilityCare" data-icon="fab fa-youtube fa-fw" title="YouTube" class="nav-link" rel="nofollow"> <i class="fab fa-youtube fa-fw"></i> equals www.youtube.com (Youtube)
Source: chromecache_528.10.dr	String found in binary or memory: <div class="video-embed-field-provider-youtube video-embed-field-responsive-video"><iframe width="854" height="480" frameborder="0" allowfullscreen="allowfullscreen" src="https://www.youtube.com/embed/VGBF0KnVs_g?autoplay=0&start=0&rel=0"></iframe> equals www.youtube.com (Youtube)
Source: chromecache_557.10.dr	String found in binary or memory: <div class="video-embed-field-provider-youtube video-embed-field-responsive-video"><iframe width="854" height="480" frameborder="0" allowfullscreen="allowfullscreen" src="https://www.youtube.com/embed/aF3gGRNRnkk?autoplay=0&start=0&rel=0"></iframe> equals www.youtube.com (Youtube)
Source: chromecache_402.10.dr	String found in binary or memory: <div class="video-embed-field-provider-youtube video-embed-field-responsive-video"><iframe width="854" height="480" frameborder="0" allowfullscreen="allowfullscreen" src="https://www.youtube.com/embed/qZOjPBJiBPg?autoplay=0&start=0&rel=0"></iframe> equals www.youtube.com (Youtube)
Source: chromecache_487.10.dr, chromecache_555.10.dr, chromecache_382.10.dr, chromecache_528.10.dr, chromecache_765.10.dr, chromecache_409.10.dr, chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr	String found in binary or memory: <link rel="preconnect" href="https://www.facebook.com/" crossorigin> equals www.facebook.com (Facebook)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: (g.rk(c,"redirector.googlevideo.com"),d=c.toString()):c.j.match("rr?[1-9].*\\.c\\.youtube\\.com$")?(g.rk(c,"www.youtube.com"),d=c.toString()):(c=iwa(d),jE(c)&&(d=c));c=new g.XL(d);c.set("cmo=pf","1");e&&c.set("cmo=td","a1.googlevideo.com");return c}; equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: 0?"http":"https";this.Ca=iE((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)\|\|"")\|\|iE(this.mf)\|\|this.protocol+"://www.youtube.com/";h=b?b.eventLabel:a.el;d="detailpage";h==="adunit"?d=this.D?"embedded":"detailpage":h==="embedded"\|\|this.N?d=is(d,h,GJa):h&&(d="embedded");this.Ja=d;Qqa();h=null;d=b?b.playerStyle:a.ps;f=g.Vb(HJa,d);!d\|\|f&&!this.N\|\|(h=d);this.playerStyle=h;this.K=g.Vb(HJa,this.playerStyle);this.houseBrandUserStatus=b==null?void 0:b.houseBrandUserStatus;this.qa=this.K&&this.playerStyle!=="play"&& equals www.youtube.com (Youtube)
Source: chromecache_765.10.dr	String found in binary or memory: </ul><div class="video-embed-field-provider-youtube video-embed-field-responsive-video"><iframe width="854" height="480" frameborder="0" allowfullscreen="allowfullscreen" src="https://www.youtube.com/embed/5KUkQdG9eg8?autoplay=0&start=0&rel=0"></iframe> equals www.youtube.com (Youtube)
Source: chromecache_485.10.dr	String found in binary or memory: <div class="video-embed-field-provider-youtube video-embed-field-responsive-video"><iframe width="854" height="480" frameborder="0" allowfullscreen="allowfullscreen" src="https://www.youtube.com/embed/ys-jVwjuTHY?autoplay=0&start=0&rel=0"></iframe> equals www.youtube.com (Youtube)
Source: chromecache_725.10.dr	String found in binary or memory: <p>To learn more about early childhood intervention, watch this <a href="https://www.youtube.com/watch?v=DbuV4isNLDI" rel="nofollow">family perspectives video<span class="external-link-icon" title="External website"><i class="far fa-external-link-alt"></i></span></a> .</p> equals www.youtube.com (Youtube)
Source: chromecache_397.10.dr	String found in binary or memory: Io.prototype.Ia=function(){return this.C};var kna=(new Date).getTime();var xla="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),yla=/\bocr\b/;var Ala=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var Qab=0,Rab=0,Sab=0;var Ro;g.Ko=null;g.Mo=!1;g.So=1;Ro=Symbol("SIGNAL");g.To={version:0,r_:0,Om:!1,eg:void 0,Sy:void 0,An:void 0,LL:0,hj:void 0,Ou:void 0,ZE:!1,oP:!1,O1:function(){return!1}, equals www.youtube.com (Youtube)
Source: chromecache_639.10.dr	String found in binary or memory: L.getElementsByTagName("iframe"),la=S.length,na=0;na<la;na++)if(!u&&c(S[na],H.Ge)){hJ("https://www.youtube.com/iframe_api");u=!0;break}})}}else F(v.vtp_gtmOnSuccess)}var q=["www.youtube.com","www.youtube-nocookie.com"],r={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},t,u=!1;Z.__ytl=n;Z.__ytl.o="ytl";Z.__ytl.isVendorTemplate=!0;Z.__ytl.priorityOverride=0;Z.__ytl.isInfrastructure=!1; equals www.youtube.com (Youtube)
Source: chromecache_397.10.dr	String found in binary or memory: LIa=function(a,b){if(!a.j["0"]){var c=new VF("0","fakesb",{video:new RF(0,0,0,void 0,void 0,"auto")});a.j["0"]=b?new oN(new g.XL("http://www.youtube.com/videoplayback"),c,"fake"):new FN(new g.XL("http://www.youtube.com/videoplayback"),c,new $M(0,0),new $M(0,0))}}; equals www.youtube.com (Youtube)
Source: chromecache_452.10.dr, chromecache_639.10.dr, chromecache_611.10.dr, chromecache_732.10.dr	String found in binary or memory: Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},Yj:function(){e=zb()},nd:function(){d()}}};var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_397.10.dr	String found in binary or memory: a))):this.api.U().L("enable_adb_handling_in_sabr")&&c==="BROWSER_OR_EXTENSION_ERROR"&&!d.K?(d=d.hostLanguage,a="//support.google.com/youtube/answer/3037019#zippy=%2Cupdate-your-browser-and-check-your-extensions",d&&(a=g.Ui(a,{hl:d})),this.Cd(rY(this,"BROWSER_OR_EXTENSION_ERROR",a))):this.Cd(g.pY(a.errorMessage)):this.Cd(rY(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c=g.Ui(c, equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: a.details.rc!=="429"?a.errorCode==="ump.spsrejectfailure"&&(e="HTML5_SPS_UMP_STATUS_REJECTED"):(e="TOO_MANY_REQUESTS",f="6");this.ea.Qf(a.errorCode,a.severity,e,DF(a.details),f)}else this.ea.publish("nonfatalerror",a),d=/^pp/.test(this.videoData.clientPlaybackNonce),this.Fd(a.errorCode,a.details),d&&a.errorCode==="manifest.net.connect"&&(a="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.It)(),iT(a,"manifest",function(h){b.K=!0;b.ma("pathprobe",h)},function(h){b.Fd(h.errorCode, equals www.youtube.com (Youtube)
Source: chromecache_397.10.dr	String found in binary or memory: a.ismb);this.cq?(r=a.vss_host\|\|"s.youtube.com",r==="s.youtube.com"&&(r=sP(this.Ca)\|\|"www.youtube.com")):r="video.google.com";this.Qn=r;tP(this,a,!0);this.La=new OO;g.P(this,this.La);q=b?b.innertubeApiKey:ks("",a.innertube_api_key);p=b?b.innertubeApiVersion:ks("",a.innertube_api_version);r=b?b.innertubeContextClientVersion:ks("",a.innertube_context_client_version);q=g.$q("INNERTUBE_API_KEY")\|\|q;p=g.$q("INNERTUBE_API_VERSION")\|\|p;l=g.$q("INNERTUBE_CONTEXT_CLIENT_CONFIG_INFO");m=HO(this);n=typeof this.j.c=== equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: b=this.api.U();a=this.api.getVideoData();var c="";b.C\|\|(b=g.xP(b),b.indexOf("www.")===0&&(b=b.substring(4)),c=g.DR(a)?"Watch on YouTube Music":b==="youtube.com"?"Watch on YouTube":g.AE("Watch on $WEBSITE",{WEBSITE:b}));this.updateValue("title",c)}; equals www.youtube.com (Youtube)
Source: chromecache_611.10.dr, chromecache_732.10.dr	String found in binary or memory: c?"runIfCanceled":"runIfUncanceled",[]);if(!g.length)return!0;var k=lA(a,c,e);N(121);if(k["gtm.elementUrl"]==="https://www.facebook.com/tr/")return N(122),!0;if(d&&f){for(var m=Kb(b,g.length),n=0;n<g.length;++n)g[n](k,m);return m.done}for(var p=0;p<g.length;++p)g[p](k,function(){});return!0},oA=function(){var a=[],b=function(c){return ob(a,function(d){return d.form===c})};return{store:function(c,d){var e=b(c);e?e.button=d:a.push({form:c,button:d})},get:function(c){var d=b(c);return d?d.button:null}}}, equals www.facebook.com (Facebook)
Source: chromecache_724.10.dr, chromecache_702.10.dr	String found in binary or memory: function X(a,b){this.v={};this.playerInfo={};this.videoTitle="";this.j=this.g=null;this.h=0;this.m=!1;this.l=[];this.i=null;this.A={};this.options=null;if(!a)throw Error("YouTube player element ID required.");this.id=ra(this);b=Object.assign({title:"video player",videoId:"",width:640,height:360},b\|\|{});var c=document;if(a=typeof a==="string"?c.getElementById(a):a){W.yt_embedsEnableRsaforFromIframeApi&&vb();c=a.tagName.toLowerCase()==="iframe";b.host\|\|(b.host=c?ob(a.src):"https://www.youtube.com");this.options= equals www.youtube.com (Youtube)
Source: chromecache_724.10.dr, chromecache_702.10.dr	String found in binary or memory: function vb(){var a=new tb,b=["https://www.youtube.com"];b=b===void 0?sb:b;pa(function(c){switch(c.g){case 1:return C(c,ub(),2);case 2:if(!c.m){c.g=3;break}return C(c,Promise.all(b.map(function(d){var g;return pa(function(k){if(k.g==1)return k.l=2,C(k,navigator.permissions.query({name:"top-level-storage-access",requestedOrigin:d}),4);k.g!=2?(g=k.m,g.state==="prompt"&&a.g.push(d),k.g=0,k.l=0):(k.l=0,k.i=null,k.g=0)})})),4); equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: g.KP=function(a){var b=g.xP(a);RJa.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: chromecache_397.10.dr	String found in binary or memory: g.k.getVideoUrl=function(a,b,c,d,e,f,h){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=h?"music.youtube.com":g.xP(this);e=c==="www.youtube.com";!f&&d&&e?f="https://youtu.be/"+a:g.oP(this)?(f="https://"+c+"/fire",b.v=a):(f&&e?(f=this.protocol+"://"+c+"/shorts/"+a,d&&(b.feature="share")):(f=this.protocol+"://"+c+"/watch",b.v=a),au&&(a=ana())&&(b.ebc=a));return g.Ui(f,b)}; equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: g.xP=function(a){a=sP(a.Ca);return a==="www.youtube-nocookie.com"?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: chromecache_611.10.dr, chromecache_732.10.dr	String found in binary or memory: if(!(e\|\|f\|\|g\|\|k.length\|\|m.length))return;var p={eh:e,ah:f,bh:g,Ph:k,Qh:m,Ge:n,Bb:b},q=C.YT;if(q)return q.ready&&q.ready(d),b;var r=C.onYouTubeIframeAPIReady;C.onYouTubeIframeAPIReady=function(){r&&r();d()};F(function(){for(var t=E.getElementsByTagName("script"),u=t.length,v=0;v<u;v++){var w=t[v].getAttribute("src");if(QC(w,"iframe_api")\|\|QC(w,"player_api"))return b}for(var x=E.getElementsByTagName("iframe"),y=x.length,A=0;A<y;A++)if(!HC&&OC(x[A],p.Ge))return wc("https://www.youtube.com/iframe_api"), equals www.youtube.com (Youtube)
Source: chromecache_457.10.dr, chromecache_530.10.dr	String found in binary or memory: return b}DC.H="internal.enableAutoEventOnTimer";var gc=ja(["data-gtm-yt-inspected-"]),FC=["www.youtube.com","www.youtube-nocookie.com"],GC,HC=!1; equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: this.Y.Aa&&(a.authuser=this.Y.Aa);this.Y.pageId&&(a.pageid=this.Y.pageId);isNaN(this.cryptoPeriodIndex)\|\|(a.cpi=this.cryptoPeriodIndex.toString());var e=(e=/_(TV\|STB\|GAME\|OTT\|ATV\|BDP)_/.exec(g.Bb()))?e[1]:"";e==="ATV"&&(a.cdt=e);this.G=a;this.G.session_id=d;this.oa=!0;this.B.flavor==="widevine"&&(this.G.hdr="1");this.B.flavor==="playready"&&(b=Number(JO(b.experiments,"playready_first_play_expiration")),!isNaN(b)&&b>=0&&(this.G.mfpe=""+b),this.oa=!1);b="";g.lO(this.B)?kO(this.B)?(d=c.B)&&(b="https://www.youtube.com/api/drm/fps?ek="+ equals www.youtube.com (Youtube)
Source: chromecache_527.10.dr, chromecache_397.10.dr	String found in binary or memory: var D2={};var Mdb={Fs:[{IB:/Unable to load player module/,weight:20},{IB:/Failed to fetch/,weight:500},{IB:/XHR API fetch failed/,weight:10},{IB:/JSON parsing failed after XHR fetch/,weight:10},{IB:/Retrying OnePlatform request/,weight:10},{IB:/CSN Missing or undefined during playback association/,weight:100}],Mr:[{callback:K7a,weight:500}]};var X7a=/[&\?]action_proxy=1/,W7a=/[&\?]token=([\w-])/,Y7a=/[&\?]video_id=([\w-])/,Z7a=/[&\?]index=([\d-])/,$7a=/[&\?]m_pos_ms=([\d-])/,b8a=/[&\?]vvt=([\w-]*)/,O7a="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),a8a="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "),R7a={android:"ANDROID", equals www.youtube.com (Youtube)
Source: chromecache_611.10.dr, chromecache_732.10.dr	String found in binary or memory: var SB=function(a,b,c,d,e){var f=Jz("fsl",c?"nv.mwt":"mwt",0),g;g=c?Jz("fsl","nv.ids",[]):Jz("fsl","ids",[]);if(!g.length)return!0;var k=Oz(a,"gtm.formSubmit",g),m=a.action;m&&m.tagName&&(m=a.cloneNode(!1).action);N(121);if(m==="https://www.facebook.com/tr/")return N(122),!0;k["gtm.elementUrl"]=m;k["gtm.formCanceled"]=c;a.getAttribute("name")!=null&&(k["gtm.interactedFormName"]=a.getAttribute("name"));e&&(k["gtm.formSubmitElement"]=e,k["gtm.formSubmitElementText"]=e.value);if(d&&f){if(!wy(k,yy(b, equals www.facebook.com (Facebook)
Source: chromecache_525.10.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/b0557ce3\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}var YT;if(!window["YT"])YT={loading:0,loaded:0};var YTConfig;if(!window["YTConfig"])YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: ndis.gov.au
Source: global traffic	DNS traffic detected: DNS query: f1-oc.readspeaker.com
Source: global traffic	DNS traffic detected: DNS query: connect.facebook.net
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: webchat-widget.ndis.gov.au
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: static.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: script.hotjar.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: analytics.google.com
Source: global traffic	DNS traffic detected: DNS query: stats.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: www.youtube.com
Source: global traffic	DNS traffic detected: DNS query: i.ytimg.com
Source: global traffic	DNS traffic detected: DNS query: static.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: yt3.ggpht.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: app-oc.readspeaker.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 06:37:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeserver-timing: dtSInfo;desc="0", dtRpid;desc="2021335837"CF-Cache-Status: EXPIREDExpires: Tue, 01 Oct 2024 06:37:55 GMTCache-Control: public, max-age=86400Server: cloudflareCF-RAY: 8cb235023894c35b-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 30 Sep 2024 06:38:08 GMTServer: ApacheContent-Length: 209Connection: closeContent-Type: text/html; charset=iso-8859-1

Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/understanding/how-ndis-works
Source: chromecache_520.10.dr	Initial sample: https://data.ndis.gov.au/
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/news/stories
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/participants/changing-your-plan
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/news/latest
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/providers/pricing-arrangements
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/stories/10373-mike-says-his-ndis-funding-helps-him-stay-independent
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/stories/10364-michelles-glad-shes-still-path-supporting-people
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/understanding/families-and-carers/early-childhood-approach-children-younger-9
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/stories/10370-ndis-supports-help-koen-play-and-coach-wheelchair-basketball
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/participants/creating-your-plan
Source: chromecache_520.10.dr	Initial sample: https://cloud.e.ndis.gov.au/newsletter_signup
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/news/10425-ndis-providers-receive-grants-co-design-new-payment-options
Source: chromecache_520.10.dr	Initial sample: https://ourguidelines.ndis.gov.au/
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/applying-access-ndis/am-i-eligible
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/participants/working-providers/find-registered-provider
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/news/10303-ceo-statement-getting-ndis-back-track-bill
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/applying-access-ndis
Source: chromecache_520.10.dr	Initial sample: https://improvements.ndis.gov.au/
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/news/10365-grant-round-results-blended-payment-co-design
Source: chromecache_520.10.dr	Initial sample: https://www.ndis.gov.au/participants/using-your-plan

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1360,i,9679507563952575083,13765372778311210832,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "http://mailto:Nadine.McCluskey@ndis.gov.au"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4708 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8
Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Downloads\downloaded.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2036 --field-trial-handle=1620,i,15769612952736250241,8455910719674616377,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1360,i,9679507563952575083,13765372778311210832,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4708 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=2008,i,9694595766097206996,8280027556047011910,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2036 --field-trial-handle=1620,i,15769612952736250241,8455910719674616377,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf	Initial sample: PDF keyword /JS count = 0
Source: THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: downloaded.pdf.crdownload.9.dr	Initial sample: PDF keyword /JS count = 0
Source: downloaded.pdf.crdownload.9.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: 138dbd96-f9b0-4ea3-aace-5a155eec7b23.tmp.9.dr	Initial sample: PDF keyword /JS count = 0
Source: 138dbd96-f9b0-4ea3-aace-5a155eec7b23.tmp.9.dr	Initial sample: PDF keyword /JavaScript count = 0
Source: chromecache_520.10.dr	Initial sample: PDF keyword /JS count = 0
Source: chromecache_520.10.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D6sLoDe5C2S7tFe&MD=ox7yObK5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=D6sLoDe5C2S7tFe&MD=ox7yObK5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_n4cpgH2VmHw18yUfk1NFWEo7PwHLRe2tFDYipFjbtrU.css HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/css/css_pXYAUoSV5tvAlAXUMZn0dt1jRVSQn4OCkU_Mqgw0tl4.css HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /ruxitagentjs_ICA7NQVfghqrux_10299240903104354.js HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/hotjar.script.js?sjlegg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /themes/custom/ndis/logo.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-question-mark.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-tick.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-12/illustration-support-green.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/hotjar.script.js?sjlegg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /themes/custom/ndis/logo.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-question-mark.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /ruxitagentjs_ICA7NQVfghqrux_10299240903104354.js HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-tick.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP
Source: global traffic	HTTP traffic detected: GET /ruxitagentjs_D_10299240903104354.js HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-plan-3-search.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1Host: static.cloudflareinsights.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ndis.gov.ausec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-provider-tick.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/homepage_fullsize/public/hero/2024-08/NDIA%20Website%20Banners_legislation_update%20%28002%29.png?h=78313e81&itok=c9YZV1JS HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-ecei.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /ndia-ncc-webchat-widget.js HTTP/1.1Host: webchat-widget.ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-plan-1-folder.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-12/illustration-support-green.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /c/hotjar-2951610.js?sv=6 HTTP/1.1Host: static.hotjar.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /script/8973/webReader/webReader.js?pids=wr&lang=en_au HTTP/1.1Host: f1-oc.readspeaker.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_zqzLsXbXm3erCMCJqJ1gZdpfzhmZK5F3I4ecdOlnuls.js HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/js/js_vnf7VqzregZt2wUuwbPeLRljDC8X2UDAMOf8qQEVifE.js HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/google_tag/primary/google_tag.script.js?sjlegg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-ecei.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-plan-3-search.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-provider-tick.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-provider-price.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/styles/homepage_fullsize/public/hero/2024-08/NDIA%20Website%20Banners_legislation_update%20%28002%29.png?h=78313e81&itok=c9YZV1JS HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /beacon.min.js/vcd15cbe7772f49c399c6a5babf22c1241717689176015 HTTP/1.1Host: static.cloudflareinsights.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2023-10/231003_PACE%20Soft%20Launch%20icon.svg HTTP/1.1Host: ndis.gov.auConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ndis.gov.au/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825
Source: global traffic	HTTP traffic detected: GET /sites/default/files/icons/2018-11/illustration-plan-1-folder.svg HTTP/1.1Host: ndis.gov.auConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __cf_bm=AYhJXKvHQZ0XF2UEwWv4czhF6WJn40pKOmA6du9Gnl0-1727678161-1.0.1.1-PqSHJt63xbcoQ.frGxevfnUXdEnVXLsnK3eQUZ3auquNO8RvsogVFBQREibj62apODjtwFLGIr9KvJy7v.K0OQ; dtCookie=v_4_srv_-2D85_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP; rxVisitor=1727678163820T4NGLBRCVV38LSQWVAKHHTPPSNC6Q6AU; dtPC=-85$278163815_225h1vIQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0e0; dtSa=-; rxvt=1727679963833\|1727678163825

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 520
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 520			Jump to dropped file

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Process Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Link
ndis.gov.au	0%	Virustotal	Browse
star-mini.c10r.facebook.com	0%	Virustotal	Browse
a.nel.cloudflare.com	0%	Virustotal	Browse
static.cloudflareinsights.com	0%	Virustotal	Browse
i.ytimg.com	0%	Virustotal	Browse
static.doubleclick.net	0%	Virustotal	Browse
stats.g.doubleclick.net	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
scontent.xx.fbcdn.net	0%	Virustotal	Browse
analytics-alv.google.com	0%	Virustotal	Browse
youtube-ui.l.google.com	0%	Virustotal	Browse
script.hotjar.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
static-cdn.hotjar.com	0%	Virustotal	Browse
td.doubleclick.net	0%	Virustotal	Browse
googleads.g.doubleclick.net	0%	Virustotal	Browse
yt3.ggpht.com	0%	Virustotal	Browse
play.google.com	0%	Virustotal	Browse
cdn.jsdelivr.net	0%	Virustotal	Browse
1526497121.rsc.cdn77.org	0%	Virustotal	Browse
connect.facebook.net	0%	Virustotal	Browse
analytics.google.com	0%	Virustotal	Browse
app-oc.readspeaker.com	0%	Virustotal	Browse
www.facebook.com	0%	Virustotal	Browse
f1-oc.readspeaker.com	0%	Virustotal	Browse
static.hotjar.com	0%	Virustotal	Browse
x1.i.lencr.org	0%	Virustotal	Browse
www.youtube.com	0%	Virustotal	Browse
photos-ugc.l.googleusercontent.com	0%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://developers.google.com/youtube/iframe_api_reference#Events	0%	URL Reputation	safe
https://fontawesome.com/license/free	0%	URL Reputation	safe
https://youtu.be/	0%	URL Reputation	safe
http://x1.i.lencr.org/	0%	URL Reputation	safe
https://getbootstrap.com/)	0%	URL Reputation	safe
http://jqueryui.com	0%	URL Reputation	safe
https://github.com/twbs/bootstrap/graphs/contributors)	0%	Virustotal		Browse
https://www.ndis.gov.au/contact/locations	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ndis.gov.au	104.18.41.59	true	false	0%, Virustotal, Browse	unknown
star-mini.c10r.facebook.com	157.240.0.35	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	0%, Virustotal, Browse	unknown
static.cloudflareinsights.com	104.16.79.73	true	false	0%, Virustotal, Browse	unknown
i.ytimg.com	216.58.206.54	true	false	0%, Virustotal, Browse	unknown
app-jp.readspeaker.com	185.78.174.254	true	false		unknown
static.doubleclick.net	142.250.185.134	true	false	0%, Virustotal, Browse	unknown
webchat-widget.ndis.gov.au	104.18.41.59	true	false		unknown
stats.g.doubleclick.net	74.125.206.154	true	false	0%, Virustotal, Browse	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse	unknown
scontent.xx.fbcdn.net	157.240.0.6	true	false	0%, Virustotal, Browse	unknown
youtube-ui.l.google.com	142.250.74.206	true	false	0%, Virustotal, Browse	unknown
analytics-alv.google.com	216.239.34.181	true	false	0%, Virustotal, Browse	unknown
script.hotjar.com	13.33.187.109	true	false	0%, Virustotal, Browse	unknown
googleads.g.doubleclick.net	142.250.186.162	true	false	0%, Virustotal, Browse	unknown
play.google.com	172.217.16.206	true	false	0%, Virustotal, Browse	unknown
photos-ugc.l.googleusercontent.com	216.58.206.65	true	false	0%, Virustotal, Browse	unknown
www.google.com	142.250.186.36	true	false	0%, Virustotal, Browse	unknown
td.doubleclick.net	216.58.206.34	true	false	0%, Virustotal, Browse	unknown
analytics.google.com	142.250.186.142	true	false	0%, Virustotal, Browse	unknown
1526497121.rsc.cdn77.org	143.244.62.6	true	false	0%, Virustotal, Browse	unknown
static-cdn.hotjar.com	18.66.102.11	true	false	0%, Virustotal, Browse	unknown
www.facebook.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
yt3.ggpht.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
f1-oc.readspeaker.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
x1.i.lencr.org	unknown	unknown	false	0%, Virustotal, Browse	unknown
cdn.jsdelivr.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
connect.facebook.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
app-oc.readspeaker.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
static.hotjar.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.youtube.com	unknown	unknown	false	0%, Virustotal, Browse	unknown

Name	Malicious	Reputation
https://www.youtube.com/generate_204?znvg8w	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fparticipants&bp=3&app=d189871191699be4&crc=1951801277&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-tick.svg	false	unknown
https://ndis.gov.au/sites/default/files/styles/tile_image_large/public/images/2023-10/231016_NDIA%20Website%20Tiles_V1_DataResearch.png?h=47626626&itok=jV8VYDSD	false	unknown
https://ndis.gov.au/sites/default/files/styles/tile_image_large/public/images/2018-11/Support%20to%20get%20a%20job%20SML.jpg?h=92a6a039&itok=j-eqXLEA	false	unknown
https://ndis.gov.au/sites/default/files/icons/2019-07/NDIS-tick-data.svg	false	unknown
https://www.youtube.com/embed/ys-jVwjuTHY?autoplay=0&start=0&rel=0&enablejsapi=1&origin=https%3A%2F%2Fndis.gov.au	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-track-your-plan.svg	false	unknown
https://ndis.gov.au/news	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2F%23main-content&bp=3&app=d189871191699be4&crc=985751189&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Flanguages&bp=3&app=d189871191699be4&crc=2352770268&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fapplying-access-ndis%2Fam-i-eligible&bp=3&app=d189871191699be4&crc=3234709865&en=1w0v4cd2&end=1	false	unknown
https://i.ytimg.com/vi_webp/aF3gGRNRnkk/sddefault.webp	false	unknown
https://ndis.gov.au/languages	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fproviders&bp=3&app=d189871191699be4&crc=3847602504&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/themes/custom/ndis/assets/dist/js/chunk/last-section-ee83a4c3af105d057084.js	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fparticipants%2Fusing-your-plan&bp=3&app=d189871191699be4&crc=2595891592&en=1w0v4cd2&end=1	false	unknown
https://www.youtube.com/s/player/b0557ce3/player_ias.vflset/en_US/embed.js	false	unknown
https://www.youtube.com/s/player/b0557ce3/player_ias.vflset/en_US/remote.js	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fapplying-access-ndis&bp=3&app=d189871191699be4&crc=274932755&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fabout-us&bp=3&app=d189871191699be4&crc=4192454940&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/js/js_O3_WAf94hH2u39nwboLm_2i9YAn877rcqKeO_KZBM3c.js	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-manage-ndis-funds.svg	false	unknown
https://ndis.gov.au/sites/default/files/styles/homepage_mobile/public/hero-mobile/2024-08/NDIA%20Website%20Banners_legislation_update%20%28002%29.png?h=78313e81&itok=TaTcxz8G	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2F&bp=3&app=d189871191699be4&crc=4029570574&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/styles/tile_image_large/public/images/2023-10/231016_NDIA%20Website%20Tiles_V1_Improvements.png?h=47626626&itok=ukfSVJBd	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-planning-meeting.svg	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-plan-1-folder.svg	false	unknown
https://ndis.gov.au/sites/default/files/js/js_vnf7VqzregZt2wUuwbPeLRljDC8X2UDAMOf8qQEVifE.js	false	unknown
https://www.youtube.com/generate_204?ac03zg	false	unknown
https://ndis.gov.au/print/pdf/node/4	false	unknown
https://www.youtube.com/s/player/b0557ce3/www-embed-player.vflset/www-embed-player.js	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-modifications.svg	false	unknown
https://ndis.gov.au/cdn-cgi/rum?	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2F%23main-content&bp=3&app=d189871191699be4&crc=341326216&en=1w0v4cd2&end=1	false	unknown
https://f1-oc.readspeaker.com/script/8973/webReader/webReader.js?pids=wr&lang=en_au	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-approved-ndis-plan.svg	false	unknown
https://ndis.gov.au/providers	false	unknown
https://ndis.gov.au/themes/custom/ndis/assets/dist/js/chunk/vendors~tippy-8ff5da44d59d090760be.js	false	unknown
https://ndis.gov.au/participants	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fnews&bp=3&app=d189871191699be4&crc=2816155341&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/styles/tile_image_large/public/images/2019-10/LOGO-I-Heart-NDIS.png?h=6c83441f&itok=kwdkgPt2	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Funderstanding&bp=3&app=d189871191699be4&crc=4092948829&en=1w0v4cd2&end=1	false	unknown
http://ndis.gov.au/	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fparticipants%2Fcreating-your-plan&bp=3&app=d189871191699be4&crc=2663958336&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2F%23block-mainnavigation&bp=3&app=d189871191699be4&crc=2214797534&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/ruxitagentjs_D_10299240903104354.js	false	unknown
https://ndis.gov.au/themes/custom/ndis/assets/dist/images/arrows-right.svg	false	unknown
https://ndis.gov.au/sites/default/files/styles/tile_image_large/public/images/2018-12/Melissa%20Thew%20Coffee%20Beach%202018.jpg?h=a7fcc12a&itok=qHG6LHNK	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-your-questions.svg	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Funderstanding%2Ffamilies-and-carers%2Fearly-childhood-approach-children-younger-9&bp=3&app=d189871191699be4&crc=2801243546&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fparticipants&bp=3&app=d189871191699be4&crc=1030788214&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-your-age.svg	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-support_0.svg	false	unknown
https://i.ytimg.com/vi/5KUkQdG9eg8/maxresdefault.jpg?sqp=-oaymwEmCIAKENAF8quKqQMa8AEB-AH-CYAC0AWKAgwIABABGCkgTih_MA8=&rs=AOn4CLDtnYDjEn-bbwQS85M1YOH_N0s5bw	false	unknown
https://www.google.com/js/th/KZ9qBfv2Fvj8--thF3jkrqmjFIXwxVfodGy5wvrcirQ.js	false	unknown
https://ndis.gov.au/#block-mainnavigation	false	unknown
https://ndis.gov.au/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js	false	unknown
https://ndis.gov.au/sites/default/files/hotjar.script.js?sjlegg	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fparticipants%2Fcreating-your-plan&bp=3&app=d189871191699be4&crc=980352368&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fchanges-ndis-legislation&bp=3&app=d189871191699be4&crc=3268644263&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fapplying-access-ndis%2Fam-i-eligible&bp=3&app=d189871191699be4&crc=910308078&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fnews&bp=3&app=d189871191699be4&crc=324235154&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-stories.svg	false	unknown
https://ndis.gov.au/rb_bf64989qjg?type=js3&sn=v_4_srv_5_sn_P1I6RKUOVKT19710R4SS64Q692TL5PEP_perc_100000_ol_0_mul_1_app-3Ad189871191699be4_1_rcs-3Acss_0&svrid=5&flavor=post&vi=IQANDKOPAPFFURWPCJUPQBPLGOMKPDOE-0&modifiedSince=1726659793268&rf=https%3A%2F%2Fndis.gov.au%2Fnews&bp=3&app=d189871191699be4&crc=4215919885&en=1w0v4cd2&end=1	false	unknown
https://ndis.gov.au/sites/default/files/icons/2018-11/illustration-gov-yes_0.svg	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://ampcid.google.com/v1/publisher:getClientId	chromecache_514.10.dr, chromecache_542.10.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://github.com/twbs/bootstrap/graphs/contributors)	chromecache_492.10.dr, chromecache_540.10.dr, chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false	0%, Virustotal, Browse	unknown
https://www.ndis.gov.au/contact/locations	chromecache_567.10.dr	false	0%, Virustotal, Browse	unknown
https://ourguidelines.ndis.gov.au/understanding-supports	chromecache_528.10.dr	false		unknown
https://www.youtube.com/embed/5KUkQdG9eg8?autoplay=0&start=0&rel=0	chromecache_765.10.dr	false		unknown
https://www.youtube.com/generate_204?cpn=	chromecache_527.10.dr, chromecache_397.10.dr	false		unknown
https://cloud.e.ndis.gov.au/provider_signup	chromecache_741.10.dr	false		unknown
https://drafts.csswg.org/cssom/#serialize-an-identifier	chromecache_400.10.dr, chromecache_715.10.dr, chromecache_617.10.dr, chromecache_403.10.dr	false		unknown
https://www.ndis.gov.au/improvements	chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr, chromecache_402.10.dr, chromecache_567.10.dr, chromecache_741.10.dr, chromecache_426.10.dr	false		unknown
https://github.com/jquery-form/form	chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false		unknown
https://www.dynatrace.com/company/trust-center/customers/reports/	chromecache_569.10.dr, chromecache_684.10.dr	false		unknown
https://www.ndis.gov.au/participants/creating-your-plan)	chromecache_520.10.dr, 138dbd96-f9b0-4ea3-aace-5a155eec7b23.tmp.9.dr, downloaded.pdf.crdownload.9.dr	false		unknown
https://angular.dev/license	chromecache_527.10.dr, chromecache_397.10.dr	false		unknown
https://developers.google.com/youtube/iframe_api_reference#Events	chromecache_724.10.dr, chromecache_702.10.dr	false	URL Reputation: safe	unknown
https://fontawesome.com/license/free	chromecache_492.10.dr, chromecache_540.10.dr, chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false	URL Reputation: safe	unknown
https://youtu.be/	chromecache_527.10.dr, chromecache_397.10.dr	false	URL Reputation: safe	unknown
http://github.com/robloach/jquery-once	chromecache_400.10.dr, chromecache_715.10.dr, chromecache_617.10.dr, chromecache_403.10.dr	false		unknown
https://www.drupal.org/project/webform/issues/3068998	chromecache_601.10.dr, chromecache_538.10.dr, chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false		unknown
https://github.com/Modernizr/Modernizr/blob/c56fb8b09515f629806ca44742932902ac145302/modernizr.js#L6	chromecache_601.10.dr, chromecache_538.10.dr	false		unknown
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.1.dr	false	URL Reputation: safe	unknown
https://css-tricks.com/snippets/jquery/make-an-jquery-hasattr/	chromecache_538.10.dr	false		unknown
https://getbootstrap.com/)	chromecache_492.10.dr, chromecache_540.10.dr, chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false	URL Reputation: safe	unknown
https://ourguidelines.ndis.gov.au/home/becoming-participant/applying-ndis/do-you-meet-disability-req	chromecache_409.10.dr	false		unknown
https://stackoverflow.com/questions/20899274/how-to-refresh-page-on-back-button-click/20899422#20899	chromecache_601.10.dr, chromecache_538.10.dr	false		unknown
https://www.ndis.gov.au/news/latest?f%5B0%5D=news_category%3A141	chromecache_735.10.dr	false		unknown
https://www.youtube.com/user/DisabilityCare	chromecache_487.10.dr, chromecache_555.10.dr, chromecache_382.10.dr, chromecache_528.10.dr, chromecache_765.10.dr, chromecache_409.10.dr, chromecache_725.10.dr, chromecache_735.10.dr, chromecache_485.10.dr, chromecache_619.10.dr, chromecache_557.10.dr, chromecache_402.10.dr, chromecache_567.10.dr, chromecache_741.10.dr, chromecache_426.10.dr	false		unknown
http://youtube.com/drm/2012/10/10	chromecache_527.10.dr, chromecache_397.10.dr	false		unknown
https://www.youtube.com/embed/aF3gGRNRnkk?autoplay=0&start=0&rel=0	chromecache_557.10.dr	false		unknown
https://adservice.google.com/pagead/regclk?	chromecache_732.10.dr	false		unknown
https://www.drupal.org/node/3104677	chromecache_492.10.dr, chromecache_540.10.dr, chromecache_503.10.dr, chromecache_633.10.dr, chromecache_430.10.dr, chromecache_583.10.dr	false		unknown
https://data.ndis.gov.au/)	chromecache_520.10.dr, 138dbd96-f9b0-4ea3-aace-5a155eec7b23.tmp.9.dr, downloaded.pdf.crdownload.9.dr	false		unknown
http://jqueryui.com	chromecache_400.10.dr, chromecache_715.10.dr, chromecache_617.10.dr, chromecache_403.10.dr	false	URL Reputation: safe	unknown
http://schema.org/SearchAction	chromecache_487.10.dr	false		unknown
https://www.drupal.org/node/2445271	chromecache_601.10.dr, chromecache_538.10.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
143.244.62.6	1526497121.rsc.cdn77.org	United States	174	COGENT-174US	false
18.66.102.11	static-cdn.hotjar.com	United States	3	MIT-GATEWAYSUS	false
143.244.62.5	unknown	United States	174	COGENT-174US	false
13.33.187.19	unknown	United States	16509	AMAZON-02US	false
104.18.41.59	ndis.gov.au	United States	13335	CLOUDFLARENETUS	false
142.250.74.206	youtube-ui.l.google.com	United States	15169	GOOGLEUS	false
216.239.34.181	analytics-alv.google.com	United States	15169	GOOGLEUS	false
216.58.206.54	i.ytimg.com	United States	15169	GOOGLEUS	false
142.250.185.100	unknown	United States	15169	GOOGLEUS	false
142.250.185.226	unknown	United States	15169	GOOGLEUS	false
104.16.80.73	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.185.142	unknown	United States	15169	GOOGLEUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
23.22.254.206	unknown	United States	14618	AMAZON-AESUS	false
142.250.186.78	unknown	United States	15169	GOOGLEUS	false
142.250.186.34	unknown	United States	15169	GOOGLEUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.194	unknown	United States	15169	GOOGLEUS	false
216.239.32.181	unknown	United States	15169	GOOGLEUS	false
157.240.0.35	star-mini.c10r.facebook.com	United States	32934	FACEBOOKUS	false
13.33.187.92	unknown	United States	16509	AMAZON-02US	false
23.46.224.162	unknown	United States	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.78.174.254	app-jp.readspeaker.com	Sweden	49959	READSPEAKERSE	false
142.250.186.142	analytics.google.com	United States	15169	GOOGLEUS	false
172.217.16.150	unknown	United States	15169	GOOGLEUS	false
157.240.253.35	unknown	United States	32934	FACEBOOKUS	false
13.33.187.109	script.hotjar.com	United States	16509	AMAZON-02US	false
18.66.102.51	unknown	United States	3	MIT-GATEWAYSUS	false
142.250.185.78	unknown	United States	15169	GOOGLEUS	false
216.58.212.166	unknown	United States	15169	GOOGLEUS	false
216.58.206.34	td.doubleclick.net	United States	15169	GOOGLEUS	false
157.240.0.6	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
172.217.23.110	unknown	United States	15169	GOOGLEUS	false
74.125.206.154	stats.g.doubleclick.net	United States	15169	GOOGLEUS	false
142.250.185.164	unknown	United States	15169	GOOGLEUS	false
104.16.79.73	static.cloudflareinsights.com	United States	13335	CLOUDFLARENETUS	false
172.64.146.197	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.74.196	unknown	United States	15169	GOOGLEUS	false
142.250.186.162	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
172.217.16.206	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.134	static.doubleclick.net	United States	15169	GOOGLEUS	false
216.58.206.65	photos-ugc.l.googleusercontent.com	United States	15169	GOOGLEUS	false
142.250.185.132	unknown	United States	15169	GOOGLEUS	false
142.250.185.214	unknown	United States	15169	GOOGLEUS	false
157.240.251.9	unknown	United States	32934	FACEBOOKUS	false
142.250.185.130	unknown	United States	15169	GOOGLEUS	false
142.250.184.214	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1522477
Start date and time:	2024-09-30 08:34:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf
Detection:	CLEAN
Classification:	clean2.winPDF@86/630@137/49
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Browse: https://ndis.gov.au/community Browse: https://ndis.gov.au/participants/creating-your-plan Browse: https://ndis.gov.au/participants Browse: https://ndis.gov.au/providers Browse: https://ndis.gov.au/languages Browse: https://ndis.gov.au/applying-access-ndis Browse: https://ndis.gov.au/applying-access-ndis/am-i-eligible Browse: https://ndis.gov.au/participants/using-your-plan Close Viewer Browse: https://ndis.gov.au/news Browse: https://ndis.gov.au/changes-ndis-legislation Browse: https://ndis.gov.au/understanding/families-and-carers/early-childhood-approach-children-younger-9 Browse: https://ndis.gov.au/#main-content Browse: https://ndis.gov.au/#block-mainnavigation Browse: https://ndis.gov.au/print/pdf/node/4 Browse: https://ndis.gov.au/understanding Browse: https://ndis.gov.au/about-us Browse: https://app-oc.readspeaker.com/cgi-bin/rsent?customerid=8973&lang=en_au&readclass=screen-reader&url=https%3A%2F%2Fndis.gov.au%2Fnode%2F4 Browse: https://ndis.gov.au/understanding/how-ndis-works

Input	Output
URL: https://ndis.gov.au/community Model: jbxai	{ "brand":["ewamax"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"CONTACT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: PDF document Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/creating-your-plan Model: jbxai	{ "brand":["ewamax"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"CONTACT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/creating-your-plan Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants Model: jbxai	{ "brand":["ewamax"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"CONTACT", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/ Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"For children younger than 9", "prominent_button_name":"Learn more", "text_input_field_labels":["How the NDIS works", "Am I eligible?", "How do I apply?", "Creating your plan", "Using your plan", "Changing your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/providers Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/community Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/languages Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"For children younger than 9", "prominent_button_name":"Learn more", "text_input_field_labels":["How the NDIS works", "Am I eligible?", "How do I apply?", "Creating your plan", "Using your plan", "Changing your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/ Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"For children younger than 9", "prominent_button_name":"Learn more", "text_input_field_labels":["How the NDIS works", "Am I eligible?", "How do I apply?", "Creating your plan", "Using your plan", "Changing your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/community Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/applying-access-ndis Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/providers Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/creating-your-plan Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"To get ready for your planning meeting, think about your immediate support needs and your current and future goals.", "prominent_button_name":"Listen", "text_input_field_labels":["Print this page", "Save page as PDF"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/creating-your-plan Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"To get ready for your planning meeting, think about your immediate support needs and your current and future goals.", "prominent_button_name":"Listen", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/applying-access-ndis Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Applying to access the NDIS", "prominent_button_name":"Listen", "text_input_field_labels":["Print this page", "Save page as PDF"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/using-your-plan Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/applying-access-ndis Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"If you think you are eligible for the NDIS", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/news Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Applying to access the NDIS", "prominent_button_name":"Listen", "text_input_field_labels":["Print this page", "Save page as PDF"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/changes-ndis-legislation Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"If you think you are eligible for the NDIS", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/using-your-plan Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Using your plan", "prominent_button_name":"Listen", "text_input_field_labels":["Help starting your plan", "Understanding your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/understanding/families-and-carers/early-childhood-approach-children-younger-9 Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"If you think you are eligible for the NDIS", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/#main-content Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Using your plan", "prominent_button_name":"Listen", "text_input_field_labels":["Help starting your plan", "Understanding your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/applying-access-ndis/am-i-eligible Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/applying-access-ndis/am-i-eligible Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/changes-ndis-legislation Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/print/pdf/node/4 Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Using your plan", "prominent_button_name":"Listen", "text_input_field_labels":["Help starting your plan", "Understanding your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/participants/using-your-plan Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"Using your plan", "prominent_button_name":"Listen", "text_input_field_labels":["Help starting your plan", "Understanding your plan"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/understanding/families-and-carers/early-childhood-approach-children-younger-9 Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/news Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/#block-mainnavigation Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://app-oc.readspeaker.com/cgi-bin/rsent?customerid=8973&lang=en_au&readclass=screen-reader&url=https%3A%2F%2Fndis.gov.au%2Fnode%2F4 Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/understanding/how-ndis-works Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"We're introducing a new computer system and some improvements to the way we deliver the NDIS. Find out about what we're doing next.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://ndis.gov.au/understanding/how-ndis-works Model: jbxai	{ "brand":["NDIS"], "contains_trigger_text":true, "trigger_text":"We're introducing a new computer system and some improvements to the way we deliver the NDIS. Find out about what we're doing next.", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF5181f7.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF518245.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2dfa33b4-7259-49ce-8ef5-84e076bf847f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8fa09ffe-c32b-4948-9702-a8e088927c13.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF51c52a.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF518320.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240930063509Z-171.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240930063827Z-192.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Windows Analysis Report
THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
23.22.254.206	#U0631#U0648#U0632 #U0633#U06cc#U0627#U0647 #U06a9#U0627#U0631#U06af#U0631.exe	Get hash	malicious	Unknown	Browse
	WOT0089836_Electrical_Single_Line_diagram%2C_lighting__RR_docx_3461849704.pdf	Get hash	malicious	Unknown	Browse
	original.eml	Get hash	malicious	HTMLPhisher	Browse
	Payment Confirmation-- (2).pdf	Get hash	malicious	HTMLPhisher	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:626535c6-68da-4729-b016-6e974989fb70	Get hash	malicious	LummaC Stealer	Browse
	https://acrobat.adobe.com/id/urn:aaid:sc:US:4a1d4a71-0ecb-4b97-81ac-6d37886bcc89	Get hash	malicious	LummaC Stealer	Browse
	Keyser & Mackay.pdf	Get hash	malicious	Unknown	Browse
	Money Fellows Signatures Consent Docs#122531(Revised).pdf	Get hash	malicious	Unknown	Browse
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse
18.66.102.11	https://whm.agcofarm.com/	Get hash	malicious	Unknown	Browse
	https://cpanel.whitewestinghouse.com.py/	Get hash	malicious	Unknown	Browse
	https://basepro-login.gitbook.io/login	Get hash	malicious	HTMLPhisher	Browse
	http://loginmitamasks.gitbook.io/	Get hash	malicious	Unknown	Browse
	https://coinbassprolhgiu.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	https://cbbaeprologeu.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://krakecnlogs.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://comzbasesign-ins.gitbook.io/	Get hash	malicious	Unknown	Browse
	http://metauscvxlkogimens.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
	https://exudus-walet.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
13.33.187.19	https://cpanel.whitewestinghouse.com.py/	Get hash	malicious	Unknown	Browse
	https://coinnbaeeprologin.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse
	https://cbbaeprologeu.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://coinnbaeeprologin.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
	https://mattiamsk-wallaat.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse
	http://metauscvxlkogimens.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
	http://ingresosoporte.ru/	Get hash	malicious	Unknown	Browse
	http://gemenilogiin.gitbook.io/	Get hash	malicious	Unknown	Browse
	https://krakenmlogina.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse
	http://cbbaeprologeu.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse
104.16.80.73	https://gemmni-lgi.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse
	http://qiudbkj.mmm.page/	Get hash	malicious	Unknown	Browse
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse
	https://ipfs.io/ipfs/QmUcxG9XYwfiVnjaf6ugfmt6iPHAdNuk7o3cqDa64AYtKB	Get hash	malicious	HTMLPhisher	Browse
	https://airdrop-manta.com/	Get hash	malicious	Unknown	Browse
	https://solanadefimainnet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse
	http://install.convertwithwave.com	Get hash	malicious	Unknown	Browse
	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse
	http://tokenpblket.com/	Get hash	malicious	HTMLPhisher	Browse
	http://ecometanexus.unids.com/	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
script.hotjar.com	https://cpanel.benory.digitall-communication.com/	Get hash	malicious	Unknown	Browse	13.227.219.120
	https://whm.agcofarm.com/	Get hash	malicious	Unknown	Browse	13.33.187.109
	https://cpanel.whitewestinghouse.com.py/	Get hash	malicious	Unknown	Browse	13.33.187.92
	http://geimuinislonggu.gitbook.io/	Get hash	malicious	Unknown	Browse	13.33.187.109
	https://coinnbaeeprologin.gitbook.io/us	Get hash	malicious	HTMLPhisher	Browse	13.33.187.19
	https://basepro-login.gitbook.io/login	Get hash	malicious	HTMLPhisher	Browse	13.33.187.109
	http://gembuulogin.gitbook.io/	Get hash	malicious	Unknown	Browse	13.33.187.92
	http://comsbisaeprelogiun.gitbook.io/	Get hash	malicious	HTMLPhisher	Browse	13.33.187.109
	http://loginmitamasks.gitbook.io/	Get hash	malicious	Unknown	Browse	13.33.187.74
	https://coinbassprolhgiu.gitbook.io/us/	Get hash	malicious	HTMLPhisher	Browse	13.33.187.74
static.cloudflareinsights.com	http://alma.ymyxsh.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://ka.digitalbankbrics.com/	Get hash	malicious	Unknown	Browse	104.16.79.73
	https://gemmni-lgi.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	104.16.80.73
	http://qiudbkj.mmm.page/	Get hash	malicious	Unknown	Browse	104.16.80.73
	https://ebaite.cn/	Get hash	malicious	Unknown	Browse	104.16.80.73
	https://ipfs.io/ipfs/QmUcxG9XYwfiVnjaf6ugfmt6iPHAdNuk7o3cqDa64AYtKB	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	https://airdrop-manta.com/	Get hash	malicious	Unknown	Browse	104.16.80.73
	http://en-alldappfix.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	https://solanadefimainnet.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.16.80.73
	http://nodechain-launchpadlpx.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
bg.microsoft.map.fastly.net	https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg	Get hash	malicious	Unknown	Browse	199.232.214.172
	yVhGfho0R4.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	https://pokegamaclub.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	Transmission Cost Database 2.0.xlsb	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://okfun188.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mukirecords.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://budivenut.com/bAGMhBTY81DQ0DRMJ1XOQUUSFVUf9ARgYwDOI1O1UxFG8AJXEwDbZRAlQiDHcDIShTNa4gYPQjUu8AKO81BR	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	PureCrypter	Browse	199.232.214.172
app-jp.readspeaker.com	https://www.alsok.co.jp/	Get hash	malicious	Unknown	Browse	185.78.174.254
app-jp.readspeaker.com	http://alsok.co.jp	Get hash	malicious	Unknown	Browse	185.78.174.254

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	38.180.87.102
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	199.100.223.212
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	38.237.211.64
	KbgbtpUE4g.exe	Get hash	malicious	GhostRat, Nitol	Browse	206.119.171.39
	https://www.iphone.trustefy.org/	Get hash	malicious	Unknown	Browse	154.59.122.79
	http://www.telegroeem.com/	Get hash	malicious	Unknown	Browse	149.104.74.86
	http://sellerthirteen.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	https://sellerfourth.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	https://sellerfifteen.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	http://sellerfifth.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
COGENT-174US	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	38.180.87.102
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	199.100.223.212
	SecuriteInfo.com.Linux.Siggen.9999.30976.5557.elf	Get hash	malicious	Mirai	Browse	38.237.211.64
	KbgbtpUE4g.exe	Get hash	malicious	GhostRat, Nitol	Browse	206.119.171.39
	https://www.iphone.trustefy.org/	Get hash	malicious	Unknown	Browse	154.59.122.79
	http://www.telegroeem.com/	Get hash	malicious	Unknown	Browse	149.104.74.86
	http://sellerthirteen.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	https://sellerfourth.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	https://sellerfifteen.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
	http://sellerfifth.eur-tiktokshop.com/	Get hash	malicious	Unknown	Browse	38.45.125.66
MIT-GATEWAYSUS	https://cpanel.benory.digitall-communication.com/	Get hash	malicious	Unknown	Browse	18.66.102.51
	https://whm.agcofarm.com/	Get hash	malicious	Unknown	Browse	18.66.102.11
	https://mx1.margarettaphilomena.net/	Get hash	malicious	Unknown	Browse	18.65.39.128
	https://cpanel.whitewestinghouse.com.py/	Get hash	malicious	Unknown	Browse	18.66.102.11
	https://summary.xoetispetcarerewards.com/	Get hash	malicious	Unknown	Browse	18.66.121.135
	https://www.givingday.communityschoolnaples.org/	Get hash	malicious	Unknown	Browse	18.173.205.14
	http://hdelm7ye84n38d9lvch0ev4c0.js.wpuserpowered.com/	Get hash	malicious	Unknown	Browse	18.172.112.118
	http://www.safari.com/	Get hash	malicious	Unknown	Browse	18.66.102.51
	https://www.dropbox.com/l/scl/AABP2xOO01sAb_g6Yf7--zZVCXd20jwYUa4	Get hash	malicious	Unknown	Browse	18.66.122.107
	http://geimuinislonggu.gitbook.io/	Get hash	malicious	Unknown	Browse	18.66.112.79
AMAZON-02US	shipping documents_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	84.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	54.171.96.34
	Shipping Documents_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SecuriteInfo.com.Linux.Siggen.9999.28931.8128.elf	Get hash	malicious	Mirai	Browse	46.137.223.255
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	184.77.13.166
	SecuriteInfo.com.Linux.Siggen.9999.28522.3483.elf	Get hash	malicious	Mirai	Browse	35.183.153.123
	https://polidos.com/	Get hash	malicious	Unknown	Browse	52.222.236.94
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	54.74.102.83
	https://ole798.com/	Get hash	malicious	Unknown	Browse	52.214.31.35

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://wwvmicrosx.live/office365/office_cookies/main	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	https://www.google.ad/amp/clck.ru/3DSSA9?hghgHGHGHJGhghdgddghfhghfgdgdgdgfhgg?sdfsewsrewrettfg	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	SecuriteInfo.com.Win32.Evo-gen.16378.4678.exe	Get hash	malicious	Amadey, Stealc	Browse	184.28.90.27 20.114.59.183
	https://en.softonic.com	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	http://jeevankiranfoundationcenter.co.in/css/rrp.htm	Get hash	malicious	Kutaki	Browse	184.28.90.27 20.114.59.183
	https://polidos.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://pokerfanboy.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	https://polap77.com/	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 20.114.59.183
	https://pokegamaclub.com/	Get hash	malicious	Unknown	Browse	184.28.90.27 20.114.59.183
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	184.28.90.27 20.114.59.183

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.186602261717714
Encrypted:	false
SSDEEP:	6:PIYL+q2Pwkn2nKuAl9OmbnIFUt82II1Zmw+2IeLVkwOwkn2nKuAl9OmbjLJ:P/L+vYfHAahFUt82R/+2NLV5JfHAaSJ
MD5:	C743361EB494139006979725A3DE9CAC
SHA1:	778096DC5C8FD2EDCA4EE9D48797FBD95EAD7A1D
SHA-256:	C79C090509D6694F794F009A3603E563D742EADD12FBD8A8EA730BBD634EECF8
SHA-512:	CCD10900B8B1AC4D8231CBCE4E58779DBFE0FC6AC1232B4D93B41F9F1959ED71F90F971FA544FDE45308EE28BA4EAC7EA358CD2B351AD539B8A91AAC0EC457C6
Malicious:	false
Reputation:	low
Preview:	2024/09/30-02:38:22.619 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/09/30-02:38:22.622 1c7c Recovering log #3.2024/09/30-02:38:22.622 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PDF document, version 1.7, 0 pages
Category:	dropped
Size (bytes):	67711
Entropy (8bit):	7.324309282260586
Encrypted:	false
SSDEEP:	1536:CwVXZRoP1Pu/llwA/xP06mJ2mmcs7F4ItvUqK:CAZRyFu9GExPcJ2X7LQ
MD5:	74E6538505F35DD830F482A9C3F6CAC5
SHA1:	920630307B630A8875715F7EE23BE16703909D4C
SHA-256:	0531419B0EC612B8C2C2D36C8D3AEFA8C712D0F505050F77ED147E6ABB524D47
SHA-512:	0F59C6E9E5EF54294291A5C3E036B8D41DD86AE8221E85C4ED5683A3F2B98FE7683F9F16223A26205F62F87C06E9C3EF16005A7B5C7A25C206BD30B395A27E56
Malicious:	false
Preview:	%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.65 0 R.90 0 R.128 0 R.157 0 R.195 0 R.]./Count 6./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 13 0 R./F3 18 0 R.>>./XObject << ./I1 63 0 R./I2 64 0 R.>>./ExtGState << ./GS1 59 0 R./GS2 60 0 R.>>.>>./MediaBox [0.000 0.000 612.000 792.000]. >>.endobj.4 0 obj.[/PDF /Text /ImageC ].endobj.5 0 obj.<<./Producer (...d.o.m.p.d.f. .2...0...4. .+. .C.P.D.F)./CreationDate (D:20240929002042+10'00')./ModDate (D:20240929002042+10'00')./Title (...W.e.l.c.o.m.e. .t.o. .t.h.e. .n.e.w. .N.D.I.S. .w.e.b.s.i.t.e).>>.endobj.6 0 obj.<< /Type /Page./MediaBox [0.000 0.000 612.000 792.000]./Parent 3 0 R./Annots [ 24 0 R 26 0 R 28 0 R 30 0 R 32 0 R 34 0 R 36 0 R 39 0 R 41 0 R 43 0 R 45 0 R 47 0 R 49 0 R 51 0 R 53 0 R 55 0 R 57 0 R ]./Contents 7 0 R.>>.endobj.7 0 obj.<< /Filter /FlateDecode./Length 1282 >>.stream.x..X.r.6..._.]....7.l2m......x.d...

File type:	PDF document, version 1.7 (zip deflate encoded)
Entropy (8bit):	7.985484299245902
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	THEODOSIADIS, Arthur_2024 6184_Planning_T Docs.pdf
File size:	9'500'605 bytes
MD5:	f96e40b4174c70cb18e24a5218a5083d
SHA1:	71eb30ccb9b4338842f33ab4f317a42ea88ac7d5
SHA256:	68c929f9276faf476a4cc602bda467199a2ae5e3763a8b12c1f7ffff8a3712c3
SHA512:	77dfb253c782c44489d08dc42cb120f9fadd1f3e5bb5cfe1c6dc28615d970f6833f5ad96ab8b9267e57141765db3b1fcd9041009dd65d896f930238f444891df
SSDEEP:	196608:gqq6RD+6DFaWw9oJFwgDXMS79aWkOEvwWfU:gqtRyqFaX9aDtkW4YMU
TLSH:	60A622E48253DD4CD4A58230BE0F0A5373BD70D07B0A54777A99CEBE4752EA268D0AED
File Content Preview:	%PDF-1.7.%......2650 0 obj.<</Linearized 1/L 9488587/O 2652/E 97348/N 289/T 9485809/H [ 509 2614]>>.endobj. ..2668 0 obj.<</DecodeParms<</Columns 5/Predictor 12>>/Filter/FlateDecode/ID[<D6C046DBD909CB48BDBA874D05BB8EA6><F0E95AF2D0B60240A3B5B45F7A8D7

General
Header:	%PDF-1.7
Total Entropy:	7.985484
Total Bytes:	9500605
Stream Entropy:	7.989680
Stream Bytes:	9209870
Entropy outside Streams:	5.360328
Bytes outside Streams:	290735
Number of EOF found:	3
Bytes after EOF:

Name	Count
obj	1543
endobj	1543
stream	1199
endstream	1199
xref	0
trailer	0
startxref	3
/Page	291
/Encrypt	0
/ObjStm	59
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	37
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
110	0000000000000000	3a9d129f388a0a9fd4c4afc4b74b1239
112	0000000000000000	80c1cece96fad8017e19873ae4f3bd3c
118	0000000000000000	f4b414eef9fca33a2362a3a6b1e087d4
120	0000000000000000	78759c1a5387a50702a7983292c893c8
126	0000000000000000	b2d5b2edea1ada69d4991a014101aa6a